Privacy Policy

Daloop.com ("Daloop," "we," "us," "our") respects your privacy. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and the rights you have over it.

This policy applies to the Daloop website, dashboard, signals, alerts, paper-trading portfolio, and any other features we offer (collectively, the "Service"). It does not apply to third-party services we link to but do not control.

Information you provide. When you create an account, subscribe, or contact support, we collect: your name, email address, billing address, and any information you choose to include in support messages.

Account preferences. Your selected plan, billing cycle (monthly or annual), trial status, watchlist tickers, alert preferences, paper-trading portfolio trades, and theme (light or dark mode).

Usage data. Pages you view within the Service, features you interact with, browser type and version, device identifiers, and approximate location derived from IP address. We collect this to operate, secure, and improve the Service.

Payment data. In production, payment information is handled by our payment processor (Stripe). We never receive or store your full card number; we receive only a token, the last four digits, and the card brand.

Communications data. If you email support@daloop.com, we keep the content of your message and our reply for quality and record-keeping purposes.

We use your information to:

• Operate, maintain, and improve the Service and its 14 dashboard views.
• Generate and deliver the BUY/SELL signals, alerts, and paper- trading portfolio records you request.
• Process subscription payments, handle plan upgrades, downgrades, and cancellations, and send renewal notices.
• Communicate with you about product updates, security issues, and policy changes.
• Investigate and prevent fraud, abuse, and violations of our Terms of Service.
• Comply with our legal obligations, including tax and financial record-keeping.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information under the following legal bases:

• Performance of a contract — to deliver the Service, process payments, and provide the signals and dashboard features you subscribed to.
• Legitimate interests — to operate, secure, and improve the Service, communicate with you, and prevent fraud, where those interests are not overridden by your rights.
• Legal obligation — to comply with applicable tax, financial, and record-keeping laws.
• Consent — for optional analytics and marketing communications, which you can withdraw at any time.

We use cookies and similar technologies to keep you signed in, remember your theme preference, and operate the Service. We do not use advertising cookies.

• Essential cookies — required for account authentication and session management. The Service does not function without them.
• Preference cookies — store your light/dark theme selection, watchlist, and dashboard view state on your device.
• Analytics cookies — if enabled, help us understand aggregate usage patterns so we can improve the Service. You can disable these without losing functionality.

Most browsers let you refuse or delete cookies. Doing so may limit some Service features (for example, you may need to sign in more often).

We do not sell your personal information. We share it only as described below:

• Service providers — vendors that help us operate the Service, such as payment processing (Stripe), cloud hosting, transactional email, and analytics. These providers are bound by contracts that limit their use of your information.
• Legal compliance — when required by law, court order, or to protect the rights, property, or safety of Daloop, our users, or others.
• Business transfers — in connection with a merger, acquisition, or sale of all or part of our business, subject to the confidentiality protections described in this policy.

Third-party service providers. We engage the following providers to process personal information on our behalf. Each provider is bound by a written contract that limits its use of your information to the purposes described below and requires it to safeguard your information with measures no less rigorous than those described in this policy.

• Stripe — payment processing. Processes your card number, billing address, and authentication tokens. Stripe does not share your full card number with us; we receive only a token, the last four digits, and the card brand. Legal basis: necessary for performance of the contract (taking payment for your subscription).
• Tiingo — market-data provider for U.S. stocks and ETFs. Receives only the ticker symbols and date ranges needed to retrieve OHLCV data; does not process your personal information. Legal basis: necessary for performance of the contract (delivering the signals you subscribed to).
• Tiingo — cryptocurrency market-data provider. Receives only the ticker symbols and date ranges needed to retrieve OHLCV data; does not process your personal information. Legal basis: necessary for performance of the contract (delivering the signals you subscribed to).
• MailerLite — email-marketing platform. Processes your email address and, if you have provided it, your name, for the sole purpose of sending marketing emails — and only after you have opted in. You can unsubscribe at any time using the link in any marketing email. Legal basis: consent, withdrawable at any time.
• Google Analytics with Cookiebot — analytics and cookie-consent management. Processes browsing data (pages viewed, features used), device identifiers, and approximate location derived from IP address. Google Analytics is configured to anonymize IP addresses where applicable; Cookiebot records and enforces your consent to non-essential cookies. Legal basis: consent, withdrawable through the cookie banner at any time.
• NextAuth.js — open-source authentication library used to manage sign-in. Processes your email address, a salted hash of your password, and session tokens used to keep you signed in. Authentication data is stored in our database and is never shared with third parties. Legal basis: necessary for performance of the contract (operating your account).
• Namecheap Private Email / SMTP — transactional email delivery. Processes your email address to deliver password-reset messages, account-verification messages, and service notices such as renewal receipts and policy-change notifications. Legal basis: necessary for performance of the contract and our legitimate interest in operating the Service.

We keep your personal information for the duration of your account and delete it within 30 days of account closure, except where longer retention is required by applicable tax, financial, or record-keeping law. The specific retention periods are:

• Active accounts — retained for the life of your account, plus the duration needed for billing and tax record-keeping.
• Closed accounts — account preferences, watchlist, and portfolio data are deleted within 30 days of account closure, except where retention is required for legal or accounting purposes.
• Server logs — kept for up to 90 days for security and abuse prevention.
• Support communications — kept for up to 2 years for quality and dispute resolution.

We use industry-standard safeguards to protect your personal information, including encrypted transmission (TLS) and encrypted storage for sensitive data. Access is restricted to authorized personnel who need it to operate the Service.

No method of transmission or electronic storage is completely secure. We cannot guarantee absolute security, but we work continuously to keep the Service protected.

In the event of a data breach affecting your personal information, we will notify you and the relevant supervisory authority as required by applicable law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information (subject to legal exceptions).
• Restrict or object to our processing of your information.
• Receive a portable copy of your information in a structured, machine-readable format.
• Withdraw consent to processing based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at support@daloop.com. We will respond within 30 days.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). This section describes those rights and how to exercise them.

Categories of Personal Information We Collect

Under California law, we collect the following categories of personal information:

• Identifiers — name, email address, account credentials.
• Commercial information — subscription plan, billing cycle, payment history, Stripe customer ID.
• Internet activity — watchlist, alert preferences, chatbot conversation history, dashboard usage.
• Financial data — payment method (processed by Stripe; we do not store full card numbers).

Your California Privacy Rights

• The right to know — what personal information we collect, sell, or share, and with whom.
• The right to delete — request deletion of your personal information (subject to legal exceptions such as completing transactions and complying with legal obligations).
• The right to correct — request correction of inaccurate personal information.
• The right to opt out of sale or sharing — Daloop does not sell personal information as defined by the CCPA/CPRA, and does not share personal information for cross-context behavioral advertising. No opt-out is necessary.
• The right to limit use of sensitive personal information — we do not collect sensitive personal information (as defined by CPRA) beyond what is necessary to provide the Service.
• The right not to be discriminated against — we will not discriminate against you for exercising your privacy rights.

Other State Privacy Rights

If you are a resident of Colorado, Virginia, Connecticut, Utah, or another U.S. state with a comprehensive privacy law, you have similar rights to access, delete, correct, and opt out of processing of your personal information. To submit a request under any U.S. state privacy law, contact us at support@daloop.com. We will verify your identity before responding.

Shine the Light Law

Under California's Shine the Light law, California residents may request information about our disclosures of personal information to third parties for their direct marketing purposes. Daloop does not share personal information with third parties for their direct marketing purposes.

The Service is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a child, contact us at support@daloop.com and we will delete it.

Daloop is based in the United States. If you access the Service from outside the U.S., your information will be transferred to the U.S. and processed there.

For users in the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses for the transfer of personal information to the U.S., or another lawful transfer mechanism where applicable.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

We encourage you to review this policy periodically. Your continued use of the Service after a change takes effect constitutes your acceptance of the revised policy.

If you have questions about this Privacy Policy or your personal information, contact us:

• By email: support@daloop.com
• See also our Terms of Service and Disclaimer.
• Company: Daloop.com