# Privacy policy

Last updated: 26 September 2026

Double Agent is run by **Loopclub Ltd**, a company registered in Delaware, USA ([REGISTERED ADDRESS]). "We" means Loopclub Ltd. Questions or requests: **privacy@doubleagent.so**.

This policy covers three groups of people, and our role is different for each:

| You are | What we hold | Our role |
|---|---|---|
| A visitor to doubleagent.so or app.doubleagent.so | Analytics about your visit | Controller |
| A Double Agent customer (an account holder) | Your account | Controller |
| A visitor to a website that uses Double Agent | What the script records about your visit | Processor for that website, which is the controller |

## 1. Visitors to websites that use Double Agent

Websites install Double Agent to tell people apart from bots and AI agents. When you visit one of them, its owner decides to use us, and **they are the controller** of your data. We process it on their behalf under our [Data Processing Agreement](/legal/dpa/). Ask them first about your rights; you can also write to us and we will pass your request on or help them answer it.

**What the script records**

- **About the visit:** a random session id (kept in your browser's `sessionStorage`, never in a cookie), the pages you view in order, how long each is on screen and how far you scroll, the referring site, and campaign tags in the address (such as `utm_source`). Ad click ids are recorded only as "present", never their value.
- **About the browser and device:** browser, operating system and version, device type, screen size, languages, time zone, colour depth, device memory, touch support, network type, graphics renderer, and the browser's own "client hints".
- **About how the page is used:** timing and movement patterns of mouse, touch, scroll and keyboard events, used to tell a person from a script. **We never record what you type**, and on payment pages we listen to no fields at all.
- **From the connection:** your IP address, the full user-agent string, a fixed list of request headers (never cookies or credentials), and facts our network provider adds: country, region, city, an approximate location rounded to about 11 km, network operator, and connection details.
- **The result:** whether the visit looks human, bot or AI agent, and, for bots and agents, which one and how it identified itself.
- **Identifiers the site links:** only if the site connects them, for example an analytics client id or an order id, so it can label that record.

**Why:** to detect bots, scrapers and AI agents, prevent fraud and abuse, and label the site's analytics, advertising and commerce tools so they count people correctly. The website chooses which tools receive the label.

**How long**

| Data | Kept |
|---|---|
| Raw IP address, full user agent, request headers, device details | 30 days |
| Session detail (pages, verdict, location to city level, device type) | 90 days (30 days for sites whose owner has not claimed them) |
| Hourly totals with no individual data | 365 days |
| "Who is on the site now" | 1 hour |

Raw data (IP, user agent, headers) is stored separately. Only the website's owners and admins can open it, and every look is recorded.

**Aggregate statistics.** We may combine data across many websites into statistics that cannot identify you or any website, for example "the share of AI-agent visits this month", to improve detection and publish research. Nothing is published for a group smaller than ten websites, and websites can opt out.

## 2. Customers

When you create an account we hold your **email address**, the accounts and sites you belong to and your role, your API keys (secret keys only as a one-way hash), sign-in records, and an audit log of actions such as adding a domain or rotating a key. We use them to run your account, secure it, email you sign-in links and important service notices, and meet legal obligations. The basis is our contract with you and our legitimate interest in keeping the service secure. Account data is kept while your account exists and deleted within 30 days after you close it, except records we must keep by law.

## 3. Visitors to our own sites

doubleagent.so and app.doubleagent.so use **Google Analytics 4** and **Microsoft Clarity**, and our own Double Agent script, to understand how the sites are used. Google Analytics and Clarity set cookies. Clarity masks what you type and the account data shown in the app. We use them only in production, on the basis of your consent where the law requires it.

## Who else receives data

- **Service providers** who run parts of the service for us, listed on the [subprocessors page](/legal/subprocessors/).
- **Tools a website chooses to connect** (for example its analytics or shop platform) receive the human, bot or agent label for that visit. That is the website's decision.
- **Authorities**, when the law requires it.

We do not sell personal data or share it for cross-context behavioural advertising.

## International transfers

We are based in the United States, and data is processed in the United States and by our providers' global networks. For data from the EU, UK and Switzerland we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, as set out in our DPA.

## Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your data, object to or restrict its use, and withdraw consent. California residents have the rights to know, delete, correct and opt out of sale or sharing (we do neither), and will not be treated differently for using them. Write to **privacy@doubleagent.so**. We answer within 30 days (45 for California). If you visited a website that uses Double Agent, we may ask for your session id or the site and time of your visit, because we do not know who you are. You can also complain to your data protection authority.

## Security

Data is encrypted in transit. Access is limited by role and separate keys, raw data is readable only through an audited route, and rate limits and abuse controls protect every endpoint. Details: [Security](/docs/security/).

## Children

Double Agent is not directed at children and we do not knowingly collect children's data for our own purposes.

## Changes

We will post changes here and update the date above. For material changes we will email customers at least 30 days before they apply.

## Contact

Loopclub Ltd, [REGISTERED ADDRESS]. Privacy: privacy@doubleagent.so. Contracts and DPAs: legal@doubleagent.so.