Privacy Policy
Effective 2 October 2026. Covers the SEO reporting dashboard at app.getduality.com and our website at getduality.com, run by Duality Digital.
Who we are
Duality Digital provides an SEO reporting dashboard: we track keyword rankings, site speed, backlinks and search performance for the websites our clients ask us to track, and show it back to them in one report. This policy explains what we collect to do that, why, and what you can ask us to do about it. Duality Digital is a trading name of BLACKPEAKSOLUTIONS LTD; the company details are under Contact, at the end of this policy.
What we collect directly from you
- Account details — name, email address, and a password (stored as a one-way bcrypt hash — we never store or can see the password itself). The sign-up and free-trial forms are protected by Google reCAPTCHA, which checks in the background that an account is being created by a person: it loads when you start filling in the form, sends Google information about your browser and how you use the page, and may set a cookie of Google's. We do not pass your name, email address, password or website to Google. Google's Privacy Policy and Terms of Service apply to that check.
- Business/site details — your website address, the keywords you want tracked, and location/language targeting for those keywords.
- Billing details — if you subscribe to a paid plan, your card payment is taken by Stripe. Stripe collects your card details, billing name, email and address directly on its own secure page; we never receive or store your card number. We keep only a reference to your Stripe customer record, your plan and any add-ons, your subscription status and your next renewal date, so we know what you have paid for.
- Report branding — if you add a logo and business details (company name, website, email, phone, address and a short description) to a site's share link, we store them with that site and show them on its shared report to anyone who has the link. From a logo file we keep only the image itself: anything else stored inside the file, such as text or location data, is removed. You can change or remove them in Settings at any time, and they are deleted with that site's other data.
- Problem reports — if you use "Report a problem", what you write, together with the page and site you were on, your screen size, browser, and a short list of what recently failed on that page, so we can find the fault. It is shown to you before you send it, is read only by us, and is deleted with your account.
- Signup details — if you request an account, the company name, website and message you submit, plus the IP address the request came from (used only to stop automated spam submissions).
- Contact form — if you write to us through the contact form on getduality.com, your name, email address, the topic you choose and your message (and, if you use the Enterprise request form on our pricing page, the phone number and company name you choose to give). We use them only to reply to you. They reach us by email, and we do not store them anywhere else. We also get a short note on our team's Telegram that a message has arrived, which gives only the topic and the length of the message, never your details. The IP address the message came from is held briefly in memory, only to stop automated spam, and is not stored. The form is protected by Google reCAPTCHA, which checks in the background that a message comes from a person: it loads when you start filling in the form, sends Google information about your browser and how you use the page, and may set a cookie of Google's. We do not pass your name, email address, phone number, company name or message to Google. Google's Privacy Policy and Terms of Service apply to that check.
- Website visits — when you visit our website at getduality.com, Google Analytics records which pages you view, the page or search that sent you to us, your browser and device type, and a rough location (country and city). It uses two cookies,
_gaand_ga_followed by our measurement ID, which hold a random identifier and last up to two years. When you send a message through the contact form it also records that a message was sent and the topic you chose, never your name, email address or message. We use this only to see which pages are useful and where enquiries come from, not for advertising. You can stop Google Analytics on our website, and on other websites, with Google's Analytics opt-out browser add-on, and you can block or delete these cookies in your browser's settings. - Free tools — on getduality.com, the keyword density checker and the heading structure checker run entirely in your browser: what you paste is not sent to us. If you use the domain authority checker, the domain you type is sent to our server, and on to the search data provider named below, to get its figures. We keep the result in memory for up to 24 hours so that the same lookup is not repeated, and do not store it anywhere else. The IP address the request came from is held briefly in memory, only to limit automated abuse, and is not stored.
What we collect on your behalf
Once you grant our service account access to Google Search Console and Google Analytics for your own site, we read clicks, impressions, sessions, engagement and similar aggregate performance figures from those properties, so we can show them in your report. For this data, you remain the data controller — it is your website's performance data — and we act as a processor on your instruction. Revoking our access at any time stops this immediately.
What we collect from other providers
To measure your site's public search presence, we send your target keywords, website domain and location settings to a specialist search data provider (search rankings, backlinks, referring domains, domain trust, keyword research) and to Google PageSpeed Insights (page speed scores). Both describe your website's public footprint — how it ranks and performs in search — not personal data about your site's visitors.
Cookies and local storage
In the dashboard at app.getduality.com we use two cookies: a session cookie that keeps you signed in (httpOnly, secure, expires after two weeks of inactivity), and a security cookie that stops other websites from making changes to your account on your behalf (secure, expires after two weeks). The dashboard sets no tracking, advertising or analytics cookies. On its sign-up and free-trial pages, Google reCAPTCHA may set a cookie of its own. On our website at getduality.com, Google Analytics sets two cookies, _ga and _ga_ followed by our measurement ID, as described under "Website visits" above, and Google reCAPTCHA on the contact form may set a cookie of its own. We do not use advertising cookies. A light/dark theme preference is kept in your browser's local storage — it never leaves your device and we never read it. If you turned analytics off on our website with the link that used to be at the bottom of each page, that choice stays in your browser's local storage and we still respect it; it never leaves your device either. If you install the site as an app on your phone or computer, your browser also keeps three small files for a "you are offline" screen (a page and our logo); they contain nothing about you or your account.
Who we share data with
We use a small number of processors to run the service, each only for what's needed to provide it:
| Who | What for |
|---|---|
| Google (Search Console, Analytics, PageSpeed APIs) | reading the performance data described above |
| Google (Analytics, reCAPTCHA) on getduality.com | understanding how our website is used (pages viewed, where visitors came from, device and browser, a rough location, and that a contact message was sent and its topic) and checking that contact-form messages come from people (information about your browser and how you use the contact page, which your browser sends to Google directly). We do not pass your name, email address or message to Google |
| Google (reCAPTCHA) on the dashboard's sign-up and free-trial pages | checking that new accounts are created by people (information about your browser and how you use the sign-up page, which your browser sends to Google directly). We do not pass your name, email address, password or website to Google |
| A specialist search data provider | rank, backlink, domain trust and keyword research checks — only your target keywords, website domain and location settings (and, for the free domain authority checker on getduality.com, the domain a visitor types), never your name, email address or any visitor data |
| Postmark | sending account emails (email confirmation, password resets, invites) and, while you are a subscriber or on a free trial, an email each time a new report is ready (you can switch these off in Settings) — your name and email address, and the summary figures in the report email. Postmark also carries messages sent through the contact form on getduality.com to our inbox, with the name, email address and message you wrote |
| DuckDuckGo (site icons) | fetching the small icon shown beside your website's name. Our server asks for it, using only your website's domain name; your browser never contacts DuckDuckGo and it receives none of your account details |
| Stripe | taking card payments and managing subscriptions, invoices and receipts — your name, email address, billing details and payment details, which Stripe collects directly |
We also run an internal Telegram alert for our own team if a scheduled collection fails or a service credential needs attention — that alert never contains client account data, only operational status (which source failed, for which client, and why, or that a client's payment failed and for how much). A separate Telegram note tells us when a contact-form message has arrived; it gives only the topic and length of the message, never your details.
We do not sell personal data, and we do not use it for advertising, ours or anyone else's.
How long we keep data
We keep your data for as long as your account is active. If your paid plan ends, you choose: pay a flat monthly fee to hibernate, in which case we keep your reports and history, read-only, for as long as you keep paying; or delete your account. If a subscription ends without you choosing, your account is deactivated and your data is locked and kept for 90 days so you can come back or take a copy; nothing new is collected. After that we permanently delete it. If you'd rather we erased everything, see "Your rights" below.
Payment records. Invoices and payment records are held by Stripe, and kept for as long as tax and accounting law requires. Erasing your account does not remove those records, even though it removes everything else (see "Your rights").
The database is also backed up daily as a safeguard against data loss: daily backups are kept 14 days, weekly backups 8 weeks, and monthly backups are currently retained indefinitely for disaster-recovery purposes. A deletion request removes your data from our live system immediately; a copy may persist in a backup for as long as that backup is retained under this schedule, and is never used for anything other than restoring the system after a failure.
Your rights
You can ask us, at any time, to:
- see what data we hold about you or your account;
- correct anything that's wrong;
- export your report history;
- permanently delete your account and everything tied to it.
When we delete an account, we also delete your customer record from Stripe, which ends any subscription immediately. The one exception is the invoices and payment records described above, which Stripe and the law require to be kept.
You can delete your account yourself at any time: go to Settings, then Your account, then Delete account. To make sure a permanent, irreversible action is never a misclick away, you confirm by typing a word and entering your password. If you have paid time left, your account stays open until the end of the period you have paid for and is deleted then; until that date you can change your mind in Settings. Otherwise it is deleted straight away. Deleting ends your subscription, deletes your sites and their reports, and erases your login, and we email you to confirm. Copies of your data in our routine backups are removed as those backups expire, on the schedule above. If you would rather ask us, or you cannot sign in, email privacy@getduality.com and we'll do it for you.
Security
Passwords are hashed, never stored in plain text. Sessions are cookie-based with secure transport enforced. Sign-in attempts are rate-limited to make automated password guessing impractical. Access to anything administrative is gated behind a separate, additional passphrase on top of a normal admin login. Backups are taken daily and tested for restorability.
Children
This service is a B2B tool for businesses managing their own SEO reporting. It is not directed at, and we do not knowingly collect data from, children.
Changes to this policy
If this policy changes in a way that matters, we'll update the date at the top and, for a material change, let active clients know directly.
Contact
Duality Digital — privacy@getduality.com
Duality Digital is a trading name of BLACKPEAKSOLUTIONS LTD, a company registered in England and Wales.
BLACKPEAKSOLUTIONS LTD
17 High Street, Corby Glen, Grantham, England, NG33 4LU
Company no. 16819956 · VAT no. GB513280522