How we handle personal data.

Who we are

SmartDuke Technologies (“SmartDuke”, “we”, “us”) makes SmartDuke, a business app with an AI assistant called Duke, at dukeos.app, and runs this website, smartduke.com. You can reach us at support@dukeos.app or on WhatsApp at +91 73393 01244.

Questions about this policy, or about your personal data, go to support@dukeos.app.

Our two roles

Businesses (our customers) use SmartDuke to run their work: their customers, members, patients, students, bookings, invoices and messages. The law treats us differently depending on whose data it is:

• Your account data: we decide. For the details of the people who sign up and sign in (owners and team members), billing details and how the app is used, SmartDuke is the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the controller under the GDPR. This policy explains what we do with that data.
• A business's customer data: the business decides. For the records a business keeps in SmartDuke about its own customers, the business is the data fiduciary (controller) and SmartDuke is its data processor. We handle that data only on the business's instructions, as set out in our Data Processing Agreement. If you are a customer of a business that uses SmartDuke, that business's own privacy notice applies, and requests about your data should go to them first. We will help them answer.

What we collect

When you use the SmartDuke app

• Account details: your name, email address, phone number if you add one, and a photo if you add one. Passwords are stored only as a one-way hash. If you turn on two-factor sign-in, we keep the secret for your authenticator app, encrypted.
• Business details: the business's name, address, country, branding, plan and settings.
• Billing details: billing name, address, GSTIN if you give one, invoices and payment status. Card, UPI and bank details are entered with our payment providers (PayU in India, PayPal elsewhere), not with us, and we never see or store full card numbers.
• Sign-in and security records: when and from which IP address and device you sign in, and failed attempts, so we can protect accounts and stop abuse.
• Activity in the app: an audit log of who created, changed or deleted which record and when (including changes Duke made after someone approved them), and records of AI use (feature, model, amount used and cost), without the text of your questions or Duke's replies.
• Your conversations with Duke: kept in your account so you can return to them. They are private to the person who had them.
• Messages you send us, such as support requests.

Data businesses keep in SmartDuke

Whatever a business chooses to keep: customer names and contact details, bookings, memberships, attendance, invoices and payments, notes, documents, messages sent and received by email and WhatsApp, and custom fields and pages the business creates. We process it as the business's processor (see above).

On this website

What you choose to send us: if you use the contact form or email us, we receive your name, email address, business details and your message. We also count visits with Google Analytics (pages viewed, rough location, device and how you found us) to improve the site; it sets cookies on your device. Visitors in Europe are asked first, and analytics stays off unless they allow it. We use no advertising trackers, and this website has no accounts.

We do not buy or rent personal data.

Why we use it, and on what basis

• To provide the service you signed up for: create your account and business, sign you in, run the app, send sign-in codes, invitations and notifications, and give support. (DPDP: you gave us the data for this purpose. GDPR: performance of our contract with you.)
• To bill you and meet tax and accounting rules, such as GST invoices. (Legal obligation.)
• To keep the service safe: rate limits, fraud and abuse prevention, security logs and backups. (DPDP: legitimate uses and our duty to protect data. GDPR: our legitimate interests and legal obligations.)
• To improve SmartDuke, using usage counts and error reports. (GDPR: our legitimate interests.) We do not use the content of a business's records or conversations to train AI models.
• To tell you about important changes to the service, your plan or this policy. We send marketing emails only if you agree, and every one has a way to stop them.

Where we rely on your consent, you can withdraw it at any time by writing to us. Withdrawing doesn't affect what was done before.

Duke, the AI assistant

Duke answers questions, drafts messages and prepares changes using only the data the person asking is allowed to see, with that person's permissions. To do this, the question and the records needed to answer it are sent to an AI model provider: OpenAI by default, or the provider whose key a business connects (for example Anthropic). Under the API terms we use, these providers don't use this data to train their models; they may keep it for a short time to detect abuse.

Duke drafts; a person decides. Changes, deletions and messages Duke prepares wait for a person to approve them, and every approved change is recorded in the audit log with who approved it. The one exception is “Duke on duty”: in a conversation a customer started (for example on WhatsApp), a business can switch on actions such as answering, booking and handing over to a person, which then run without a per-action approval, limited to that customer. Money, cancellations of paid things, deletions, exports, settings and bulk messages always need a person.

AI can make mistakes. Businesses should check what Duke prepares before approving it.

Members and customers of a business

Some businesses give their members or customers a member app on the business's own address. If you use one:

• You sign in with a code sent to your email. Your phone stays signed in for up to 6 months unless you sign out.
• Your photo, if the business keeps one, is visible only to the business's staff, for example so the front desk can confirm it's you.
• If the business turns on door check-in by QR code, the app asks for your phone's location only at the moment you check in, to confirm you are at the door. It is not tracked at any other time.
• The business decides what is kept about you and for how long. Ask them first about your data; we help them answer.

Who we share it with

We use a small number of service providers (subprocessors) to run SmartDuke: hosting, AI models, email, WhatsApp and payments. Each gets only what it needs for its job and is bound by contract to protect it. The current list, with what each one does, is on our Subprocessors page: Contabo GmbH, OpenAI, Anthropic, Google (Google Analytics), Resend, Meta Platforms (WhatsApp Cloud API), PayU, PayPal.

When a business connects its own accounts, such as its own WhatsApp number, its own Stripe, PayPal, Razorpay or PayU account for its customers' payments, or its own AI key, data goes to those services under the business's own agreement with them.

We may also disclose data when the law requires it (for example a valid order from a court or government authority), to protect people's safety or our rights, or to a buyer if our business is sold, who must then keep this policy's promises.

We never sell personal data, and we never share it for advertising.

Where it is stored

SmartDuke stores data on servers run by our hosting provider Contabo in Germany (European Union); uploaded files and backups are kept in Contabo Object Storage in the European Union. Some subprocessors, such as our AI and email providers, are in the United States, so data may be processed outside India and outside the European Union. India's DPDP Act allows transfers except to countries the government restricts, and we will follow any such restriction. For people in the European Economic Area or the UK, transfers outside it rely on the safeguards the GDPR provides, such as the European Commission's standard contractual clauses or an adequacy decision.

With the DukeOS Source Licence, the app runs on the licensee's own servers, and the data then stays there: the licensee, not SmartDuke, is responsible for it.

How long we keep it

• Account and business data: while the business has an account.
• Unpublished drafts: if a business signs up and builds an app but never publishes it on a paid plan, the draft and its data are deleted after 30 days.
• Closed businesses: when a business is closed, it is blocked straight away and can be reopened for a while. 90 days after closing, everything it kept in SmartDuke, including files, is deleted.
• Backups: we take a backup every night and keep each one for 30 days, so deleted data disappears from backups within 30 days.
• Invoices and payment records: as long as tax and accounting law requires (in India, generally about six years).
• Security and audit logs: as long as the business's account exists, so it can answer “who changed this?”. When a person's data is erased, their values in the history are blanked, keeping only who and when.

How we protect it

• Each business's data is kept separate: every request is checked against the signed-in person's business by the application and again by the database itself.
• Everything is sent over HTTPS. Passwords are hashed, and keys and tokens for connected services are encrypted at rest.
• Role-based permissions decide what each person (and Duke, acting for them) can see and do. Two-factor sign-in is available, and businesses can require it.
• Uploaded files are scanned for viruses. Every change to business data is recorded in an audit log.
• Nightly backups are tested by restoring them every week. Only a small number of SmartDuke staff can reach production systems, and staff actions on a business are recorded in that business's audit log.

No system is perfectly secure. If a personal data breach happens, we will inform the people affected and the Data Protection Board of India as the DPDP Act requires, and, for data we process for a business, we will tell that business without undue delay so it can meet its own duties.

Your rights

Depending on where you live, you can:

• ask what personal data we hold about you and how we use it, and get a copy;
• ask us to correct, complete or update it;
• ask us to delete it, where we don't have to keep it by law;
• withdraw consent you gave, at any time;
• under the DPDP Act, nominate another person to use your rights if you die or can no longer act, and have your grievance heard;
• under the GDPR, object to or restrict some uses, and receive your data in a portable format.

Business owners can do much of this themselves: owners can export all of their business's data as one file from Settings, and people with the right permission can erase a customer's personal data completely.

To use your rights, write to support@dukeos.app. We may need to confirm it's you. We aim to reply within 30 days. If your data is held by a business that uses SmartDuke, we will pass your request to that business.

If you are not satisfied, you can complain to the Data Protection Board of India after first raising it with us, or, in the EEA or UK, to your local data protection authority.

Grievance Officer

For questions or complaints about personal data, contact our Grievance Officer: Dinakar, SmartDuke Technologies. Email: support@dukeos.app. WhatsApp: +91 73393 01244. We acknowledge complaints within 7 days and aim to resolve them within 30 days.

Cookies and similar storage

The SmartDuke app uses only the cookies it needs to work. They are not used for advertising or for tracking you across sites:

• Sign-in cookies (sd_access and sd_refresh for team members, sd_member in the member app) keep you signed in. Scripts in the page can't read them. They last up to 30 days for team members and up to 6 months for members, unless you sign out.
• A theme cookie remembers whether you chose light or dark mode.
• Your browser's local storage keeps small preferences, such as whether you've dismissed the “install the app” prompt.

This website, smartduke.com, uses Google Analytics cookies (_ga and _ga_<id>, kept for up to two years) to count visits and see which pages help people. Visitors in Europe are asked first, and their choice is remembered in the browser (sd-analytics). It sets no advertising or cross-site tracking cookies.

Children

SmartDuke accounts are for adults acting for a business. Some businesses, such as tutoring centres, keep records about children. As data fiduciary, they are responsible for getting verifiable consent from a parent or guardian where the DPDP Act requires it, and for not using children's data in ways the law forbids.

The live demos and this website

The demo businesses linked from this site contain made-up people and data. You sign in with a demo button, without giving us any personal details, and messages in a demo are never actually sent.

Photos of people at work on this site are stock photos from Pexels, used to illustrate kinds of business. The people in them are not SmartDuke customers. Photographers: Andres Ayrton, Yan Krukau, cottonbro studio, Kawê Rodrigues, Funkcinės Terapijos Centras, Esma Karagoz, Kampus Production, Boris Pavlikovsky, Vitaly Gariev, Alena Darmel, Ann Tarazevich, Audy of Course, RDNE Stock project, Amina Filkins, Mehmet Turgut Kirkgoz, ishola S.Oladimeji, Gustavo Fring, Thirdman, Moin Uddin, Khwanchai Phanthong, Pavel Danilyuk, Tima Miroshnichenko, Elias Gamez, Ron Lach, Antoni Shkraba, Musa Ouizo, Kindel Media, Garda Pest Control Indonesia, Karola G, Ketut Subiyanto, World Sikh Organization of Canada, Aman Deep, Mikhail Nilov. Screens and the tour video come from our live demo businesses, which use made-up data.

Changes to this policy

We may update this policy. The latest version always lives at this address with its date. If a change matters, we will tell account owners by email or in the app before it takes effect.