Privacy Policy

Last updated: 2026-04-18

This Privacy Policy describes how Express Loop LLC (d/b/a "Daba")("Company", "we") collects, uses, and shares personal data in connection with the DabaRank service.

1. Data We Collect

Account data: name, email, organization name, authentication identifiers from our identity provider (WorkOS).
Content you submit: domains, URLs, prompts, company descriptions, locations, industries, offerings.
Usage data: page views, feature interactions, request metadata (IP, user-agent, timestamps), error logs.
Billing data: billing contact, last four digits of card and expiry. Full card details are collected and stored by Stripe; we never receive or store them.
AI responses: responses returned by third-party AI providers to prompts you configured.

2. How We Use Data

To deliver, maintain, and improve the Service.
To process payments and manage subscriptions.
To send service announcements, security notices, and billing notifications.
For aggregated, de-identified analytics to understand product usage.
To meet legal obligations and prevent abuse.

3. Third-Party AI Providers

When you run prompts, we transmit them to third-party AI providers — including OpenAI, Anthropic, Google, and Perplexity — to generate the responses we analyze. Each provider processes data under its own terms, and requests may be cached or logged for operational purposes.

Do not submit personal data of third parties, confidential information, or regulated data (PHI, payment data, etc.) through prompts.

4. Subprocessors

We engage third-party service providers ("subprocessors") to help deliver the service, in the following categories:

Cloud hosting, databases, and backups
Payment processing
Authentication and user management
Content delivery and network security
Error and performance monitoring
Third-party AI providers (see Section 3)

A current list of named subprocessors is available on request. We notify customers of material subprocessor changes in advance.

5. Data Sharing

We do not sell personal data. We share data only with subprocessors above under data-processing contracts, when required by law, or with your explicit permission.

6. Data Retention

Account and Content data: retained while your account is active.
After account deletion: removed within 30 days, except for records we must keep for legal, tax, or dispute reasons.
Backups: encrypted and rotated on a rolling 30-day window.
Access logs: 90 days.

7. Security

We use TLS in transit, encryption at rest, least-privilege access, tenant-level data isolation, and audit logging. No system is impenetrable; report suspected incidents to [email protected].

8. Your Rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA/CPRA, and similar), you may have the right to access, correct, delete, or port your personal data, and to object to certain processing. Submit requests to [email protected]. We verify identity before fulfilling requests and respond within the timeframe required by applicable law.

9. International Transfers

We process data in the United States and the European Union. Where data moves across jurisdictions, we rely on Standard Contractual Clauses and equivalent safeguards.

10. Children

The Service is not directed to children under 16. We do not knowingly collect data from children.

11. Changes

Material changes will be announced by email or in-product notice at least 14 days before they take effect.

12. Contact

Privacy questions: [email protected]. Data controller: Express Loop LLC (d/b/a "Daba"), Texas, United States. Legal notices are accepted by email at [email protected].