Privacy Policy

Daloop.com ("Daloop," "we," "us," "our") respects your privacy. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and the rights you have over it.

This policy applies to the Daloop website, dashboard, signals, alerts, paper-trading portfolio, and any other features we offer (collectively, the "Service"). It does not apply to third-party services we link to but do not control.

Information you provide. When you create an account, subscribe, or contact support, we collect: your name, email address, billing address, and any information you choose to include in support messages.

Account preferences. Your selected plan, billing cycle (monthly or annual), trial status, watchlist tickers, alert preferences, paper-trading portfolio trades, and theme (light or dark mode).

Usage data. Pages you view within the Service, features you interact with, browser type and version, device identifiers, and approximate location derived from IP address. We collect this to operate, secure, and improve the Service.

Payment data. In production, payment information is handled by our payment processor (Stripe). We never receive or store your full card number; we receive only a token, the last four digits, and the card brand.

Communications data. If you email support@daloop.com, we keep the content of your message and our reply for quality and record-keeping purposes.

We use your information to:

• Operate, maintain, and improve the Service and its 14 dashboard views.
• Generate and deliver the BUY/SELL signals, alerts, and paper- trading portfolio records you request.
• Process subscription payments, handle plan upgrades, downgrades, and cancellations, and send renewal notices.
• Communicate with you about product updates, security issues, and policy changes.
• Investigate and prevent fraud, abuse, and violations of our Terms of Service.
• Comply with our legal obligations, including tax and financial record-keeping.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information under the following legal bases:

• Performance of a contract — to deliver the Service, process payments, and provide the signals and dashboard features you subscribed to.
• Legitimate interests — to operate, secure, and improve the Service, communicate with you, and prevent fraud, where those interests are not overridden by your rights.
• Legal obligation — to comply with applicable tax, financial, and record-keeping laws.
• Consent — for optional analytics and marketing communications, which you can withdraw at any time.

We use cookies and similar technologies to keep you signed in, remember your theme preference, operate the Service, and attribute affiliate referrals. The categories below describe the cookies we use and their purpose.

• Essential cookies — required for account authentication and session management. The Service does not function without them.
• Preference cookies — store your light/dark theme selection, watchlist, and dashboard view state on your device.
• Affiliate / marketing cookies — used for conversion attribution by our affiliate network (Awin). When you click an affiliate referral link to Daloop, Awin sets a first-party cookie named awc in your browser. Theawc cookie is HTTP-only (not readable by JavaScript on the page), marked Secure, and expires 365 days after the click. It contains Awin's click reference identifier and allows Awin to attribute any subsequent subscription purchase to the referring partner so that the partner can be paid a commission. Daloop also loads the Awin MasterTag (a small JavaScript library hosted athttps://www.dwin1.com/130007.js) on every page; the MasterTag is required for Awin to operate its tracking and conversion attribution and may set or read additional technical cookies under Awin's control. You can delete theawc cookie from your browser at any time; note that because it is set server-side when you arrive via an affiliate link, it is set before the cookie banner appears.
• Analytics cookies — if enabled, help us understand aggregate usage patterns so we can improve the Service. You can disable these without losing functionality.

Most browsers let you refuse or delete cookies. Doing so may limit some Service features (for example, you may need to sign in more often, or you may forfeit affiliate-referral attribution for any partner who referred you).

We do not sell your personal information. We share it only as described below:

• Service providers — vendors that help us operate the Service, such as payment processing (Stripe), cloud hosting, transactional email, and analytics. These providers are bound by contracts that limit their use of your information.
• Legal compliance — when required by law, court order, or to protect the rights, property, or safety of Daloop, our users, or others.
• Business transfers — in connection with a merger, acquisition, or sale of all or part of our business, subject to the confidentiality protections described in this policy.

Third-party service providers. We engage the following providers to process personal information on our behalf. Each provider is bound by a written contract that limits its use of your information to the purposes described below and requires it to safeguard your information with measures no less rigorous than those described in this policy.

• Stripe — payment processing. Processes your card number, billing address, and authentication tokens. Stripe does not share your full card number with us; we receive only a token, the last four digits, and the card brand. Legal basis: necessary for performance of the contract (taking payment for your subscription).
• Tiingo — market-data provider for U.S. stocks and ETFs. Receives only the ticker symbols and date ranges needed to retrieve market data; does not process your personal information. Legal basis: necessary for performance of the contract (delivering the signals you subscribed to).
• Tiingo — cryptocurrency market-data provider. Receives only the ticker symbols and date ranges needed to retrieve market data; does not process your personal information. Legal basis: necessary for performance of the contract (delivering the signals you subscribed to).
• MailerLite — email-marketing platform. Processes your email address and, if you have provided it, your name, for the sole purpose of sending marketing emails — and only after you have opted in. You can unsubscribe at any time using the link in any marketing email. Legal basis: consent, withdrawable at any time.
• Google Analytics with Cookiebot — analytics and cookie-consent management. Processes browsing data (pages viewed, features used), device identifiers, and approximate location derived from IP address. Google Analytics is configured to anonymize IP addresses where applicable; Cookiebot records and enforces your consent to non-essential cookies. Legal basis: consent, withdrawable through the cookie banner at any time.
• NextAuth.js — open-source authentication library used to manage sign-in. Processes your email address, a salted hash of your password, and session tokens used to keep you signed in. Authentication data is stored in our database and is never shared with third parties. Legal basis: necessary for performance of the contract (operating your account).
• Namecheap Private Email / SMTP — transactional email delivery. Processes your email address to deliver password-reset messages, account-verification messages, and service notices such as renewal receipts and policy-change notifications. Legal basis: necessary for performance of the contract and our legitimate interest in operating the Service.
• Awin — affiliate marketing network. Processes theawc affiliate-referral cookie (a first-party, HTTP-only, Secure cookie with a 365-day expiry set when you click an affiliate link), the order amount, an order reference, the voucher code (if any), and a customer-acquisition type (new vs. existing) on checkout completion. Awin also loads the MasterTag (a JavaScript library hosted athttps://www.dwin1.com/130007.js) on every page of the Service to enable conversion tracking. We pass theawc value through to Stripe as session metadata so that commissions can be attributed correctly at checkout. We do not transmit your name, email, or card details to Awin. See our Terms of Service for the affiliate disclosure. Legal basis: our legitimate interest in operating an affiliate marketing program that compensates referring partners for successful referrals. You can delete the awc cookie from your browser at any time to opt out of affiliate attribution.

We keep your personal information for the duration of your account and delete it within 30 days of account closure, except where longer retention is required by applicable tax, financial, or record-keeping law. The specific retention periods are:

• Active accounts — retained for the life of your account, plus the duration needed for billing and tax record-keeping.
• Closed accounts — account preferences, watchlist, and portfolio data are deleted within 30 days of account closure, except where retention is required for legal or accounting purposes.
• Server logs — kept for up to 90 days for security and abuse prevention.
• Support communications — kept for up to 2 years for quality and dispute resolution.

We use industry-standard safeguards to protect your personal information, including encrypted transmission (TLS) and encrypted storage for sensitive data. Access is restricted to authorized personnel who need it to operate the Service.

No method of transmission or electronic storage is completely secure. We cannot guarantee absolute security, but we work continuously to keep the Service protected.

In the event of a data breach affecting your personal information, we will notify you and the relevant supervisory authority as required by applicable law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information (subject to legal exceptions).
• Restrict or object to our processing of your information.
• Receive a portable copy of your information in a structured, machine-readable format.
• Withdraw consent to processing based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at support@daloop.com. We will respond within 30 days.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). This section describes those rights and how to exercise them.

Categories of Personal Information We Collect

Under California law, we collect the following categories of personal information:

• Identifiers — name, email address, account credentials.
• Commercial information — subscription plan, billing cycle, payment history, Stripe customer ID.
• Internet activity — watchlist, alert preferences, chatbot conversation history, dashboard usage.
• Financial data — payment method (processed by Stripe; we do not store full card numbers).

Your California Privacy Rights

• The right to know — what personal information we collect, sell, or share, and with whom.
• The right to delete — request deletion of your personal information (subject to legal exceptions such as completing transactions and complying with legal obligations).
• The right to correct — request correction of inaccurate personal information.
• The right to opt out of sale or sharing — Daloop does not sell personal information as defined by the CCPA/CPRA, and does not share personal information for cross-context behavioral advertising. No opt-out is necessary.
• The right to limit use of sensitive personal information — we do not collect sensitive personal information (as defined by CPRA) beyond what is necessary to provide the Service.
• The right not to be discriminated against — we will not discriminate against you for exercising your privacy rights.

Other State Privacy Rights

If you are a resident of Colorado, Virginia, Connecticut, Utah, or another U.S. state with a comprehensive privacy law, you have similar rights to access, delete, correct, and opt out of processing of your personal information. To submit a request under any U.S. state privacy law, contact us at support@daloop.com. We will verify your identity before responding.

Shine the Light Law

Under California's Shine the Light law, California residents may request information about our disclosures of personal information to third parties for their direct marketing purposes. Daloop does not share personal information with third parties for their direct marketing purposes.

The Service is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a child, contact us at support@daloop.com and we will delete it.

Daloop is based in the United States. If you access the Service from outside the U.S., your information will be transferred to the U.S. and processed there.

For users in the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses for the transfer of personal information to the U.S., or another lawful transfer mechanism where applicable.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

We encourage you to review this policy periodically. Your continued use of the Service after a change takes effect constitutes your acceptance of the revised policy.

If you have questions about this Privacy Policy or your personal information, contact us:

• By email: support@daloop.com
• See also our Terms of Service and Disclaimer.
• Company: Daloop.com