Privacy Policy

How we collect, use, and protect your data.

1. Controller

The controller responsible for data processing is Duet Technologies GmbH, Munich, Germany. For questions about data protection, contact us at privacy@askduet.com.

2. Data We Collect

Account Data

When you create an account, we collect your email address and name. This data is necessary to provide the Service and manage your account.

Usage Data

We collect information about how you interact with the Service, including pages visited, features used, and timestamps. This data helps us improve the Service and diagnose technical issues.

Research Data

When you create studies and collect responses, we process the research data you and your participants provide. This includes questions, answers, conversation transcripts, and any media recordings.

Technical Data

We automatically collect technical information such as your IP address, browser type, operating system, and device information when you access the Service.

3. How We Use Your Data

We process your data for the following purposes:

  • Service delivery: To provide, maintain, and improve the Duet platform
  • Account management: To manage your account, process payments, and communicate with you
  • Research processing: To facilitate your research studies, including AI-powered conversation analysis
  • Security: To protect the Service and our users from fraud and abuse
  • Legal compliance: To comply with applicable laws and regulations

4. Legal Basis for Processing

We process your data based on:

  • Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Service
  • Legitimate interests (Art. 6(1)(f) GDPR): Usage analytics, security, and service improvement
  • Consent (Art. 6(1)(a) GDPR): Where you have given explicit consent, such as for marketing communications
  • Legal obligation (Art. 6(1)(c) GDPR): Where processing is required by law

5. Data Sharing

We share your data only with:

  • Service providers: Third-party providers who assist in operating the Service (hosting, payment processing, email delivery)
  • AI providers: We use third-party AI models to power conversational features. Research data may be processed by these providers under strict data processing agreements
  • Legal requirements: When required by law, regulation, or legal process

We do not sell your personal data to third parties.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Research data is retained according to your account settings. After account deletion, we remove your personal data within 30 days, except where retention is required by law.

7. Your Rights

Under the GDPR, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate personal data
  • Erasure: Request deletion of your personal data
  • Restriction: Request restriction of data processing
  • Portability: Receive your data in a structured, machine-readable format
  • Objection: Object to data processing based on legitimate interests
  • Withdraw consent: Withdraw previously given consent at any time

To exercise these rights, contact us at privacy@askduet.com.

8. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area. We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

9. Cookies

We use essential cookies to operate the Service. We do not use tracking or advertising cookies. For more details, see the cookie settings in your browser.

10. Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit and at rest, access controls, and regular security assessments.

11. Children

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email or through the Service.

13. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht).

14. Contact

For data protection inquiries, contact us at privacy@askduet.com.

Last updated: February 2026