Privacy Policy

Account data. For the people who sign up and use DueBase, we decide how that data is used, and this policy applies directly.

Customer content. Records your organisation puts into DueBase — vendors, their contacts, documents and assessments — belong to your organisation. We process it only on your instructions, to provide the service, as described in our Data Processing Agreement.

• Account details: your name, work email address and organisation.
• Usage records: sign-ins and the actions you take in DueBase, kept in an audit trail for your organisation.
• Technical data needed to run the service securely, such as IP address and browser type in server logs.
• Messages you send us, for example support requests.

We do not use advertising trackers, and we do not sell personal data.

• To provide, secure and support DueBase.
• To send service emails — invitations, password resets, reminders and alerts you have configured.
• To send your vendors the requests and reminders your team creates.
• To meet legal obligations.

Only with the providers that run DueBase on our behalf (listed on our Security page), under contracts that restrict them to that purpose — and where the law requires it.

DueBase stores data in Mumbai, India. When a user runs a DueBase AI feature, the relevant document text is processed by our AI processing provider, which may process it outside India.

We keep account data and customer content while your organisation’s account is active. When an account is closed, we delete customer content on request within 30 days, except where we must keep something to meet a legal obligation.

You can ask to access, correct or delete your personal data, or object to how it is used. If your data was added by an organisation that uses DueBase, please contact that organisation first — we will help them respond. Write to privacy@duebasehq.com for any privacy request.

We will update this page if our practices change, and tell account administrators about material changes before they take effect.