# Privacy Policy > What Duly keeps, who sees it, and what you can ask us to do. Effective 19 October 2026. ## What this covers Duly ("Duly," "we," "us," or "our") operates joinduly.com and is responsible for the personal information collected through this site and the waitlist. This policy covers joinduly.com, the Duly waitlist, and the Duly app (web, iPhone and Mac) while it is in invite-only preview. "Duly", "we" and "us" mean B TECH TECNOLOGIA DA INFORMACAO LTDA, a company registered in Brazil under CNPJ 52.731.063/0001-11. A **Team** is a workspace; its **owner** and **admins** manage it. **Team content** is what people and AI teammates put into a Team: messages, files, requests, and results. We handle Team content to run Duly for the Team and follow the owner's choices. For account, billing and product-quality data, we decide how it is used, as this policy says. The [User Terms](https://joinduly.com/terms) cover the rest. You accept them when you create a Team or join one: the sentence under Create Team and under Join says so and links to them and to this policy. ## What we collect **You give it to us.** Your name and email when you sign in or are invited; a profile picture and handle if you add them; everything you and your AI teammates write or upload in a Team; a note if you write to us. **Our sign-in provider sends it.** Sign-in goes through WorkOS. It tells us your user id, your email, whether it is verified, your name, and the method you used, such as email or your company's single sign-on. We store no passwords. **We record it as you use Duly.** - Product records in our own database: counts and timings of things like messages sent, runs that failed, invites used and credit bought. They hold ids, kinds and numbers, not message text. - Error and performance reports sent to Better Stack: app version, operating system, a random session id, how long a reply took, which kind of request failed (ids removed), and crashes. On the web we turn off the options that would attach your name, email or click trail. The iPhone and Mac apps send none of these reports today. Our servers also send Better Stack traces and, for failed AI calls, copies with free text redacted. - A record each time you accept the User Terms: which version, when, and whether you were creating a Team, opening an invite link or answering an invitation. - Server logs at our cloud hosting providers: time, route, IP address and similar technical details. ## How we use it To run Duly (sign you in, deliver messages, run AI teammates, store files, send notifications, bill the Team), to keep it safe and fix bugs, to answer support requests, to improve results (below), and to meet legal duties. We do not sell personal information or share it for advertising, and we use no advertising or analytics cookies. We do not train models on Team content. We do not sell personal information or share it for cross-context behavioral advertising, whether or not your browser sends a Global Privacy Control signal. ## AI model providers AI teammates do their work by sending it to AI models run by other companies: the instructions, the conversation they need, what people wrote, files and pictures they were given, and the output of tools they used. - Most requests go through **OpenRouter**, which passes them to a company that runs the model. The models we use are made by OpenAI, Anthropic, Google and xAI. - Pictures an AI teammate creates go straight to **OpenAI** or **Google**. - When dictation is available, the web app sends the audio clip to **xAI**, or to **Groq** if xAI is down. We do not store the audio. The Apple apps turn speech into text on the device. These calls run on Duly's accounts, not yours. Each provider handles what it receives under its own terms. We tell OpenRouter to send our requests only to providers that do not collect them to train on. The companies we call directly for pictures and dictation, OpenAI, Google, xAI and Groq, do not train on what we send either. Providers may keep requests for a limited time, for example up to 30 days to check for abuse; we have not turned on zero retention. A Team that does not want its content to reach these providers cannot use AI teammates. AI teammates also use tools. A web search sends the query the teammate writes to **Brave Search**. Reading a web page fetches the public address the teammate picks. **Plugins** (connections built on MCP) send what the teammate gives them to the partner a person connected, which has its own policy. Owners and admins decide which plugins are allowed. ## Help improve results For every Team we count what happens to results: kept, asked for again, corrected, or stopped. The counts hold no words. Today this covers only pictures an AI teammate draws. We use the counts to compare models. "Help improve results" is a Team setting, and **it is on by default**. Once the Team's owner has seen the setting, and while it is on, we also keep the request someone typed and a pointer to the picture. We use them ourselves to compare models and to build the set of requests we test them on. Only the owner can turn it off. Turning it off stops new material from being kept; **what was kept stays**, including after the Team closes. ## Who can see Team content People in the Team see what its rooms and permissions allow. Owners and admins manage members, AI teammates, spending and plugins; being an admin does not by itself put you in other people's conversations. **Duly staff** can read Team content in three ways: an internal read-only tool that shows message text, AI teammate run records and problem reports, but not names, emails, handles or tokens; an administration tool for operators; and direct database access, which the founder has. We use them for support, to debug failed runs, and to improve the product. AI teammates can also file problem reports to us, with free text of their own. Reads through the internal tool are logged. We share information beyond that only with the providers below, with a company that acquires or merges with us, with advisers under confidentiality, and where the law requires or to protect people from harm. Where we can, we tell the Team first. ## Who else handles your data | Provider | What for | | --- | --- | | Railway, in its US East region | Servers and databases | | Cloudflare | Serving the site and the web app, carrying app traffic, file storage, the waitlist database | | WorkOS | Sign-in and single sign-on | | Stripe | Payments for credit | | OpenRouter, OpenAI, Anthropic, Google, xAI, Groq | AI models, images and dictation | | Brave Search | Web search queries from AI teammates | | Better Stack | Error, performance and trace reports | | Apple | Push notifications to the iPhone and Mac apps. They carry a wake-up signal, not message text. | We will update this list when it changes. Plugins a person connects are their own choice and are not listed. ## Payments Teams buy credit through Stripe, which collects the card number. We keep the card brand and last four digits, the amount, tax, and the ids that tie a purchase to Stripe. We keep these records for at least 5 years after the purchase, as tax law requires. ## Cookies and browser storage The web app sets only the cookies it needs: a session cookie, a platform cookie, a short sign-in cookie and a security (CSRF) cookie. All are cleared when you sign out. We use no advertising or analytics cookies and load no third-party scripts in the app. It also keeps recent searches, a local copy of data you have seen, and an offline cache in your browser. The Apple apps keep your session in the Keychain and a local copy of recent data on the device. The site sets no cookies. ## Waitlist When you join on the invite page, or an agent acting for you uses our MCP server or the waitlist endpoint, we store your email (the key of your record, used to send your invite code), optional company, team size and role (to open the right wave first), the wave and source, your country from Cloudflare, a truncated hash of your IP address (we store the hash instead of the address) and the first 200 characters of your browser's user agent (both to limit abuse), and timestamps. Records live in a Cloudflare D1 database that only the Duly team can read, and we send invite codes by hand. We keep a record until the waitlist closes and its invites have gone out, then delete it. Nothing in it moves to your Duly account when you join. Where applicable law requires a legal basis, we rely on our legitimate interests in responding to your invite request, operating the site, and preventing abuse. Where we rely on your consent, you may withdraw it by contacting us. You can ask us to remove you from the waitlist and delete your record at any time. ## How long we keep it - **Messages, files, run records and large tool outputs:** until the Team's owner asks us to delete them. We do not delete Team content automatically, including when a Team closes. - **Deleted messages:** the words, edit history, search text and the message's files are emptied. A teammate's run record may remain, and an edited message keeps earlier wording in its history until it is deleted. - **Recent searches:** 30 days. - **Product and model-call records:** counts and metadata with no message text; we keep them after a Team closes. - **Sign-in:** a session in the apps lasts up to 30 days. In the browser it ends after 12 hours without use, and activity extends it. ## Your choices and rights Email [support@joinduly.com](mailto:support@joinduly.com). We answer within 30 days, wherever you live. You can ask us to show you what we hold about you, correct it, delete your account or a Team's content, or give you a copy. There are no self-service buttons for these yet, so we do them by hand, keeping only what the law or security requires. Deleting your account closes it and removes your name, email, picture and handle; what you wrote in a Team stays with the Team, shown as from a former member. Where other people wrote your name, it stays. Deleting a Team's content closes the Team and erases its messages, files and run records; the empty records that billing and usage figures rely on stay. A copy holds what you wrote, or, for a Team's owner, what they can open in the Team, without other people's direct messages or private rooms. It comes as JSON with the files. Copies in our backups go when those backups expire. Closing a Team does not remove its content; ask us. If you are in a Team, you can also ask its owner. **California.** We do not sell or share personal information for advertising, and we will not treat you worse for asking about your information. **EEA and UK.** You have the rights of access, correction, deletion, objection and complaint to your data protection authority. Our servers are in the United States. When personal information moves there from the EEA, the UK or Brazil, we rely on the standard contractual clauses in our providers' data processing agreements. ## Security Sign-in sessions are stored as hashes, passwords are handled by WorkOS and not by us, and each Team's files are kept apart. No system is perfectly secure. If you find a problem, write to [support@joinduly.com](mailto:support@joinduly.com). ## Age Duly is not for children. You must be at least 18 to use it. ## Changes When this policy changes, the date at the top changes. For a material change we email Team owners and waitlist members at least 14 days before it takes effect. ## Contact [support@joinduly.com](mailto:support@joinduly.com), or the [contact page](https://joinduly.com/contact). B TECH TECNOLOGIA DA INFORMACAO LTDA, CNPJ 52.731.063/0001-11. Rua Henrique Schaumann, 182, Pinheiros, São Paulo, SP, 05413-010, Brazil.