Privacy Policy: data collection, processing, and retention
Duale AI's privacy policy describes how the company collects, processes, and retains personal data across its website, SaaS platform, and communications.
This policy covers data collection, processing purposes, retention periods, security controls, and cookie choices for Duale AI services.
- Data collected and processed by Duale AI.
- Purposes of processing and legal bases.
- Retention periods and qualification limits.
- Security controls and incident notifications.
- Cookie purposes and browser storage choices.
Summaries were generated by AI.
Introduction
This policy describes how Duale AI collects, uses, and protects personal data.
It applies to the website, the SaaS platform, and communications.
See also the terms of use and the terms of sale.
Language. This policy exists in French and English. If the two diverge, the French version prevails.
Data controller
DUALE AI SAS; share capital €10,000; Paris Trade Registry 994 521 128; 60 rue François 1er, 75008 Paris, France
DPO: contact+dpo@mail.duale.ai
Data collected
Data Duale AI controls
Data you provide: name, email, company information, payment details, support messages.
Automatic collection: IP address, device information, pages visited, logs.
Necessary browser diagnostics measure errors, requests, and performance. Optional behavior measurement can also use cookie identifiers and a browser fingerprint derived from device and browser characteristics to recognize visits. The choices and services involved are described under Cookies.
Data Duale AI processes on the Customer’s behalf
AI Services: prompts, documents, generated outputs, configurations, Tool arguments and results, and remote MCP Tool catalog definitions. MCP Connection configuration can include a credential for the Customer-selected remote server.
Web research continuity: when a Customer execution asks to reuse a Web session, the Platform can retain website
cookies, including HttpOnly values, exact-origin localStorage and sessionStorage, browser-profile attributes, and
proxy-binding metadata. Do not put credentials or personal data into a Web session unless the Customer has authorized
that processing.
Internal models: Duale AI uses open-source models hosted on European infrastructure to perform analysis and add intelligence to the Platform. This processing stays on Duale AI’s infrastructure.
If you submit third-party personal data to AI Agents, you are the data controller (Duale AI acts as data processor).
Public documentation search
The public documentation service processes the query text and can retain its derived vector embedding in a shared cache. It does not store the raw query text in that cache key or application telemetry.
Purposes of processing
When Duale AI is the controller
When Duale AI is the processor
- Purpose
- Customer Content, Outputs, and requested AI processing
- Role or legal basis
- The Customer determines the Article 6 basis as controller; Duale AI processes this data on the Customer’s documented instructions as processor under Article 28
Data recipients
Internal: only authorized employees, following least-privilege principle.
Subprocessors: Subprocessors list. Duale AI notifies any addition or replacement 30 days before if the subprocessor is in the European Economic Area, or 90 days before if outside the European Economic Area. Objections: contact+legal@mail.duale.ai
Others: competent authorities upon legal request, professional advisors (lawyers, auditors), acquirer in case of sale (prior notification).
Web research recipients: public search engines receive the query and request metadata needed to return results. Destination websites receive the requested URL, network metadata, and any cookie or origin state that the Customer asks the portable session to reuse for that origin. These recipients determine their own processing under their published terms. A Duale AI-selected proxy provider can also relay the request; the active provider must appear on the subprocessor list before Web research processes personal data through it.
Customer-selected MCP servers: while a Connection is enabled, periodic catalog checks send the configured credential and request or network metadata to the remote server. The server returns the names, titles, descriptions, annotations, and schemas of its Tools. A Tool Call separately sends the native Tool name, Tool arguments, request or network metadata, and the same configured credential; the server returns the Tool result. Duale AI does not send the Agent Identity or end-user identity as part of either MCP request. The Customer selects the server, remote account, processing terms, location, and lawful basis for personal data sent through that path.
Data location
Hetzner hosts the application data in Germany. The website and network protection run through Cloudflare.
Transfers outside the European Economic Area: Data Privacy Framework where it applies, or 2021 standard contractual clauses with supplementary measures where required.
Details: Subprocessors
Retention periods
The status column distinguishes a stated period or legal criterion from a target, logical reuse boundary, or cache expiry that does not prove physical deletion by that time.
Content-bearing technical traces
Technical traces support diagnosis and service operation. They can contain the content of a prompt, a generated Output, a Tool argument, and a Tool Result. Access is limited to authorized Duale AI staff who need the traces for those purposes. They are not exposed in the web interface or through the API. The trace table applies a 365-day row TTL, but it deletes only when every eligible row in a storage part has expired. It therefore does not enforce a 365-day maximum for each trace. The data processing agreement requires deletion or return after processing services end, but the current retention control has not been qualified to enforce a Tenant-specific completion deadline. Do not treat contract-end deletion as an enforced timing control until Duale AI publishes that qualification.
Contract, claim, and execution records
The five-year criterion applies only to contract and claim records needed to establish, exercise, or defend legal claims. Its trigger follows Article 2224 of the French Civil Code. Other account data is erased or made anonymous when it is no longer necessary. Invoices are kept for ten years under Article L123-22 of the French Commercial Code.
Duale AI further keeps, for twelve months after each recorded Provider Attempt, the provider and model identifiers, call timestamps, and root Task identifier. These records contain no message content and outlive the contract, to establish and defend legal rights. They are not a complete Provider Attempt or Runtime Route history. The detail is in the Evidence and cooperation terms.
A successful Stop also records the identity, a person or an Agent Identity, that requested it, the time, and the caller-supplied reason. That reason is content-bearing text. The audit-log policy targets twelve months, but current controls do not enforce a maximum retention period for the Stop record. The data processing agreement’s contract-end rule continues to apply to Customer Content in that record.
Qualification limits
After the stated duration, Duale AI deletes data or makes it anonymous where the applicable retention process exists. Audit records can outlive the 12-month target because audit-log expiry is not currently enforced.
Disabling or deleting an MCP Connection stops its future catalog checks and new Tool Calls, but does not delete the retained Tool definitions or last published assignment context in this release. Expiry prevents those Tools from being offered to a model. Where that retained data contains personal data processed for a Customer, the data processing agreement’s contract-end deletion obligation still applies, but the current controls have not been qualified to prove a Tenant-specific completion deadline.
The Web-session and documentation-query periods above are reuse or cache-expiry boundaries, not proof that every copy was physically erased by that time. Where a Stop record or portable Web-session state contains personal data processed for a Customer, the data processing agreement’s contract-end deletion obligation still applies, but the current controls have not been qualified to prove Tenant-specific removal across every retained record or cache value.
Security
Security controls
Duale AI uses TLS for customer-facing Platform paths. It applies application-level encryption at rest to Library documents and derived search data, database backups, and reporting copies. Duale AI requires multi-factor authentication for sensitive account changes, separates data per Customer, controls access by role, and records configuration, access, Tool dispatch, and task lifecycle events.
Storage exceptions
Page access can cache eligible tenant-scoped resources from public pages for about seven days without application-level encryption at rest. Requests that contain cookies or authorization credentials bypass that public-page cache. A separate scoped portable-session cache stores cookies and exact-origin storage when the Customer requests reuse; its physical expiry can exceed the 30-day logical reuse boundary, and Duale AI publishes no application-level encryption-at-rest guarantee for that value.
The binding list is in the data processing agreement.
Incident notifications
In case of breach. For the data Duale AI controls (account, billing, and security), Duale AI notifies the supervisory authority without undue delay and, where feasible, within 72 hours (GDPR Art. 33(1)).
For the Content you submit, Duale AI acts as processor: it notifies you without undue delay (Art. 33(2)), and you must notify your supervisory authority if the breach warrants it.
When an incident requires notification under applicable law, Duale AI alerts you within 24 hours and delivers a final report within one month. Outside those cases, Duale AI informs you as soon as it can.
Contact: contact+security@mail.duale.ai
Your rights
Under GDPR (Art. 15-21), you have these rights:
- Access your data (Art. 15)
- Rectify inaccurate information (Art. 16)
- Erase your data (Art. 17)
- Restrict processing (Art. 18)
- Port your data in structured format (Art. 20)
- Object to processing (Art. 21)
- Withdraw consent at any time without affecting prior processing (Art. 7.3)
Contact: contact+privacy@mail.duale.ai. Duale AI responds within one month. It can extend this period by two months for complex requests.
Recourse: complaint to your supervisory authority (for France: CNIL, https://www.cnil.fr)
Duale AI does not sell personal data.
Cookies
Cookies and other browser storage serve four purposes. You can choose Customer support and Behavior independently; refusing either does not prevent account creation or use of the Platform.
Your choices apply to both the public website and Duale AI Dashboard in the same browser and service environment.
In production, this covers duale.ai and its Dashboard subdomains, including app.beta.duale.ai. Test environments
keep separate choices. The purposes and providers described below apply whether you first choose on the website or
in Dashboard.
- Purpose
- Essential
- What it covers
- Authentication, requested service functions, and remembering privacy choices
- Your choice
- Required
- Purpose
- Security and reliability
- What it covers
- Duale AI’s necessary error, request, and performance diagnostics on its own infrastructure
- Your choice
- Required; linked to your visits only if you enable Behavior
- Purpose
- Customer support
- What it covers
- Crisp chat, its session cookies, and the messages and profile details needed for support
- Your choice
- Optional
- Purpose
- Behavior
- What it covers
- Audience and journey measurement, recognition of visits, and public-site interaction analysis
- Your choice
- Optional
The first-visit notice offers Accept all, Reject all, and Customize. You can reopen Privacy settings from the website footer or Dashboard navigation. Acceptance, refusal, custom settings, and withdrawal apply across both. Saving a first decision or changed choices reloads the page. Choices last six calendar months; visiting either app or saving an unchanged choice does not renew that period.
An essential preference cookie remembers these choices even when optional purposes are refused. This cookie is separate from the optional visitor identity described below and is not used for analytics. Choices stay in this browser; they are not synchronized through your account, across devices, or through a fingerprint. If the browser removes the cookie, you will be asked again.
Optional services and identifiers
Customer support: Crisp loads only when this choice is enabled. It uses cookies to reconnect you to a conversation and stores conversations on its servers. In Dashboard, Duale AI can provide your name, profile image and internal account identifier when your profile loads. Opening support chat also provides your verified email address. Crisp’s session cookie normally lasts six months and is renewed when the chat loads, as described in Crisp’s cookie policy. You can also contact support by email at contact+support@mail.duale.ai.
Behavior: When this choice is enabled, Duale AI measures visits and actions on the website and Dashboard using its own analytics infrastructure.
With Behavior enabled, Duale AI uses a shared session cookie to link visits across duale.ai subdomains and a browser
fingerprint to help recognize returning browsers. It sends these identifiers, and your internal account identifier
when signed in to Dashboard, to its own analytics infrastructure. Crisp also receives them when
Customer support is enabled. Your account identifier can link activity across signed-in devices. These identifiers
can also link visits to error, request and performance records.
The fingerprint does not reliably identify a physical device. The session cookie has no fixed expiry and follows the browser’s session lifetime, which can include session restore.
The six-month retention period applies to Duale AI’s own website events. Crisp’s account settings and terms govern the retention of support data, independently of consent or cookie expiry. Supplier details are in the subprocessor list.
Withdrawing a choice from either app applies to both. The current page reloads; other open pages apply the change and reload when the browser reports it or when they become active again. Withdrawal does not erase earlier records or support conversations. Use the contact details under Your rights to request access or deletion.
Browser signals
Duale AI treats Global Privacy Control and Do Not Track as a refusal of Behavior collection. These signals do not prevent you from enabling Customer support and do not disable Essential or Security and reliability functions.
Minors
B2B platform, reserved for professionals. Access is limited to Users whom a Customer authorizes and who are at least 18 years old. Duale AI does not knowingly collect data from minors. Report concerns: contact+privacy@mail.duale.ai
Automated decisions and artificial intelligence
Automated decisions by Duale AI as controller
Duale AI does not use the personal data it controls for automated decisions producing legal effects concerning you (GDPR Art. 22).
AI transparency
AI transparency (Regulation (EU) 2024/1689): The Platform API does not itself expose a conversational interface to natural persons. The duties that apply to a Customer integration depend on the actual provider or deployer role and the use that people encounter. Re-exposing an Output does not by itself make the Customer a provider or establish a direct-interaction duty under Article 50(1). See Transparency: Who informs whom in the Terms of Use.
Customer-configured Agent processing
AI Agents configured by Customers can process third-party data. In this case:
- The Customer is data controller (Duale AI = processor)
- The Customer is responsible for GDPR Art. 22 compliance if Agents make automated decisions affecting third parties
Processing on behalf of Customers
When the Customer uses the Platform to process third-party personal data, the Customer is data controller and Duale AI acts as data processor (GDPR Art. 28). The data processing agreement forms a section of the terms of sale and sets out Duale AI’s commitments.
Contact: contact+legal@mail.duale.ai
Modifications
Duale AI notifies substantial changes by email 30 days before they take effect.
Contact
- Privacy: contact+privacy@mail.duale.ai
- DPO: contact+dpo@mail.duale.ai