Privacy policy

1. Two roles: the businesses' data, and our own

• When a business uses SmartDuke, the information it keeps about its customers, members and leads belongs to that business. The business decides what to collect and why; we process it on the business's behalf and only to provide the service. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) the business is the data fiduciary and we are its data processor (under the GDPR, the controller and the processor). If you're a customer of a business that uses SmartDuke, contact that business about your data first; we'll help them answer you.
• For our own accounts, the people who sign up and sign in to SmartDuke, and visitors to our websites, we decide how the data is used: we are the data fiduciary (controller).

2. What we collect

People who use SmartDuke (business owners and staff)

• Name, email address, phone number (if given), password (stored only as a secure one-way hash) and two-factor sign-in settings.
• The business's details: name, address, country, branding, plan and billing details.
• Sign-in and security records: when and from which IP address and device you signed in, to protect accounts.
• What you do in the app, in an audit log (who changed what, and when), for security and accountability.

Data businesses keep about their own customers (on the business's behalf)

• Contact details (name, phone, email), notes, tags and fields the business adds.
• Leads, appointments, bookings, memberships, orders, invoices and payments.
• Messages sent and received by email and WhatsApp, with delivery status.
• Documents the business uploads.
• Conversations with the business's AI assistant, and the actions it proposes or takes.

Customers who message a business on WhatsApp: your phone number, your WhatsApp profile name and the messages you exchange with that business, which reach SmartDuke through Meta's WhatsApp Business Platform.

Payments: when a business takes payments through SmartDuke, card and bank details go directly to the payment provider (PayU in India, PayPal elsewhere). We receive only the result (paid or not, the amount, a reference), never full card numbers.

3. How we use it

• To provide the service: signing in, keeping and showing records, sending the emails and WhatsApp messages a business sends, bookings, reminders and invoices.
• To run the AI assistant a business switches on (section 4).
• To keep accounts and data secure, prevent abuse and fraud, and keep the audit log.
• To bill businesses for SmartDuke and keep the accounting records the law requires.
• To give support when you ask for it, and to send service messages such as password resets and welcome links.

We don't sell personal data, and we don't use businesses' customer data for our own marketing. Under the GDPR our grounds are the contract, our legitimate interests in security and a working service, legal obligations, and consent where it's required.

4. The AI assistant

• To answer, the assistant sends the relevant part of the business's data and the conversation to an AI model provider: OpenAI, or another provider the business chooses with its own key. We use these providers' business services, which don't use this data to train their models.
• It sees only what the person it works for may see in SmartDuke. When it answers a customer, it can read and change only that customer's own details and appointments.
• Anything about money, refunds or cancellations, and anything the business hasn't allowed it to do on its own, goes to a person. Every change it makes is recorded with who it acted for.
• If you write to a business, you're told you're talking with its assistant, and you can ask for a person at any time.
• We record usage (feature, model, amount processed, cost), not the content of prompts and replies, in our usage records.

5. Who we share it with

Only the service providers we need to run SmartDuke, under contracts that require them to protect the data and use it only for us:

We also share data when the law requires it, to protect people's safety or our rights, or as part of a merger or sale of our business (with the same protections). When a business connects its own accounts (its own AI key, WhatsApp number or payment gateway), data also goes to those providers under the business's own agreement with them.

6. Where data is stored

SmartDuke's servers and files are in Germany (EU). Some providers above process data in other countries, including the United States. Where the law requires it we rely on safeguards for those transfers, such as standard contractual clauses. The DPDP Act allows transfers except to countries the Government of India restricts.

7. How long we keep it

• A business's data: while the business uses SmartDuke. When it closes its account, we delete its data within 90 days, except what the law requires us to keep.
• Backups: 30 days, then deleted.
• Audit and security logs: for the life of the account. When a person's data is erased, the values in those records are blanked; only the fact that a change happened, and when, stays.
• Our own billing records: as long as tax and accounting laws require (generally 8 years in India).

8. Security

Encryption in transit (HTTPS) everywhere; passwords stored as one-way hashes (Argon2id) and integration keys encrypted at rest; optional two-factor sign-in that a business can require; every business's data kept separate, enforced by the application and again by the database; uploaded files scanned for viruses; and an audit log of every change. No system is perfectly secure: if a breach affects your personal data, we'll tell the affected businesses and people, and the authorities where required (in India, the Data Protection Board), without undue delay.

9. Your rights

• Ask what personal data we hold about you and get a copy.
• Correct or complete it.
• Have it erased.
• Withdraw consent where we relied on it.
• Under the GDPR, object to or restrict some processing and complain to your data protection authority.
• Under the DPDP Act, have your grievance handled and nominate someone to exercise your rights if you can't.

If you're a customer of a business that uses SmartDuke, ask that business: in SmartDuke they can export or completely erase your data, and we'll help them if needed. For your SmartDuke account, write to support@smartduke.com; we answer within 30 days.

10. Deleting your data

• Customers of a business (including on WhatsApp): ask the business to erase your data. Erasing a person in SmartDuke removes their contact details, messages and conversations, and blanks their history. You can also write to support@smartduke.com with the business's name and your phone number or email; we'll pass the request on and confirm when it's done.
• SmartDuke accounts: write to support@smartduke.com. A business owner can ask us to close the business's account; everything of it is then deleted within 90 days.

11. Cookies

SmartDuke uses only the cookies it needs to work: a secure sign-in cookie that keeps you signed in. We don't use advertising or tracking cookies.

12. Children

SmartDuke is for businesses and isn't meant for children under 18. Businesses that keep data about children (a coaching centre, for example) must get verifiable consent from a parent or guardian as the DPDP Act requires, and must not use it for tracking or targeted advertising.

13. Changes

We'll post changes here and update the date at the top. For significant changes we'll tell businesses by email or in the app before they take effect.

14. Contact and grievance officer

Grievance officer: Dinakar, support@smartduke.com, WhatsApp +91 73393 01244. We acknowledge grievances within 48 hours and resolve them within 30 days. If you're not satisfied, you can complain to the Data Protection Board of India or, in the EU or UK, to your data protection authority.