Privacy
DUEX is in early private pilot. This page explains, in plain language, how we handle information from people who visit duex.app, write to us, take part in a pilot, or hear from us about DUEX.
Who we are
DUEX is an early-stage product operated by Arvinder Singh from Toronto, Canada. Privacy contact: [email protected].
Our role
For the deal context a customer submits to DUEX during a pilot, DUEX acts as a service provider (a "processor" under GDPR and a "service provider" under CCPA): the customer decides what data goes in, and DUEX processes it on the customer's instructions. For website visits, sales outreach, account administration, and people writing directly to us, DUEX acts as an independent controller.
What we collect
- Site visits. Basic visit logs — your IP address, the type of browser you use, the page you came from, and the page you viewed — collected by our hosting provider for security and to keep the site running.
- Email you send us. When you write to [email protected], we keep your message and contact details so we can reply and follow up.
- Sales outreach. We may collect business contact information — name, role, company, work email, public LinkedIn or company profile, and any reply history — so we can write to potential business customers about DUEX. Recipients can opt out at any time by replying to the email or writing to [email protected]; we will record the opt-out and not contact you again about DUEX.
- Pilot data. If you take part in a paid pilot, the deal context you submit through DUEX is stored so we can run the review and produce a decision record. The customer chooses what to put in this field, including any personal data of third parties.
- Demo submissions. The demo at duex.app/demo is open and free. If you paste deal text into it, that text and the memo it produces are sent to our frontier-model review providers (listed on our Subprocessors page) and saved to DUEX's own database so we can operate, debug, and improve the review. Please do not paste anything you are not authorized to share or that must stay confidential, and avoid the sensitive categories listed below. You can ask us to delete a demo submission at any time at [email protected].
What we do with it
- Run the site, respond to inquiries, run pilots, contact prospective customers, and improve the product.
- We do not sell or share personal information for cross-context behavioral advertising.
- We do not use your pilot data to train shared models that serve other companies. The frontier-model providers we call — listed on our Subprocessors page — operate under business API terms whose default is no training on submitted inputs.
- During early pilots and open demos, we save each completed review (the deal context you submitted, the resulting memo, and basic metadata like cost and timing) to DUEX's own database so we can debug the workflow and improve the review engine. We do not share this with other customers, and we delete it on request within 30 days unless we need to keep it for security, legal, or billing reasons.
Companies that help us run DUEX
To run DUEX we rely on a small, defined set of outside companies. The full list — each company's name, what they do for us, where they are, and a link to their data terms — is at duex.app/subprocessors.
At a glance:
- Cloudflare — DNS, hosting, and security for the public site.
- Railway — application hosting and the database where your pilot data is stored.
- Google Workspace — our email at [email protected].
- Frontier-model providers (named on our Subprocessors page) — the providers whose models power the reviews. DUEX calls their business API endpoints, whose contractual defaults do not train on the inputs we send. Each pilot review may be sent in parallel to several providers for independent perspectives, and to one for a separate double-check.
We notify active pilot customers by email at least 15 days before adding a new company that would process their pilot data.
Where your data goes
DUEX is based in Canada and uses service providers that may process data in Canada, the United States, the European Economic Area, the United Kingdom, and other locations where they operate. For personal data of EU, UK, or Swiss data subjects, DUEX uses the European Standard Contractual Clauses, the UK International Data Transfer Addendum, or other appropriate safeguards — set out in our Data Processing Addendum.
Sensitive data we do not handle
Please do not submit protected health information, payment card data, government IDs or classified information, children's data, biometric identifiers, or other regulated sensitive data through DUEX, unless we have agreed in writing that your pilot is configured for it. The full restriction list is in our Acceptable Use Policy.
How long we keep your data
| Data type | How long we keep it |
|---|---|
| Pilot deal context | During the pilot, then deleted from our active systems within 30 days after the pilot ends or your written request — whichever comes first. The pilot agreement may set a different period. |
| Approval memos and decision records | During the pilot, then deleted from our active systems within 30 days after the pilot ends, unless you ask us to keep them. |
| Operational and security logs | Typically up to 90 days, unless we need them longer for an investigation. |
| Emails and business records | As long as needed for business, legal, tax, accounting, and dispute purposes. |
| Sales outreach records | Until the contact is no longer relevant for outreach, plus a "do not contact" record we keep to honor opt-outs. |
Deletion requests remove pilot data from active systems within 30 days. Copies may remain in encrypted backups or in provider logs until they expire under normal cycles, unless earlier deletion is technically feasible. Some review providers also keep inputs and outputs briefly for abuse monitoring under their business API terms — details on the Subprocessors page.
Your rights
You can ask us to see, correct, delete, restrict, or export information we hold about you, object to processing, or withdraw consent where we relied on it. Email [email protected]. We respond within 30 days unless applicable law allows or requires a different period. We may need to verify your identity, and for pilot data we may direct your request to the customer who controls that data.
Automated processing
DUEX uses automated language models to generate review outputs, but every Output is reviewed by a person at the customer organization before any decision is made. DUEX does not make solely automated decisions that produce legal effects on you within the meaning of GDPR Article 22 or that have a similarly significant effect on you.
For California residents
If you are a California resident, you may have rights under the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), including the right to know, the right to delete, the right to correct, the right to opt out of sale/sharing, the right to limit use of sensitive personal information, and the right not to be discriminated against for exercising your rights.
- Categories of personal information we collect: identifiers (name, email, IP), commercial information (deal context you submit), internet activity (visit logs), professional information (role, company), inferences drawn from the above.
- Sources: you, your employer, public business profiles, our hosting provider.
- Purposes: to run and improve the service, communicate with you, and comply with law.
- We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
- To exercise any right, email [email protected]. We will not discriminate against you for doing so.
Cookies and third-party scripts
This site does not use tracking or advertising cookies. It does not load fonts, analytics, or any other resources from third-party servers — the Inter typeface is served from duex.app itself. If the product later needs to store small data files in your browser to work, we will update this policy.
Children
DUEX is a B2B product not directed at people under 16, and we do not knowingly collect their personal information.
Changes
As DUEX grows, this policy will be updated. The effective date at the top reflects the most recent revision. We will notify active pilot customers of material changes.
Contact
Questions about this policy: [email protected].