Duezy — Privacy Policy & Data Governance

1. Overview & Commitment

At Duezy ("we", "us", "our"), we respect your privacy and are committed to protecting the confidential financial, client, and communication data you entrust to our automated invoice reminder platform.

This Privacy Policy explains how Duezy collects, processes, protects, and discloses personal and commercial data when you access our web application, desktop interface, APIs, or integration services.

Core Privacy Principle: Duezy is a workflow productivity assistant for independent consultants, freelancers, and professional firms. We do not sell your personal data, we do not monetize your client invoice details, and we do not use your confidential communications to train public AI models.

2. Google API Services & Gmail Limited Use Policy

Duezy allows users to optionally connect their Google Account via OAuth 2.0 to dispatch follow-up emails directly from their own professional email address (via the Gmail API scope https://www.googleapis.com/auth/gmail.send) and to track incoming payment replies.

✅ Google API Services User Data Policy Compliance

Duezy's use and transfer to any other app of information received from Google APIs will strictly adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Minimal Access: We only request the minimal permissions required to compose and dispatch follow-up emails you review or schedule.
No Model Training: Google Workspace user data and Gmail message contents are never used to train, retrain, or improve generalized or foundation machine learning (ML) or artificial intelligence (AI) models.
No Third-Party Transfers: Google user data is never transferred or sold to data brokers, advertisers, or third-party marketing services.
Human Access Prohibited: No human employees or contractors read your private emails, except when strictly necessary for security investigations, system debugging with your explicit consent, or to comply with applicable law.

3. Information We Collect

A. Account & Administrative Credentials

Contact Details: First name, last name, business email address, phone number, and practice/company name.
Authentication Information: Salted, cryptographically hashed passwords and encrypted session identifiers. We never store plain-text passwords.

B. Invoice & Remittance Information

Client company name, accounts payable contact name, and billing email.
Invoice identification numbers, amounts owed, currency codes (e.g. USD, EUR, GBP, CAD, ILS ₪), issue dates, and due dates.
Banking remittance details you configure (bank name, routing number, account number, SWIFT/IBAN, PayPal, Stripe payment links).

C. Communications & AI Scripting Data

Outgoing follow-up reminders, email drafts, tone settings (Warm, Direct, Firm, Executive), and client replies you choose to log.
Contextual notes you enter regarding delayed transfers or payment arrangements.

D. Payment Card & Billing Data

All subscription payments are handled directly by PCI-DSS Level 1 certified payment processors (e.g., Stripe).
Zero Card Storage: Duezy never stores or logs raw credit card numbers or CVC security codes on our servers. We only retain non-sensitive metadata (card brand, last 4 digits, expiration month/year, and customer tokens) to display your active payment method.

4. Artificial Intelligence & LLM Processing Disclosures

Duezy uses advanced Large Language Models (including Google Gemini models) to help you extract invoice details from uploaded documents and draft diplomatic follow-up emails.

Episodic In-Flight Processing: Prompts sent to AI engines are ephemeral and processed in real time solely to fulfill your specific drafting or extraction request.
Enterprise Zero-Retention Agreements: Our enterprise API agreements mandate that customer prompts and invoice data are not logged or used to train general foundation models.

5. Your Privacy Rights (GDPR & CCPA/CPRA)

Regardless of your geographic location, Duezy provides all users with comprehensive data sovereignty tools:

Right to Access & Portability: You may download a complete, machine-readable JSON archive of all your invoices, client contacts, settings, and communication history directly from the Settings menu (1-Click Data Export).
Right to Rectification: You can edit any client contact, due date, invoice amount, or bank signature at any time.
Right to Erasure (Right to be Forgotten): You have the permanent right to delete your account and wipe all stored invoices, tokens, and data with one click.
Right to Revoke Integrations: You can disconnect your Google OAuth Gmail integration at any time directly from the dashboard navbar or through your Google Account Security settings.

6. Data Security & Retention

We employ industry-standard administrative, physical, and technical defenses to protect your information:

Transport Layer Security: All data in transit is encrypted using modern TLS 1.3 / HTTPS.
Multi-Tenant Data Isolation: Every consultant's account is strictly partitioned by unique user identifiers to prevent cross-account data leakage.
Data Retention: We store your data only for as long as your account remains active. Upon account deletion, all customer records and OAuth refresh tokens are permanently purged within 24 hours.

7. Contact & Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or our security practices, please contact our Data Governance team:

Duezy Privacy & Data Governance Office
Email: privacy@duezy.com
Response Time: Within 48 business hours.