Duegent ("we", "us") is a conversational portfolio research platform. This policy explains what personal data we collect, why we collect it, and how you can control it.
1. Who We Are and Our Role
Duegent is operated by the provider of this Service, who is the data controller for it within the meaning of the GDPR. Full legal and registration details of the controller are provided on request, and to any supervisory authority on enquiry.
For any privacy matter — access, correction, deletion, objection, or a complaint — write to [email protected]. We answer without undue delay and in any event within one month, as Article 12(3) requires.
We are the controller for your account data, the holdings and content you store with us, and our self-hosted analytics. In Self-Host mode the reasoning runs on your own machine through your own coding-agent subscription: that provider is your relationship, not ours, and we are not a controller or processor of what passes through it.
2. Data We Collect
- Account data — your email address and authentication credentials (a password hash, or a Google OAuth identifier if you sign in with Google).
- Holdings you record — instruments, quantities, and notes you choose to enter in Managed mode or explicitly sync to our servers.
- Generated artifacts — research reports, notes, and other outputs the Service produces for you.
- Device & connector metadata — connector version, operating system type, and connection status, used to run and troubleshoot the Self-Host connector.
- Minimal server logs — IP address, timestamps, and request metadata kept briefly for security and debugging.
3. What We Do NOT Collect
- No brokerage credentials — we never ask for, receive, or store your broker logins or account numbers.
- No government identifiers — no SSN, national ID, or tax numbers.
- No third-party ad trackers — we do not run advertising or cross-site tracking of any kind.
In Self-Host mode, the AI reasoning runs on your own coding-agent subscription on your machine — so your holdings are never sent to a third-party LLM that we chose or pay for. The one exception is what you write in the Square: that is public by design, and we machine-translate it with the platform model so zh and en readers share one room. Your account data (holdings, chat history, research, memory) is still stored on our servers, transmitted over TLS, with API credentials encrypted at the application layer, and you can permanently delete all of it at any time.
4. Legal Bases
We process account data and the content you ask us to store on the basis of contract performance — it is what makes the Service work.
For optional analytics, the legal basis differs by region: in the EU/EEA and UK (GDPR/UK GDPR regions), analytics runs only with your prior consent — it is off by default until you opt in via the consent banner. In other regions, we rely on legitimate interest and enable privacy-friendly, cookieless analytics by default, with an opt-out available at any time via the Cookie settings link in the footer.
We rely on legal obligation for retaining transaction records required by tax and accounting law, and on legitimate interest for security and fraud prevention.
5. Processors We Use
| Provider | Purpose |
|---|---|
| Amazon Web Services (AWS) | Cloud hosting and storage |
| Cloudflare | CDN, DNS, and security (DDoS protection) |
| Paddle | Payment processing (Merchant of Record) — we never see your card details |
| Resend | Transactional email (verification, account notices) |
| OpenAI | AI inference for Managed mode, plus machine translation of anything you post in the Square (in either mode, because the Square is one shared bilingual room) — content is not used to train models under API terms |
We do not sell your personal data to any third party.
6. AI Processing
Producing research means sending context to a language model. WHICH model, and whose account pays for it, is the difference between the two modes — and it is the most consequential privacy choice in the product.
Self-Host: the model runs on your machine, under your own coding-agent subscription (Claude Code, Codex CLI). Your holdings are not transmitted to any model we chose or pay for. The one exception is what you post publicly in the Square, which is machine-translated by the platform model so zh and en readers share one room.
Managed (Duegent Cloud): we send the assembled research dossier — which includes the instruments and quantities relevant to your question — to the AI provider named in the Processors section above, under API terms that prohibit using the content to train models. That section is the authoritative list and we update it if the provider changes. We do not sell this data and do not use it to train anything ourselves.
No automated decision-making produces legal or similarly significant effects about you within the meaning of Article 22. The agent writes research; it does not decide anything about your account, your access, or your money.
7. International Transfers
Our infrastructure runs on AWS and some processors operate in the United States. For users in the EEA and UK, transfers of personal data outside those regions rely on the European Commission's Standard Contractual Clauses (SCCs) and, where the provider is certified, the EU-US Data Privacy Framework.
8. Retention
- Account data and stored content — retained until you delete them or delete your account.
- Backups — deleted data rolls off our encrypted backups within 30 days.
- Server logs — retained for 30 days.
- Transaction records — retained as required by tax and accounting law; Paddle, as Merchant of Record, holds the primary invoicing records.
9. Your Rights
You can export and delete your data directly in the product: Account → Export my data returns everything we hold as a JSON file, and Settings → Danger zone deletes the account. Deletion removes your account data and stored content, subject to the backup roll-off and legally required records above. Questions or other rights requests: [email protected].
If you are in the EU/EEA or UK, you additionally have the rights of access, rectification, erasure, portability, restriction, and objection, the right to withdraw consent at any time, and the right to lodge a complaint with your data protection authority.
California residents (CCPA/CPRA): we do not sell or share your personal data, and we do not use it for cross-context behavioural advertising. You may exercise your rights to know and to delete via the in-product tools or by contacting us.
10. Data Security
Transport is TLS throughout. Passwords are stored as bcrypt hashes, never in a recoverable form. API credentials you entrust to us (a market-data key, for instance) are encrypted at the application layer before they are written, so a database dump alone does not yield them. Access to production systems is restricted to the Service operator.
No system is perfectly secure, and anyone claiming otherwise is selling something. If we ever become aware of a personal-data breach that is likely to present a risk to you, we will notify the competent supervisory authority within 72 hours and inform you directly where Article 34 requires it.
11. Children
The Service is not intended for anyone under 18, and the Terms of Service make being 18 or older a condition of holding an account — it concerns investment research, and a brokerage account is not something a minor holds independently in most jurisdictions. We do not knowingly collect personal data from children; if we learn that we hold any, we delete it.
12. Changes to This Policy
We may update this policy. Where a change materially affects the purpose or scope of processing, we give notice before it takes effect, and where the law requires consent for that change we ask for it again rather than assuming it. Ordinary clarifications are published by updating the date on this page.
Continued use is not treated as consent to anything the law requires consent for.
13. Contact
Questions or rights requests: [email protected]. We respond within 30 days.