Privacy Policy
Last updated: September 28, 2026
DuoExpert ("we", "us") provides an AI agent and a persistent workspace for your professional life, at duoexpert.ai and app.duoexpert.ai (the "Service"). This policy describes what information we collect, how we use it, who we share it with and how, and how we protect it.
1. Information we collect
- Account information. Your name, email address, and authentication details, collected when you sign up. Authentication is handled by our identity provider (Clerk); we do not store your password.
- Workspace content. The documents, tasks, projects, conversations with your AI agent, uploaded files and images, apps you build, and websites you publish through the Service. This is the substance of the product — the workspace exists to hold it.
- Billing information. Payments are processed by Stripe. We store your subscription plan, billing status, and a reference to your Stripe customer record. We never see or store your full card number.
- Usage and technical data. Server logs (including IP address, request paths, and error diagnostics), AI usage metering (credits consumed), and page-view counts for websites you publish.
- Support communications. Feedback and bug reports you submit through the app or send to support.
2. How we use it
- To provide the Service. Storing and displaying your workspace content, and sending the relevant parts of it to AI model providers to generate your agent's responses — that is the core function you sign up for.
- Billing. Managing your subscription, metering credit usage, and processing payments through Stripe.
- Security and reliability. Authenticating requests, preventing abuse, and diagnosing errors (error logs are automatically deleted after 14 days).
- Support. Responding to your reports and requests.
- Product improvement. Understanding aggregate usage to improve the Service.
We do not sell your personal information, and we do not use your workspace content to train our own AI models.
Our legal basis for each of these. If you are in the European Economic Area or the United Kingdom, data protection law requires us to have a lawful basis for every purpose above. Ours are:
- Performance of our contract with you — providing the Service, storing your workspace content, sending it to AI model providers to generate responses, managing your subscription, and responding to your support requests. Without this processing there is no product to deliver.
- Compliance with a legal obligation — keeping invoices and payment history for the period tax and accounting law requires, and responding to lawful requests from authorities.
- Our legitimate interests — authenticating requests, preventing abuse, diagnosing errors, metering usage accurately, and understanding aggregate usage to improve the Service. We rely on this basis only where your interests and rights do not override it, and you can object to it at any time (see Your rights).
- Your consent — where we ask for it explicitly, such as optional communications. You can withdraw consent at any time, without affecting processing already carried out.
3. Who we disclose it to, and how
We share information only with the service providers required to operate the Service, each receiving only what its function needs, transmitted over encrypted (TLS) connections through authenticated APIs:
- Cloudflare — hosts the Service; stores your workspace content and files on our behalf.
- AI model providers — receive the conversation and workspace context needed to generate your agent's responses. Which provider handles a request depends on the model chosen for that conversation. We route to several, established in different countries, and the list changes as the field moves: the current one, and where each provider is established, is at AI Model Providers.
- Clerk — authentication (sign-in, sign-up, session management).
- Stripe — payment processing and subscription billing.
- Forward Email — mail forwarding and delivery for custom email addresses on domains you connect to the Service.
- Parallel Web Systems — web search. When your agent looks something up online, it sends Parallel the search it writes for your request, and Parallel returns public web pages. The search can include words from your conversation; your workspace content and files are not sent with it.
Websites your agent reads. When you ask your agent to read a web page, our servers request that page from the website, which sees the request come from us rather than from you. Nothing from your workspace is sent with it beyond the page's address.
Other people you share with. A workspace can have several members. Anyone you invite to a workspace, or who is a member of one you join, can see that workspace's content — that is the point of sharing it.
Beyond these providers, we disclose information only if required by law, or to protect the rights, safety, or integrity of the Service and its users. Websites and apps you choose to publish are, by your own action, publicly visible.
4. Where your information is processed
The Service runs on globally distributed infrastructure, and our providers are established outside the European Economic Area. Using the Service therefore involves transferring your personal data outside the EEA and the United Kingdom.
Providers in the United States — our hosting, authentication, payment, email, and web search providers, and some AI model providers. These transfers are covered by a data processing agreement incorporating the European Commission's Standard Contractual Clauses, or, where the provider is certified under the EU–US Data Privacy Framework, by that certification.
Providers in countries without an adequacy decision — some AI model providers are established in China, which the European Commission has not found to offer an adequate level of data protection. You are never routed to one of these unless you choose it. The model picker names the provider and the country behind every model, and the first time you pick one established in such a country we ask you to confirm that you understand where your content would go; the confirmation is recorded against your account. That explicit, informed choice is the basis for the transfer, alongside the contractual terms we hold with the provider. Only the content needed to generate the response you asked for is sent. If you never pick such a model, none of your content reaches one.
Which providers handle your workspace content depends on the model chosen for a conversation; the current list, and the country each provider is established in, is at AI Model Providers. You can request a copy of the safeguards that apply to any of them at contact@duoexpert.ai.
We do not currently offer a regional storage guarantee: your workspace content is stored on Cloudflare's global network without a jurisdictional restriction. If your organisation needs data residency in a specific region, or needs its content kept to providers in particular countries, contact us before you subscribe.
5. How we protect it
- All traffic to and within the Service is encrypted in transit (TLS); data is encrypted at rest by our hosting provider.
- Each workspace's content is stored in its own isolated database, so cross-workspace access is impossible by construction.
- Every content request is authenticated and checked against workspace ownership before any data is read.
- Payment credentials are handled entirely by Stripe, a PCI-DSS certified processor.
- Access to production data by our team is restricted, logged, and used only for support and debugging.
6. Retention and deletion
We keep your information for as long as your account is active. You can delete your account at any time from the app's settings; deletion removes your workspaces, documents, tasks, conversations, uploaded files, and published sites. Error logs expire automatically after 14 days.
What we deliberately keep. Two things outlive account deletion, neither containing your workspace content: your Stripe customer record (invoices and payment history, retained as required by tax and accounting law), and usage records — how much of the service each account consumed, and what it was granted — stored under an internal account number rather than your name. Because your billing record survives, these records can still be traced back to you, so we continue to treat them as personal data and use them only for billing accuracy and investigating abuse. We do not retain a copy of your documents, tasks, conversations, or files.
7. Your rights
You can access, edit, and copy your content in the app, and delete your account yourself. Depending on where you live, you may also have legal rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing — including the right to obtain a copy of your data. To exercise any of these, or to request a copy of your workspace, contact us at contact@duoexpert.ai.
Complaints. If you are in the European Economic Area or the United Kingdom and you believe we have handled your personal data unlawfully, we would rather hear from you first — but you have the right to complain to a data protection supervisory authority. Ours is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro. You may also complain to the authority in your own country of residence.
8. Changes
We will update this policy as the Service evolves and revise the date above. Material changes will be announced in the app or by email.
9. Who we are, and how to reach us
The controller responsible for your personal data, and the operator of the Service, is:
- Legal name
- UNGUREANU R. CATALIN PERSOANA FIZICA AUTORIZATA, trading as DuoExpert
- Registered office
- Str. Garabet Ibrăileanu nr. 13, Valea Lupului, jud. Iași, 707410, Romania
- Trade Register
- F22/916/15.05.2015
- Tax code (CUI)
- 34510543
- contact@duoexpert.ai
Questions about this policy: contact@duoexpert.ai, or see Support.