Privacy Policy
How we collect, use, and protect your information.
Last Updated: February 1, 2026
Introduction
DataFrame Labs ("we," "our," or "us") is committed to protecting the privacy of our clients, website visitors, and business contacts. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website, engage our services, or otherwise interact with us.
We provide quantitative research, data products, and analytical tools to financial institutions. Given the sensitive nature of our industry, we maintain rigorous standards for data protection and confidentiality.
By accessing our website or using our services, you acknowledge that you have read and understood this Privacy Policy.
Information We Collect
Information You Provide
We collect information that you voluntarily provide to us, including:
- Contact Information: Name, email address, phone number, company name, and job title when you submit inquiries through our contact form or communicate with us directly.
- Business Information: Details about your organization, investment focus, and specific requirements when discussing potential engagements.
- Communications: Records of correspondence when you contact us via email or other channels.
Information Collected Automatically
When you visit our website, we automatically collect certain information, including:
- Device Information: Browser type, operating system, device type, and screen resolution.
- Usage Data: Pages visited, time spent on pages, navigation paths, and referring URLs.
- Network Information: IP address and approximate geographic location (city/country level).
How We Use Your Information
We use the information we collect for the following purposes:
- Service Delivery: To respond to inquiries, provide requested information, and deliver our research, data products, and analytical tools.
- Business Development: To evaluate potential client engagements and tailor our services to your needs.
- Website Improvement: To analyze usage patterns and optimize our website's performance, content, and user experience.
- Communications: To send relevant updates about our services, research publications, or industry insights (with your consent where required).
- Legal Compliance: To comply with applicable laws, regulations, and legal processes.
Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies to enhance your browsing experience and collect analytical data.
Types of Cookies We Use
- Essential Cookies: Required for basic website functionality, such as page navigation and access to secure areas.
- Analytics Cookies: Help us understand how visitors interact with our website by collecting aggregated, anonymous usage data.
Managing Cookies
Most web browsers allow you to control cookies through their settings. You can typically set your browser to refuse all cookies, accept only certain cookies, or notify you when a cookie is set. Please note that disabling cookies may affect the functionality of our website.
Third-Party Services
We use the following third-party services that may collect information about your use of our website:
Google Analytics
We use Google Analytics to analyze website traffic and usage patterns. Google Analytics collects information such as how often users visit our site, what pages they visit, and what other sites they used prior to coming to our site. Google Analytics collects only the IP address assigned to you on the date you visit our site, rather than your name or other identifying information.
You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
Hosting Services
Our website is hosted on GitHub Pages, which may collect technical information about visitors as described in GitHub's privacy statement.
Data Retention
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.
- Contact Form Submissions: Retained for the duration of our business relationship plus 3 years, or as required by applicable law.
- Client Engagement Records: Retained for 7 years following the conclusion of the engagement, or as required by financial services regulations.
- Website Analytics Data: Aggregated analytics data is retained for up to 26 months.
Data Security
We implement appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit using TLS/SSL protocols
- Access controls limiting data access to authorized personnel
- Regular security assessments and monitoring
- Secure development practices for our software and systems
While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
Information Sharing and Disclosure
We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We may share your information in the following circumstances:
- Service Providers: With trusted third-party vendors who assist us in operating our business, subject to confidentiality obligations.
- Legal Requirements: When required by law, regulation, legal process, or governmental request.
- Business Transfers: In connection with a merger, acquisition, or sale of assets, where personal information may be transferred to the acquiring entity.
- Protection of Rights: To protect our rights, property, or safety, or the rights, property, or safety of others.
European Users (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have certain rights under the General Data Protection Regulation (GDPR) and similar data protection laws.
Legal Basis for Processing
We process your personal data based on the following legal grounds:
- Contract Performance: Processing necessary to perform our contract with you or take steps at your request before entering into a contract.
- Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our services and communicating with potential clients.
- Consent: Where you have given explicit consent for specific processing activities.
- Legal Obligation: Processing necessary to comply with legal requirements.
Your Rights
Under GDPR, you have the right to:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete personal data.
- Erasure: Request deletion of your personal data in certain circumstances.
- Restriction: Request restriction of processing of your personal data.
- Data Portability: Request transfer of your personal data to you or a third party in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests or for direct marketing purposes.
- Withdraw Consent: Withdraw consent at any time where processing is based on consent.
To exercise these rights, please contact us using the information provided below. You also have the right to lodge a complaint with a supervisory authority in your country of residence.
California Residents (CCPA)
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information.
Your Rights
- Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collecting it, and the categories of third parties with whom we share it.
- Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
- Right to Correct: You have the right to request correction of inaccurate personal information.
- Right to Opt-Out: You have the right to opt out of the "sale" or "sharing" of your personal information. Note: We do not sell personal information as defined under CCPA.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
Categories of Information Collected
In the preceding 12 months, we may have collected the following categories of personal information:
- Identifiers (name, email address, IP address)
- Professional or employment-related information
- Internet or electronic network activity information
- Inferences drawn from the above information
To exercise your CCPA rights, please contact us using the information provided below. We will verify your identity before processing your request.
International Data Transfers
DataFrame Labs is based in the United States. If you access our website or services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers are located.
When we transfer personal data from the EEA, UK, or Switzerland, we implement appropriate safeguards, such as standard contractual clauses approved by the European Commission, to ensure adequate protection of your data.
Children's Privacy
Our website and services are intended for business professionals and are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately, and we will take steps to delete such information.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this policy. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
Contact Us
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us:
We aim to respond to all privacy-related inquiries within 30 days.