Privacy Policy

Duly is run by Duly. You can reach us at [contact email to be added].

For personal data about you as our customer, such as your account and billing, we are the controller. For the personal data you put into Duly about your own customers, you are the controller and we act as your processor, as set out in our Terms of Service.

• Account details: your email address, your password (stored scrambled, never in plain text), your business name, and the phone number and address you choose to add.
• Billing: your subscription, trial and payment history. Card details go straight to Stripe; we never see or store your full card number.
• Your business records: the parts, prices, customers, vehicles, quotes and bills you enter. We hold these for you as your processor.
• Vehicle checks: the registration numbers typed into the free MOT, tax and insurance check.
• Technical data: essential cookies (see our Cookie Policy) and basic server logs, such as IP address, browser type, pages requested and times, used for security and fixing faults.
• Messages: what you tell us when you email us.

UK data protection law asks us to give a lawful reason for each use:

• To provide Duly and your account, including sign-in, storing your records and support. Reason: our contract with you.
• To take payments and run your subscription and trial, and to send service emails such as receipts, a trial ending or a failed payment. Reason: our contract with you.
• To keep Duly secure, prevent fraud and misuse of free trials, and fix problems. Reason: our legitimate interest in running a safe, reliable service.
• To improve Duly, using overall patterns rather than watching individuals. Reason: our legitimate interest in making the product better.
• To keep accounting and tax records. Reason: legal obligation.

We don't send marketing emails unless you have agreed to them, and each one has an unsubscribe link. We don't make decisions about you by automated means that have legal or similarly significant effects.

We never sell personal data. We share it only with providers who help us run Duly, under contracts that protect it:

• Stripe: payments, subscriptions and trials.
• Supabase: our database, sign-in and storage of your records.
• Our website hosting provider: serving the site and its server logs.
• DVLA (Vehicle Enquiry Service): registration numbers, for MOT and road tax details.
• Our insurance data provider: registration numbers, checked against the Motor Insurance Database.

We may also share data with professional advisers, or with authorities when the law requires it. If Duly is ever sold or reorganised, your data would pass to the new owner under the same protections, and we would tell you.

Some of our providers may process data outside the UK, for example in the European Economic Area or the United States. When they do, the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum, so your data keeps the same level of protection.

• Account and business records: while you have an account, and for 90 days after your subscription ends so you can come back. Then we delete or anonymise them, unless you ask us to delete them sooner.
• Billing records: six years, as HMRC requires.
• Server logs: a short time, normally no more than 90 days.
• Vehicle checks: registration numbers typed into the free check are not stored against anyone. Results are held in memory for about a minute, so repeated checks don't hit DVLA again, and then discarded. (Bikes you add to your own records are kept as part of them.)
• Emails to us: as long as we need them to help you.

You can ask us for a copy of your personal data, to correct it, to delete it, to limit how we use it, to object to how we use it, or to receive it in a format you can take elsewhere. Where we rely on your consent, you can withdraw it at any time. Write to [contact email to be added]; it's free, and we reply within one month.

If your customers ask about the data you hold on them in Duly, the request is for you as the controller. We'll help you answer it.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put it right first.

• Everything travels encrypted (HTTPS).
• Each business's records are kept apart in the database, so one business can never see another's.
• Passwords are stored scrambled, and card details stay with Stripe, which is certified to the PCI DSS standard.
• Only the people who need to, to run and support Duly, can reach the systems that hold your data.

Duly is a service for businesses and is not meant for anyone under 18.

We'll update this policy when the way we handle data changes. The date at the top shows the latest version; for important changes we'll also tell you by email or in the app.

Questions about privacy or your data: [contact email to be added].