Privacy Policy

Effective Date: October 3, 2026

This Privacy Policy explains how Dopamine (“Dopamine,” “we,” “us,” or “our”) collects, uses,

discloses, and protects personal information when you visit, apply for access to, or use the Ads

Manager dashboard, including its administrative portal, Content Vault, and Documentation site

(collectively, the “Services”). It applies to visitors, prospective clients, Clients, and authorized

users (“you” or “your”). Capitalized terms not defined in this Privacy Policy have the meanings set

forth in our Terms of Service.

1. Information We Collect

We collect the following categories of information in connection with the Services. Where a category

applies only to specific Service components, this is noted.

1.1 Account and Application Information

Name, email address, organization name, username, and role or title. Account Information is collected

during registration and account administration and applies across the Services. This category

includes information about team members added through Ads Manager’s team management features.

If you apply for access, we also collect the contact and business information you submit, such as

your phone number, company details, website, social media handle, and additional information you

choose to provide. We may maintain information about your referral or outreach source, demo status,

and related account notes.

1.2 Billing and Payment Information

Payment method information, cryptocurrency wallet addresses, wire transfer details, transaction

history, account balance, and invoices. Billing and Payment Information applies to Ads Manager.

Dopamine does not directly store full credit card numbers. Card payments are processed through Whop.

We receive payment confirmations and related transaction information from payment providers and, for

cryptocurrency payments, blockchain networks.

1.3 Usage and Activity Data

Pages visited, features used, clicks, scrolling, navigation paths, search queries, session duration,

and frequency of use. Usage Data is collected across the Services. This includes Campaign management

activity in Ads Manager, content upload and organization activity in Content Vault, and documentation

browsing.

In Ads Manager, we also collect sign-in and sign-out events, visit timestamps, page visibility

signals, estimated time using the Service, organization selections, and actions such as creating

reports, managing team access, or initiating payments. Page visibility and session duration provide

estimates of activity and do not necessarily indicate that you are actively viewing or interacting

with a page.

Usage and activity information may be associated with your account and organization using account,

browser/device, and session identifiers. We also collect technical error reports and related

diagnostic information. Session replay is described in Section 2.4.

1.4 Device, Browser, and Network Information

IP address, browser type and version, user-agent string, operating system, device type, screen

resolution, language preference, timezone, referring URL, and related technical information supplied

by your browser. Device and Browser Information is collected automatically across the Services.

In Ads Manager, we also collect approximate location derived from your internet connection, such as

country, region, city, and associated approximate coordinates and timezone. This information is

network-derived and may be inaccurate.

Browser/device identifiers and technical information may be used to recognize repeat visits and

understand access from different browsers or devices.

1.5 Content Metadata

File names, file types, upload timestamps, content tags, list assignments, and link replacement data.

Content Metadata is collected through Content Vault.

This category concerns metadata about Client Content. Separately, session replays described in

Section 2.4 may include content displayed within the Ads Manager interface. Client Content rights are

governed by the Terms of Service.

1.6 Campaign and Performance Data

Campaign names, persona configurations, account assignments, Platform-reported metrics, including

Views, reach, and engagement, Attribution data, and CPM rates. Campaign and Performance Data is

collected through Ads Manager.

1.7 Support Communications

Messages sent to your Account Manager, support emails, and feedback submissions. Support

Communications are collected across the Services and managed through Dopamine’s support processes.

2. How We Collect Information

2.1 Information You Provide Directly

We collect information you provide when applying for access, registering an account, setting up

billing, uploading content, configuring Campaigns, contacting support, submitting feedback, or

inviting team members.

2.2 Information Collected Automatically

We automatically collect Usage Data and Device, Browser, and Network Information through server logs,

authentication records, browser-based technologies, and analytics providers.

We use Vercel Web Analytics for traffic statistics and PostHog in Ads Manager for product analytics,

error reporting, and session replay. These technologies may use cookies, local storage, and related

identifiers as described in Section 5.

Our systems also record sign-in activity and receive periodic activity signals while you use Ads

Manager to maintain visit history and estimate time using the Service.

2.3 Information from Third Parties

We receive certain information from third-party sources, including:

Platform-reported metrics. Views, reach, engagement, and other performance data reported by social

media Platforms in connection with distributed Client Content.

Payment confirmation data. Transaction confirmations and payment status information from payment

providers.

Cryptocurrency payment confirmations. Transaction information from blockchain networks.

Account and referral information. Information provided by people who invite you to an organization,

refer you to Dopamine, or coordinate access to the Services on your behalf.

2.4 Product Analytics and Session Replay

We use PostHog to understand how Ads Manager is used, diagnose technical issues, and improve the user

experience.

Session replay reconstructs a visit from the pages and content displayed within Ads Manager and

interactions such as clicks, scrolling, and navigation. Replays and related analytics may be linked

to your account so authorized Dopamine personnel can investigate a reported issue, provide support,

or understand use of the Service.

Session replay is limited to the Service pages where it operates. It does not give us access to your

other browser tabs, other applications, camera, or microphone.

3. How We Use Your Information

We use personal information for the following purposes.

3.1 Service Delivery

Providing, maintaining, and administering the Services, including reviewing applications, managing

accounts and organization access, processing Campaign distribution, delivering Content Vault

functionality, and serving Documentation content.

3.2 Billing and Payments

Processing payments, calculating CPM-based Fees, generating invoices, maintaining account balances,

and resolving Billing Errors.

3.3 Analytics, Support, and Improvement

Analyzing usage patterns and feature adoption, understanding onboarding and demo usage, diagnosing

errors, responding to support issues, and improving the Services.

We may review account activity, technical diagnostics, and session replays for these purposes. We

also use referral and outreach information to understand how users find and begin using the Services.

3.4 Communications

Sending service-related notices, including billing alerts, account updates, and policy changes;

responding to support inquiries; and delivering Account Manager communications.

Dopamine does not send marketing emails unless you have opted in to receive them.

3.5 Security and Fraud Prevention

Protecting accounts and the Services by reviewing sign-in history, browser/device information, and

network activity to investigate unusual access patterns, unauthorized access, abuse, fraud, and

security threats, and to enforce the Terms of Service and Acceptable Use Policy.

3.6 Legal Compliance

Complying with applicable laws, regulations, and legal processes, responding to lawful requests from

public authorities, and establishing, exercising, or defending legal claims.

4. Sharing and Disclosure

We do not sell your personal information or use it for cross-context behavioral advertising. We may

share or disclose personal information in the following circumstances.

4.1 Service Providers

We share personal information with service providers that help us operate the Services, including:

Whop: card payment processing.

Vercel: hosting and web analytics.

Supabase: database and authentication services.

PostHog: product analytics, session replay, and error reporting.

Other operational providers: email delivery and services needed to support payments and platform

operations.

Depending on their function, these providers may process account information, transaction

information, usage events, device and network information, diagnostics, and session replay data.

We engage service providers under contractual terms governing their handling of personal information

and limiting its use to the services they provide to Dopamine and other purposes permitted by

applicable law.

4.2 Social Media Platforms

In the course of distributing Client Content, certain information, including content metadata and

account identifiers, is shared with Platforms. Each Platform’s data practices are governed by that

Platform’s own privacy policy.

4.3 Legal Requirements

We may disclose personal information if required by law or in response to valid legal process,

including subpoenas, court orders, or government requests.

4.4 Business Transfers

In connection with a merger, acquisition, reorganization, or sale of assets, personal information may

be transferred to the acquiring entity. We will notify affected Clients of any such transfer and any

choices available regarding their information.

4.5 With Your Consent

We may share personal information with third parties when you have consented to that sharing.

4.6 Aggregated or De-identified Data

We may share aggregated or de-identified data that cannot reasonably be used to identify you for

analytics, research, or business purposes.

5. Cookies and Tracking Technologies

5.1 Cookies and Similar Technologies

Cookies are small data files stored on your device when you visit a website. We also use similar

technologies, including local storage, browser-based scripts, and identifiers, to support the

Services and understand how they are used.

5.2 Technologies We Use

Essential Technologies. Support authentication, session management, security, and core functionality.

These include Supabase authentication cookies. Blocking these technologies may prevent you from

signing in or using certain features.

Analytics and Diagnostic Technologies. Help us understand usage, measure feature adoption, identify

technical issues, and improve the Services. PostHog may use cookies, local storage, and related

identifiers in Ads Manager to recognize browsers and sessions, associate activity with an account,

collect diagnostics, and enable session replay. We also use Vercel Web Analytics for traffic

statistics.

Functional Technologies. Store preferences such as theme selection, timezone settings, and

documentation reading progress.

5.3 Service Providers and Advertising

Analytics and diagnostic information may be processed by service providers, including PostHog, even

when the relevant technologies operate through Dopamine’s own domain.

We do not use these technologies for cross-context behavioral advertising. Payment providers may use

cookies or similar technologies during payment transactions to facilitate secure payment processing.

5.4 Your Choices

You can block or delete cookies through your browser settings and clear local storage through your

browser’s site-data controls. Restricting essential technologies may affect your ability to access or

use the Services.

Browser settings do not necessarily stop all analytics, server-side logging, or processing of

information already collected.

Where applicable law requires consent for optional analytics or session replay, those technologies

may be used only with the required consent. You may withdraw consent or exercise applicable rights

concerning this processing by contacting privacy@DopamineOS.com. Withdrawing consent does not affect

the lawfulness of processing that occurred before withdrawal.

6. Data Retention

6.1 General Retention Principles

We retain personal information for as long as reasonably necessary to fulfill the purposes described

in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

When determining retention periods, we consider the nature and sensitivity of the information, the

purpose of processing, operational needs, and applicable legal requirements. When information is no

longer needed, we delete or de-identify it.

6.2 Retention Periods

Account Information. Retained for the duration of the account relationship and for 7 years after

account closure or termination, subject to applicable deletion rights and record-keeping

requirements.

Billing and Transaction Records. Retained for 10 years to support tax, financial reporting, and

record-keeping obligations.

Usage Data and Analytics. Except for the activity records and session replays described below,

retained in identifiable form for up to 60 months, after which they are deleted, aggregated, or de-

identified.

Account Activity and Access History. Ads Manager visit, sign-in, sign-out, and related access-history

records follow a 365-day retention schedule, measured from the start of the visit or the date of the

event. Full IP addresses in visit and sign-in/sign-out records are scheduled for removal after 90

days through a daily deletion process. Reduced network prefixes, approximate location, browser/device

information, and account/session links may remain for the rest of the record’s retention period.

Session Replays. Retained for the period reasonably needed to investigate technical issues, provide

support, and evaluate the user experience. The applicable period depends on the recording’s age,

relevance to an unresolved issue, and our provider’s retention settings. Session replays are subject

to a separate deletion schedule from related analytics events and account activity records.

Referral and Outreach Information. Retained during the account relationship and for up to 365 days

after account deletion.

Content Metadata. Retained for the duration of the account relationship. Upon termination, Content

Metadata is retained as specified in Section 3.2 of the Terms of Service.

Support Communications. Retained for 7 years after the last communication to provide context for

support and resolve outstanding issues.

Other Device and Browser Logs. Retained in server logs for up to 365 days, after which entries are

deleted or anonymized. Information incorporated into another category follows the retention period

applicable to that category.

Deletion occurs through scheduled processes. Information subject to a specific legal preservation

requirement may be retained longer where necessary and permitted by law.

6.3 Deletion Requests

You may request deletion of personal information as described in Section 7. Closing an account does

not necessarily delete every associated record immediately. Certain information may be retained where

required or permitted by applicable law, including to complete transactions, investigate security

incidents, or meet record-keeping obligations.

7. Your Rights and Choices

7.1 General Rights

Depending on your jurisdiction and the circumstances, you may have the following rights:

Access. Request access to or a copy of personal information we hold about you.

Correction. Request correction of inaccurate or incomplete information.

Deletion. Request deletion of personal information, subject to applicable exceptions.

Restriction. Request limits on processing in certain circumstances.

Objection. Object to certain processing of your personal information.

Data Portability. Receive eligible personal information in a structured, commonly used, machine-

readable format.

Withdraw Consent. Withdraw consent where processing is based on consent, without affecting the

lawfulness of processing before withdrawal.

Complaint. Lodge a complaint with the relevant data protection authority where applicable.

7.2 California Residents

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act,

applies, California residents have the following rights.

Right to Know and Access. Request information about the categories and specific pieces of personal

information we collect, the sources of that information, the purposes for collecting or disclosing

it, and the categories of recipients.

Right to Delete. Request deletion of personal information, subject to applicable exceptions.

Right to Correct. Request correction of inaccurate personal information.

Right to Opt Out of Sale or Sharing. Dopamine does not sell personal information or share it for

cross-context behavioral advertising as those terms are defined under California law.

Sensitive Personal Information. To the extent we process sensitive personal information, we use it

for purposes permitted by applicable law, such as providing requested Services, processing

transactions, and protecting account security. You may exercise any applicable right to limit its use

or disclosure.

Non-Discrimination. We will not discriminate against you for exercising your privacy rights.

The categories of information, sources, purposes, and recipients described in Sections 1–4 also

describe our handling of personal information during the preceding 12 months, to the extent the

relevant Services and features were in operation.

7.3 How to Exercise Your Rights

Contact privacy@DopamineOS.com to submit a privacy request.

We may need to verify your identity by matching information you provide with information we hold. We

will request only information reasonably necessary to verify and process your request.

We will respond within the period required by applicable law. If an extension is permitted and

necessary, we will explain the reason and notify you of the extension.

7.4 Authorized Agents

Where permitted by applicable law, you may designate an authorized agent to submit a request on your

behalf. We may require evidence of authorization and, where permitted, direct verification of your

identity.

8. Security, Children, and International Transfers

8.1 Security Practices

We use technical and organizational measures designed to protect personal information against

unauthorized access, alteration, disclosure, or destruction. These include encryption of data in

transit and access controls.

Access to account activity and diagnostic information is restricted through authorization controls.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a data breach requires notification under applicable law, we will notify affected individuals and

relevant authorities as required. If you suspect unauthorized access to your account or become aware

of a security vulnerability, please contact us promptly.

8.2 Children’s Privacy

The Services are not directed to individuals under 18. We do not knowingly collect personal

information from children. If we become aware that a child has provided personal information, we will

take steps to delete it as required by applicable law.

Please contact us if you believe a child has provided personal information through the Services.

8.3 International Data Transfers

The Services are operated from the United States. Your personal information may be transferred to,

stored, and processed in the United States and other countries where our service providers operate.

Data protection laws in these countries may differ from those in your jurisdiction.

International transfers are subject to applicable data protection requirements, including any

required safeguards. You may contact privacy@DopamineOS.com for information about the safeguards

applicable to your personal information.

9. Updates, Contact, and Marketing

9.1 Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal

requirements.

We will notify you of material changes by email or in-app notification at least 14 days before they

take effect. The Effective Date above indicates when this version takes effect.

Where a change requires your consent under applicable law, we will obtain that consent separately.

Continued use of the Services does not replace consent where consent is legally required.

9.2 Contact Information

For questions about this Privacy Policy, our data practices, or your privacy rights, contact:

Email: privacy@DopamineOS.com

9.3 Marketing and Publicity

Dopamine will not use a Client’s name, logo, or likeness in marketing materials, case studies, or

public communications without the Client’s prior written consent.

You may opt out of promotional communications at any time by emailing help@DopamineOS.com or using

the unsubscribe link included in promotional emails. Opting out of promotional communications does

not prevent delivery of necessary account, billing, security, or other service-related messages.