Privacy Policy
Effective 20 September 2026. Covers the SEO reporting dashboard at app.getduality.com, run by Duality Digital.
Who we are
Duality Digital provides an SEO reporting dashboard: we track keyword rankings, site speed, backlinks and search performance for the websites our clients ask us to track, and show it back to them in one report. This policy explains what we collect to do that, why, and what you can ask us to do about it.
What we collect directly from you
- Account details — name, email address, and a password (stored as a one-way bcrypt hash — we never store or can see the password itself).
- Business/site details — your website address, the keywords you want tracked, and location/language targeting for those keywords.
- Billing details — if you subscribe to a paid plan, your card payment is taken by Stripe. Stripe collects your card details, billing name, email and address directly on its own secure page; we never receive or store your card number. We keep only a reference to your Stripe customer record, your plan and any add-ons, your subscription status and your next renewal date, so we know what you have paid for.
- Signup details — if you request an account, the company name, website and message you submit, plus the IP address the request came from (used only to stop automated spam submissions).
What we collect on your behalf
Once you grant our service account access to Google Search Console and Google Analytics for your own site, we read clicks, impressions, sessions, engagement and similar aggregate performance figures from those properties, so we can show them in your report. For this data, you remain the data controller — it is your website's performance data — and we act as a processor on your instruction. Revoking our access at any time stops this immediately.
What we collect from other providers
To measure your site's public search presence, we send your target keywords, website domain and location settings to DataForSEO (search rankings, backlinks, referring domains, domain trust) and to Google PageSpeed Insights (page speed scores). Both describe your website's public footprint — how it ranks and performs in search — not personal data about your site's visitors.
Cookies and local storage
We use one cookie: a session cookie that keeps you signed in (httpOnly, secure, expires after two weeks of inactivity). We do not use tracking, advertising or analytics cookies of our own. A light/dark theme preference is kept in your browser's local storage — it never leaves your device and we never read it.
Who we share data with
We use a small number of processors to run the service, each only for what's needed to provide it:
| Who | What for |
|---|---|
| Google (Search Console, Analytics, PageSpeed APIs) | reading the performance data described above |
| DataForSEO | rank, backlink and domain trust checks |
| Postmark | sending account emails (password resets, invites) and, while you are a subscriber, an email each time a new report is ready (you can switch these off in Settings) — your name and email address, and the summary figures in the report email |
| DuckDuckGo (site icons) | fetching the small icon shown beside your website's name. Our server asks for it, using only your website's domain name; your browser never contacts DuckDuckGo and it receives none of your account details |
| Stripe | taking card payments and managing subscriptions, invoices and receipts — your name, email address, billing details and payment details, which Stripe collects directly |
We also run an internal Telegram alert for our own team if a scheduled collection fails or a service credential needs attention — that alert never contains client account data, only operational status (which source failed, for which client, and why, or that a client's payment failed and for how much).
We do not sell personal data, and we do not use it for advertising, ours or anyone else's.
How long we keep data
We keep your data for as long as your account is active. When a subscription ends, billing and data collection stop, but your historical reports are kept in case you resume — nothing is deleted automatically. If you'd rather we erased everything, see "Your rights" below.
Payment records. Invoices and payment records are held by Stripe, and kept for as long as tax and accounting law requires. Erasing your account does not remove those records, even though it removes everything else (see "Your rights").
The database is also backed up daily as a safeguard against data loss: daily backups are kept 14 days, weekly backups 8 weeks, and monthly backups are currently retained indefinitely for disaster-recovery purposes. A deletion request removes your data from our live system immediately; a copy may persist in a backup for as long as that backup is retained under this schedule, and is never used for anything other than restoring the system after a failure.
Your rights
You can ask us, at any time, to:
- see what data we hold about you or your account;
- correct anything that's wrong;
- export your report history;
- permanently delete your account and everything tied to it.
When we delete an account, we also delete your customer record from Stripe, which ends any subscription immediately. The one exception is the invoices and payment records described above, which Stripe and the law require to be kept.
Email privacy@getduality.com and we'll action it — deletion requests today are actioned by hand by an administrator rather than a self-service button, precisely so a permanent, irreversible action is never one misclick away. We'll confirm once it's done.
Security
Passwords are hashed, never stored in plain text. Sessions are cookie-based with secure transport enforced. Sign-in attempts are rate-limited to make automated password guessing impractical. Access to anything administrative is gated behind a separate, additional passphrase on top of a normal admin login. Backups are taken daily and tested for restorability.
Children
This service is a B2B tool for businesses managing their own SEO reporting. It is not directed at, and we do not knowingly collect data from, children.
Changes to this policy
If this policy changes in a way that matters, we'll update the date at the top and, for a material change, let active clients know directly.
Contact
Duality Digital — privacy@getduality.com