Privacy Policy

Duta lets a person (a "creator") make an AI messenger that answers people ("visitors") on a public link. This page explains what we collect, why, who we share it with, and how to see or delete it. It goes with our Terms of Service and Usage Policy. Plain-language template text: have it reviewed before you rely on it.

What we collect from creators

• Your name and email from sign-in (handled by Clerk, our sign-in provider).
• Your setup answers, answers you teach your Duta, and whether each one is public or private.
• Text extracted from PDFs you upload (we keep the text, not the file) and text read from links you add.
• If you connect Gmail: an encrypted token that lets Duta send email you approve. We request only the gmail.send permission. Duta cannot read, search or delete your email.
• If you connect Google Calendar: an encrypted token used to check when you're busy (free/busy only, not event details) and to add calls you confirm to your calendar with an invite to the visitor.
• If you connect Google Sheets: an encrypted token limited to the one spreadsheet Duta creates for your requests.
• If you connect Outlook: an encrypted token from Microsoft. Duta asks Microsoft only for each event's start, end and busy/free status, to hide busy times, and adds calls you confirm to your calendar with an invite to the visitor.
• If you add a calendar link (Apple or others): the link, stored encrypted. Duta reads only start and end times to hide busy slots. Event titles and details are not stored.
• If a creator turns on phone calls: when someone calls their Duta number, we keep the caller's number, the time and length of the call, a written transcript and a short summary, so the creator can follow up. Callers are told at the start that they're talking to an AI and the call is transcribed. Duta doesn't store call audio.
• If you connect Slack or Discord: the address of the one channel you picked, stored encrypted. Duta can only post there. Alerts contain the visitor's name, a short summary and a link to your Duta.
• If you add your own agent: its name, the job you describe for it and the instructions you write. These are stored with your account and deleted with it. Your own agents follow the same limits as the built-in ones: they read only what you gave your Duta, draft for you, and never send anything without your approval.
• Photos and PDFs you add under Photos & files, with the names you give them. These are public: anyone with your link can see and download them. Removing a file or deleting your account deletes it from storage.
• Your bookable hours and time zone, and a log of agent calls (which agent, when, message length) to show your usage and cost. The log doesn't contain message text.

What we collect from visitors

• The messages you send on a creator's link, and contact details you choose to share (name, email, phone).
• If you pick a time: the time you chose and your time zone. If the creator confirms, you get a calendar invite.
• If you reply to an email sent through Duta: your reply, so the creator sees it next to your request.
• Photos and PDFs you attach with the + button. They're private: only you and that creator can open them, through links that expire after an hour. Deleting your chat deletes them.
• Short AI summaries of your chat and request, written for the creator. These include your name, contact details and what you asked for, and may be sent to the creator by email or to an alert channel the creator connected.
• A random ID in a cookie so your chat continues if you come back, and a one-way hash of your network address to prevent abuse.
• No account is needed to chat. The creator can see your messages.
• If you sign in to save your chats: we link your chats to your account so you can see them in My chats on any device. Creators don't see your account email unless you type it in the chat. You can delete the account from My chats.

Email open tracking

When a creator has it on (Settings → Email tracking), emails Duta sends for them include a tiny invisible image. When your mail app loads it, we record that the email was opened and when, and show it to that creator. We don't record your location or device. Many mail apps block or preload images, so it's approximate. You can stop it by turning off images in your mail app.

Counting visits

To show how many people visit Duta, we put a random ID in a cookie and save a one-way hash of it with the day and the page you opened. That's all: no name, no address, no ads and no outside trackers. Each person counts once per day. Pages inside your account aren't counted.

How it's used

• To answer visitors, draft emails for the creator to approve, and show the creator who asked what.
• Messages are processed by AI providers we use to run the agents (such as Keiki and the model it calls). They process data to provide the service.
• Emails are sent only after the creator approves them, from the creator's Gmail or from our sending provider (Resend). Replies may come back through Resend so Duta can show them to the creator.
• Service providers that process data for us: Clerk (sign-in), Supabase (database), Vercel (hosting), Keiki and the AI model it calls (agents), Resend (email), Dodo Payments (payments, for creators who upgrade), and Google, Microsoft, Slack or Discord only when the creator connects them.
• We don't sell personal data and don't use it for advertising.

Google user data

Duta's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail access is used only to send emails the creator explicitly approves in Duta. Calendar access is used only to read free/busy times and add calls the creator confirms. Sheets access is limited to the one sheet Duta creates. Google data is not used for advertising or to train AI models, not transferred to others except as needed to provide these features, and not read by humans. You can disconnect any time in Connections, which also revokes access at Google.

Deleting your data

• Creators: Settings → Your data → Delete my account removes your profile, chats, answers, agents (including ones you added) and every connection. Settings → Download my data gives you a copy first. Disconnect any single connection in Connections.
• Visitors: open the chat menu (⋯) → Delete this chat. This also removes the summary, releases a time you were holding and clears your details from it. Requests the creator already emailed you about stay with the creator.
• You can also email us at contact@chatduta.com.

Security

Data is stored in a managed Postgres database with row-level security. Google tokens, calendar links and webhook addresses are encrypted with AES-256-GCM. Calendar links must be public https addresses.

Your choices and rights

• See and download your data: Settings → Download my data.
• Fix it: edit your answers and files in Settings any time.
• Delete it: delete a chat, a file, a connection or your whole account. Visitors can delete their chat from the chat menu.
• Turn off email open tracking in Settings, and disconnect any app in Connections.
• Depending on where you live, you may have more rights (like objecting to some uses). Email us and we'll help.

How long we keep it

We keep your data while your account is open. When you delete something, it's removed from the app right away and from backups within 30 days. Payment records are kept by Dodo Payments as the law requires. Usage counts and billing events are kept while your account exists.

Children

Duta isn't for children under 13, and creators must be 18 or older. If you think a child has given us personal data, tell us and we'll delete it.

Changes

If we change this policy in a way that matters, we'll show a notice in the app and update the date above, usually 30 days before it takes effect.

Contact

Questions: contact@chatduta.com