File DA-050 View as Markdown
Privacy and consent
This page is for whoever signs off privacy on your site: what the script stores and reads, how it follows your consent banner, how long data is kept, and wording you can adapt for your privacy notice. The legal terms are in the privacy policy and the DPA. Where this page and those differ, they win.
Double Agent collects evidence to tell people, bots and agents apart. You decide which features and tools to turn on, and you need a lawful basis for them. Choosing a mode does not give you one.
What the script stores in the browser
| Key | Where | When |
|---|---|---|
doubleagent.* session keys | sessionStorage | Always. Cleared when the tab closes |
doubleagent.vid (visitor id) | localStorage | Only when Visitor tracking and consent allow it. Deleted when consent is withdrawn |
doubleagent.session (shared session) | localStorage | Same rule as the visitor id |
Double Agent sets no tracking cookie of its own. The integrations you turn on can read cookies that already exist on your site, such as an analytics client id or a cart token.
What it reads and what it doesn't
- It measures timing, pointer movement, scrolling and typing rhythm, and turns them into statistics.
- It does not read form values, and never sends typed text, passwords or clipboard contents. It does listen to
keyboard and input events.
- It records the pages of a visit, site-search terms (with emails and long digit runs replaced by
[redacted]) and,
on shops, basic product and order steps. See Ecommerce.
- Raw IP, full user agent, request headers and device details are kept apart from the ordinary session view. Only
owners and admins can read them, and every read is audited. URLs and allowed headers can still carry personal data, so keep credentials and secrets out of them.
Payment pages
When the script finds card fields or a payment provider's script (Stripe, Braintree, Adyen, PayPal), it collects less. Internally this is called PCI-lite. It is not a PCI DSS certification, and it doesn't make your payment page compliant.
In payment mode, card fields' input lengths and positions are left out, and the summarised timeline is not sent. Timing and other event measurements are still collected. A checkout URL alone doesn't turn payment mode on, and fields added to the page later may not be detected, so check your own payment pages.
Never put card numbers, passwords or other secrets in metadata, URLs or integration ids.
Consent
The script follows these banners on its own: Cookiebot, OneTrust, Google Consent Mode and Shopify's customer privacy API.
| Situation | What the script does |
|---|---|
| The page is still loading | Treats consent as denied until the page has loaded, so a banner that loads late is not missed |
| A supported banner is found | Follows it: the analytics choice for analytics tools, the marketing choice for ad tools |
| On Shopify | Follows Shopify's customer privacy API, together with any banner. If Shopify's answer is missing or broken, it counts as denied |
| No supported banner, not Shopify | Integrations may run. The visitor id still needs a real consent signal, unless Visitor tracking says the visitor's region needs none |
| The browser sends Global Privacy Control | No visitor id, in every Visitor tracking mode |
You set consent: 'denied' or 'granted' | Your setting wins over anything detected |
If your site needs consent before any collection, load the script only after the visitor agrees, or set consent: 'denied' on pages where they have not agreed yet. Test the first load, accept, refuse and withdraw with your own banner and every tool you have turned on, especially if your banner is not one of the four above.
Analytics mode and security mode
| Mode | Meant for | What changes |
|---|---|---|
analytics (default) | Labelling analytics and marketing records | Double Agent's own session report waits for analytics consent, and every tool waits for consent in its category |
security | Fraud and abuse prevention | Double Agent's own report and other security plugins run without analytics consent. Analytics and ad tools still need their own consent |
Picking security doesn't make collection exempt from consent. Consent rules can cover browser storage and fingerprinting, not only cookies. Check with your adviser whether each use is necessary for security where you operate.
How long data is kept
| Data | Kept for |
|---|---|
| Raw IP, full user agent, request headers, device details | 30 days |
| Session details, identity evidence and edge request records | 90 days (30 days for sites nobody has claimed) |
| Hourly summary counts, without individual sessions | 365 days |
| Live presence | 1 hour |
| Session feedback labels and their evaluation snapshots | No automatic expiry yet. Still covered by deletion requests |
Deletion and access requests
doubleagent.reset() ends the visitor's current session in the browser: it clears the doubleagent.* session keys and the identify() hash, then reloads the page (or, with { reload: false }, starts a new session). It does not stop collection and does not delete anything already sent. To stop collection for a visitor, use your consent banner or consent: 'denied'.
To delete or export data Double Agent has already received, delete the site in the portal, or email privacy@doubleagent.so. You need to identify the request and confirm you are allowed to make it.
Wording for your privacy notice
Describe the features and tools you actually turn on, your lawful basis, your consent choices and how long you keep data. Adapt this with your privacy adviser:
> We use Double Agent, operated by Loopclub Ltd, to classify website traffic and check the identity of bots and AI > agents. It processes visit and request information, browser and device characteristics, IP-based location and > interaction measurements. Its detection collector does not read form values or send typed text. Integrations we > enable may read existing analytics or commerce identifiers and share classification results with our connected > tools. Our use, lawful basis, consent choices and retention periods are described in this notice. More information: > https://doubleagent.so/legal/privacy/
Add your own purposes, linked identifiers, destinations and a contact for privacy rights. Don't describe all collection as strictly necessary just because you picked security mode.
Next: Visitor tracking settings, or Security for how reports are checked.