Clear boundaries for your data.
This notice explains what Dashloom Cloud processes, why, who receives it, and how you can stay in control.
Effective: September 1, 20261. Scope and roles
This notice applies to the dashloom.dev website and the hosted Dashloom Cloud service. The Dashloom Cloud operator receives privacy requests at support@dashloom.dev. Open-source self-hosted instances are independently operated by their deployers, who determine processing purposes and must publish their own notice. Dashloom cannot control third-party deployments.
2. Data we process
We may process account identifiers, email and session state; workspace membership and roles; product names, domains, and configuration; server-encrypted connector and delivery credentials; normalized metrics, sources, periods, and freshness; Agent questions, evidence bundles, outputs, and actions; report and delivery state; plan, subscription identifiers, usage ledgers, and billing-support records; feedback, bounded diagnostics, security, and operational logs. Hosted pages from your selected payment provider (Waffo or Anyway) process payment-card details; Dashloom does not receive full card numbers.
3. Where data comes from
Data comes from you and workspace members, or from services you authorize, such as Cloudflare, Google, Bing, Stripe, Paddle, Polar, Lemon Squeezy, Creem, Supabase, GitHub, Vercel, and custom REST sources. The service also generates sync, analysis, delivery, usage, and security events.
4. Why we use data
We use data to create and protect accounts, sync and normalize product metrics, provide dashboards and analysis, run Agents and model comparisons, schedule and deliver reports, enforce plan allowances, process payments and support, detect faults and abuse, maintain security, and meet legal obligations. We do not sell personal information or use workspace metrics for third-party behavioral advertising.
5. Google API data
Only after a user deliberately connects a Google Account and completes OAuth authorization does Dashloom access the Google account identifier and email, Google Analytics 4 resources and daily active users, sessions, and page views, and Search Console sites and daily clicks, impressions, CTR, and average position. Dashloom requests only openid, email, analytics.readonly, and webmasters.readonly permissions and does not modify Google data. We use this data to discover resources the user can access, map resources to products the user selects, synchronize normalized metrics, and provide user-visible dashboards, reports, and user-initiated Agent analysis. We store server-encrypted refresh tokens and granted scopes, connected-account and resource metadata, and normalized daily metrics. Data is displayed only according to workspace permissions or, when the user deliberately uses Agent, sharing, or report-delivery features, transferred in the minimum amount necessary to the model provider or recipient selected by the user. We do not sell Google user data or use it for advertising, credit assessment, or training general-purpose AI models. Users can disconnect Google at any time to stop future access and can request deletion of stored data through workspace deletion or support. Dashloom's use of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements.
6. AI and model providers
When an Agent runs, the service sends the user question and a bounded evidence bundle to the workspace-configured model provider or the provider included with a Cloud plan. Evidence is limited to the product, metrics, period, source, and context needed for analysis. Quality Lab sends the same frozen bundle separately to selected models. Providers process requests under their own terms; administrators should choose providers that meet their compliance needs.
7. Service providers and transfers
Cloud may rely on Cloudflare for hosting and storage, Waffo or Anyway for payments, model providers, email and messaging delivery services, and data providers you connect. The exact subprocessors depend on enabled features and region. These services may process data in other countries under their contracts, security measures, and applicable transfer mechanisms.
8. Cookies and diagnostics
Essential cookies maintain sessions, security, and service preferences. The open-source repository sends no product analytics telemetry by default. Anonymous diagnostics are created only when a member requests them and exclude workspace identifiers, user identity, product names and domains, credentials, raw metric values, custom metric names, questions, Agent findings, report content, and raw provider errors. If non-essential analytics or marketing cookies are added, we will offer choices where required.
9. Retention, export, and deletion
Cloud plans set maximum metric-retention windows. Reports, audit, billing, and security records may follow different periods needed to operate the service, resolve disputes, or meet legal obligations. Owners can export workspace data, adjust available retention settings, revoke connections and share links, and request workspace deletion. Exports omit credentials. Deletion cannot control copies retained by external providers under their terms.
10. Security measures
Connector and delivery credentials are encrypted server-side; ingestion and share tokens are stored as one-way hashes; access is limited by workspace roles; billing entitlements change only after verified webhooks. Least privilege, validation, scoping, and audit records reduce risk, but no system can guarantee absolute security. Report vulnerabilities privately through the repository Security Policy.
11. Your choices and rights
You can access and correct account details, revoke connections, manage members and share links, export or delete a workspace, and contact support@dashloom.dev to request access, correction, deletion, restriction, objection, or portability. Available rights depend on location, and we may need to verify identity and authority. You may also complain to a local data-protection authority.
12. Accounts and minors
Dashloom is intended for users able to accept the Terms for themselves or an organization. Do not create a workspace or connect data without the required legal capacity or authorization. Contact us if data was submitted without appropriate authority.
13. Changes and contact
We may update this notice as features, providers, or laws change and will show a new effective date. Material changes will be communicated through reasonable means. Send privacy questions, data requests, or complaints to support@dashloom.dev.