Privacy policy

Effective 11 October 2026.

Double Agent is run by Loopclub Ltd, at 4023 Kennett Pike #50389, Wilmington, DE 19807, USA. In this policy, "we" means Loopclub Ltd. Contact privacy@doubleagent.so about personal data and legal@doubleagent.so about contracts.

This policy covers our website, dashboard, APIs, detection integrations and public agent directory. An agent may act for an organisation or a person; information about its operator, wallet or activity may still be personal data.

1. Customer websites and services

The website or service using Double Agent decides which features to enable, what to send and which tools receive results. We process its data under our Data Processing Agreement. Its privacy notice explains its purposes and lawful basis. Contact that operator first about a visit; we can help it respond.

What is collected

• Visits and requests: a random session identifier, page paths and sequence, time visible, scroll progress, referral and campaign information, and timestamps. Campaign information is the referrer host and the landing page's UTM source, medium, campaign, term and content values (up to 100 characters each). Server or edge integrations can also send request method, host, path and response status. The session identifier uses browser sessionStorage, not a Double Agent tracking cookie. Ad-click identifiers are recorded as presence only (for example "gclid present"), never the identifier's value. Where the site has a search box, the visit can include the text a visitor typed into that site's own search, read from the page address, and the landing page's title; email addresses and long digit sequences (such as phone, card or order numbers) are replaced with "[redacted]" before they are stored, and these are kept with the visit's pages for the same period. On shops, the visit can include basic details of the products viewed (item number, the product's name and price), read from the site's own page metadata or ecommerce events, and, with analytics consent, whether the visitor added to cart, started checkout or ordered, with the order value; order numbers are kept only as a one-way hash. Customer details the site keeps alongside these events (names, email addresses, phone numbers, postal addresses, payment details) are not read. Page paths, the page address's query and site-search text are also checked for patterns of vulnerability probing (for example requests for configuration or backup files, or injection code in the address); only short pattern codes and the probed path (capped, with emails, long digit runs and token-like parts replaced with "[redacted]") are kept, never the query string or form values, and the resulting tag ("probing pattern", with its evidence) is shown to the site's operator for its security. The visit can also carry how many forms were submitted on each page by kind of form (for example one signup or one contact form), never what was entered, and the pages, clicks on typed buttons and these counts are summarised into a likely purpose of the visit (for example browsing, researching, completing a signup, or scraping), shown to the site's operator with its evidence; it never blocks or changes a result.
• Browser and device: user agent, operating system, screen and device characteristics, language, time zone, graphics renderer, browser client hints, and indicators of automation or browser modification.
• Interaction measurements: timing, movement and event patterns, including clicks, scrolling, touch, focus, typing and paste activity. The browser computes statistical features and a summarised timeline. The detection collector does not read form values or send typed text, passwords or clipboard contents. Payment detection reduces some collection; it does not turn off all interaction listeners or timing measurements.
• Connection information: IP address, network operator, selected request headers and network-provider metadata, including country, region, city, postal code, IP-derived coordinates and connection fingerprints when available. The ordinary session view rounds coordinates to about 11 km; the restricted raw tier can retain the provider's original IP-derived coordinates. These are not GPS readings requested from your device.
• Identity evidence and results: declared agent names; operator, agent, automation-controller and browser/client information; signature and public-key references; wallet and registry identifiers; proof outcomes; and classification, confidence and risk results. Observed names, IP ranges and signatures support different claims. A label does not establish a person's legal identity or an agent's authority to act for them.
• Linked identifiers: enabled integrations can obtain analytics client identifiers, cart tokens, order identifiers and other supported identifiers. Integrations may be detected automatically and read existing first-party cookies or page-provided identifiers, subject to SDK configuration and consent handling. This is different from setting a Double Agent tracking cookie.
• Session feedback: a customer's human, bot or agent label, the submitting member's identifier, email and role, time, site and session identifiers, and a snapshot of the classification, signals and numeric features. Labels support evaluation; submitting one does not itself change live scoring.

The request-header allow-list excludes Cookie and Authorization. URLs, referrers, other permitted headers and customer-provided metadata can nevertheless contain personal information. Customers must exclude credentials, sensitive information and unnecessary personal data. Hashing an identifier does not necessarily make it anonymous.

Purposes and effects

We classify traffic, explain evidence, verify supported identity claims, detect abuse, show session journeys, evaluate detection quality and deliver results to customer-selected destinations. Customers may use results to filter analytics, change advertising attribution, investigate requests or apply access rules. Results can be wrong and need appropriate review before decisions with legal or similarly significant effects on people.

An optional model-based second opinion can process session evidence when configured. It is disabled in the reviewed default configuration. Before enabling an external provider, we must disclose its processing on the subprocessors page and follow DPA notice requirements. Reading public A2A agent cards does not mean we record those agents' conversations, prompts or task outputs.

Cookies, storage and consent

Customers control consent and integration purposes. analytics mode labels analytics; security mode supports security use. A mode name is not a legal exemption. Consent rules can apply to browser storage, device access and fingerprinting as well as cookies.

The SDK recognises specific consent integrations, not every banner. If no supported consent state is found on an ordinary non-Shopify website after page loading, automatic handling can permit integrations. Customers needing prior consent must provide an explicit denied state or delay loading until permission is available. See Safehouse for controls and limitations.

Retention and deletion

Raw data is stored separately. Customer access is restricted to owners and administrators, and raw-data reads through the service are audited.

Session feedback is stored separately and currently has no automatic expiry. It can outlast ordinary session history. This does not exclude it from deletion instructions, privacy rights or the DPA's deletion obligations. Customers can request export or deletion of feedback and associated personal data at privacy@doubleagent.so.

Removing the script or clearing a browser identifier does not delete information already received. Customers can delete a site or contact us for account closure and individual data requests. The DPA requires deletion within 30 days after the service ends or a site is deleted, except where law requires retention. Backup copies must remain protected and excluded from ordinary use until erased under the applicable backup schedule; contact us for the schedule applicable to your service.

Aggregate statistics

We may produce statistics about detection and agent activity, including aggregate information for public directory profiles. Publication must not identify a visitor or disclose an individual customer's activity. Our publication minimum is ten distinct websites, together with checks against re-identification; group size alone does not establish anonymity. Customers can opt out at legal@doubleagent.so. Personal or merely pseudonymous data remains subject to the DPA and applicable law. Opting out does not remove independently published registry information.

2. Accounts, support and our own sites

We hold account email addresses, memberships, roles, domains, settings, API-key identifiers and hashes, sign-in records, support correspondence and audit records. Integration credentials needed to deliver a configured integration are protected separately from hashed Double Agent secret API keys. We also process technical connection and usage information to operate and secure the service.

We use required account details to provide access and send sign-in links and service notices. Where applicable, the basis is our contract with the individual account holder; for organisation representatives, security and support, it is our legitimate interest in operating and protecting the service. We also process information to meet legal obligations. Without necessary account details we cannot provide authenticated access. Account data is kept while the account exists and deleted within 30 days after closure, except records required by law or necessary for a specific unresolved dispute or security incident.

Our production website and dashboard load Google Analytics 4, Microsoft Clarity and Double Agent. Google Analytics measures usage. Clarity collects interactions and session replays; input and selected dashboard content are masked, but masking does not make all visit information anonymous. Providers can receive page and device information, online identifiers and network information. Their cookies are separate from Double Agent's session storage. The app uses browser storage for authentication, account navigation, preferences and temporary dashboard data. Choosing to remember a sign-in stores the authentication token in persistent local storage rather than only in the current browser tab. Our dashboard also uses Double Agent itself to tell people from automated traffic: once you sign in, it sends a one-way hash of your user account id (never your email address or the id itself), so that signed-in visits can serve as confirmed human examples for our detection.

Where consent is required, we must obtain it before the relevant storage, access or analytics processing. Contact privacy@doubleagent.so to withdraw consent or exercise rights. Browser privacy controls can limit cookies and storage; blocking cookies alone may not prevent all analytics requests. See Google's privacy policy and Microsoft's privacy statement.

3. Public agent identity and reputation

We collect information from public bot and agent catalogues, agent websites, A2A agent cards, Web Bot Auth key directories, ERC-8004 registries and referenced metadata or review resources. A profile can include names, descriptions, domains, endpoints, capabilities, operator information, public keys, wallet and contract addresses, token identifiers, transactions, reviews, replies, revocations and dates. Source availability affects what is displayed.

We use this information to help people and agents discover software, assess identity evidence and inspect reputation. Where personal data is involved, our proposed basis is the legitimate interest in providing a transparent, abuse-resistant directory, subject to an assessment and the individual's rights. Public availability does not waive privacy rights. Customer-derived activity is additionally subject to the safeguards above and the DPA.

Scores combine available evidence and can change. A signature establishes key control for a particular proof; it does not establish legal identity, safety, competence, good intentions or authority for every action. Third-party reviews are their authors' statements, not Loopclub Ltd's endorsement.

Profiles and cached public information may remain while a listing is maintained, subject to accuracy, refreshes and rights requests. Contact us with a profile URL and the disputed information. We can assess our display and stored copies but cannot erase independently operated blockchains or third-party publications. Do not publish secrets or unnecessary personal information in agent metadata or on-chain reviews.

4. Recipients and locations

• Providers: see our subprocessors and other recipients.
• Team notifications: account events about our customers (owner email, account name, domain, and plan, payment and domain events) are posted to our team's Slack workspace (Slack Technologies), so we can act on them. Visitor session data is not sent there.
• Customer-selected tools: analytics, advertising, commerce and webhook destinations receive identifiers, labels or events according to the integration. The customer controls that choice.
• Public readers: people, agents and search engines can access public directory information and published aggregates. Private session dossiers and customer feedback are not public reviews.
• Identity sources: registry, public-key and agent-card lookups disclose lookup identifiers and our server's connection information to the relevant RPC provider, gateway or publisher.
• Necessary disclosures: authorities where legally required, and advisers or a successor where necessary for legal claims or a business transfer, with appropriate safeguards.

Loopclub Ltd is based in the United States. We operate our Elasticsearch storage in Canada. Cloudflare operates a global network and other recipients may process information elsewhere. Canadian storage does not make the whole service Canada-only.

Restricted international transfers require safeguards appropriate to the particular transfer. The DPA sets out EU Standard Contractual Clauses and the UK Addendum for customer processing, with Swiss adaptations where applicable. Contact privacy@doubleagent.so for information or a copy of relevant safeguards. We do not claim every recipient or transfer is covered by an adequacy decision.

We do not sell customer visitor data or permit its use for cross-context behavioural advertising. Customer-directed advertising integrations are separate decisions by that customer. Our own website analytics must also be configured consistently with applicable consent and opt-out requirements.

5. Your rights

Depending on applicable law and our role, you may request access, correction, deletion, restriction or a portable copy. You may object to processing based on legitimate interests, including a directory listing that identifies you. Consent can be withdrawn without affecting processing that was lawful before withdrawal.

Where the CCPA applies, California residents may exercise rights to know, access, correct, delete and opt out of covered sale or sharing, and applicable sensitive-information rights, without discrimination. An authorised agent may act with evidence of authority. We may need proportionate verification; do not send private keys, passwords or identity documents unless a secure, necessary verification method has been agreed.

Write to privacy@doubleagent.so with the site, account or profile and enough information to locate the record. A session identifier and approximate visit time may help. Wallet control does not automatically authorise access to another person's data. Requests about customer-controlled records are referred to that customer with our assistance.

We respond within applicable deadlines, normally one month under the GDPR and 45 days under the CCPA, explaining permitted extensions or refusals. You may ask us to reconsider, appeal where local law provides that right, and complain to your supervisory authority, including the UK Information Commissioner's Office or your local EU authority.

6. Security, children and changes

We use access controls, encryption in transit, separated storage permissions, validation and abuse controls. No service can guarantee perfect security. See Security.

Our account service is intended for adults acting in a business or professional capacity. We do not knowingly collect children's information for our own purposes. Customers remain responsible for their visitors, including additional requirements for children. Contact us about information concerning a child held improperly.

We will publish dated revisions and notify customers of material changes at least 30 days before they apply, seeking additional consent where required.

Contact

Loopclub Ltd · 4023 Kennett Pike #50389, Wilmington, DE 19807, USA. privacy@doubleagent.so · legal@doubleagent.so.