Privacy Policy
Effective 13 August 2026
This policy explains what Dualzo collects when you use Dualzo, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it. It applies to the Dualzo web application and its background services.
- We read your source code only to plan and execute the work you ask for.
- We do not train models on your code, and we do not sell your data.
- Your provider API keys are stored encrypted and never written to logs.
- We never see your full card number — Paddle handles payments.
- Audit logs are append-only and pruned after 90 days.
1. What we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Name, email, hashed password, verification state, workspace membership and role | To create and secure your account and control access |
| Social identities | Google or GitHub user id and email when you sign in with them | To let you sign in without a password and to link an existing account by verified email |
| Repository metadata | Repository name, default branch, detected ecosystem and language, indexed file paths and content hashes | To index a repository and target the right files |
| Repository content | Source files, manifests, CI configuration, README, and the slices sent to your model provider | To build a plan, execute an approved task, and validate the result |
| Task data | Issue titles and bodies, prompts you write, plans, per-task output, diffs, validation output, pull request links | To run and display the pipeline |
| Audit records | Who did what and when: webhooks, plans, approvals, executions, validations, billing and admin actions | To provide the governance trail the product exists for |
| Billing data | Paddle customer and subscription ids, invoice numbers, amounts, transaction status | To operate subscriptions and produce invoices |
| Credentials | Your model provider API key, GitHub App installation tokens | To run work on your behalf. Stored encrypted; tokens are short-lived and cached only until expiry |
| Technical data | IP address, user agent, session identifier, application and job logs | Security, abuse prevention, and debugging |
We do not intentionally collect special categories of personal data. Please do not put personal data into issue titles, prompts, or repository files where it is not needed — Dualzo will process whatever your repository contains.
2. Legal bases
Where India law or the GDPR applies, we rely on: performance of a contract (to run the Service you subscribed to), legitimate interests (security, abuse prevention, product reliability), legal obligation (tax and accounting records), and consent where we ask for it (for example, product emails you can opt out of).
3. How your code is used
- Repositories are cloned into an isolated working directory, indexed, and the directory is deleted afterwards — including when a run fails.
- Indexing never executes your code. It parses files statically. Customer code runs only inside the ephemeral validation sandbox.
- Only a budgeted slice of your repository is sent to your model provider — the artifacts and files relevant to the task, never the whole repository.
- The model provider is the one you choose, running on credentials you supply. Their handling of that data is governed by their terms, not ours.
- We do not use your code to train any model, ours or anyone else’s.
4. Who we share it with
| Processor | What it receives | Purpose |
|---|---|---|
| GitHub | Repository access via the GitHub App you install; branches, commits, pull requests we create | Repository access and pull requests |
| Your AI model provider (Anthropic, OpenAI, or Google) | The prompt and the context slice for each task | Planning and code execution |
| Paddle | Billing name, email, payment details you enter with them, transaction records | Payments as merchant of record |
| Email delivery provider | Your email address and message content | Approval requests, notifications, account email |
| Hosting and infrastructure provider | All application data at rest and in transit on our servers | Running the Service |
We do not sell personal data or share it for advertising. We may disclose data where legally required, or to protect the rights and safety of our users and the Service. If the business is acquired, data may transfer as part of that transaction, subject to this policy.
5. How long we keep it
- Audit logs: 90 days, then pruned automatically.
- Executions, plans, and diffs: for the life of the workspace.
- Indexed file records: until the repository is disconnected.
- Cloned working directories: deleted at the end of every job.
- Account data: deleted within 30 days of account deletion.
- Billing records: retained as long as tax and accounting law requires, typically 7 years.
6. Security
- Traffic is served over HTTPS; passwords are hashed, never stored in plain text.
- Provider API keys use encrypted database columns and are excluded from serialisation and logs.
- GitHub webhooks are signature-verified on the raw request body before anything is parsed.
- Validation runs in an ephemeral container with CPU, memory, and time limits, read-only mounts outside the working directory, no network except during dependency install, and none of our secrets in its environment.
- Every workspace-scoped query is isolated by policy and scope, so one workspace cannot read another’s data.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and any required regulator without undue delay.
7. International transfers
Our processors operate in several countries, so your data may be processed outside the country you are in. Where required, transfers rely on Standard Contractual Clauses or an equivalent safeguard.
8. Your rights
Subject to local law, you may request access to your data, correction, deletion, a portable copy, restriction of or objection to processing, and withdrawal of consent. Profile and password settings let you do much of this yourself; for the rest, write to privacy@dualzo.app and we will respond within 30 days. You may also complain to your local data protection authority.
9. Cookies
We use strictly necessary cookies only: a session cookie to keep you signed in, a CSRF token cookie, and a preference cookie for light or dark appearance. We do not run advertising or third-party analytics trackers. Paddle may set cookies of its own during checkout, governed by its policy.
10. Children
Dualzo is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
11. Changes
We will post any change here and update the effective date. For material changes we will notify you by email or in the app before they take effect.
12. Contact
Dualzo
Email: privacy@dualzo.app
See also the Terms of Service.