Privacy Policy

Duna is a software service operated by DodoLabs PropTech Solutions B.V., Vinkenburgstraat 2A, 3512 AB Utrecht, the Netherlands. Chamber of Commerce (KvK) no. 97693464, VAT no. NL868186806B01 ("DodoLabs", "we", "us"). For the personal data described in this policy, DodoLabs is the controller under the General Data Protection Regulation (GDPR, in Dutch: AVG).

You can reach us about privacy at privacy@heyduna.com and about anything else at hello@heyduna.com. We have not appointed a data protection officer, because the law does not require one for our activities; the privacy address above is handled by the management of DodoLabs.

This policy covers visitors of this website, people who contact us or request a demo, and the people who manage a Duna account for their business. When our customers use Duna to process the data of their own audiences (for example comments, direct messages or leads), we act as a processor on their behalf; see section 5.

When you contact us or request a demo

• Your name and work email address
• Company or brand name, and website or social media handle if you provide them
• The plan you are interested in, any quote you built on our pricing page, and your message
• Your interface language, the regional price display used for you (derived from your device's region settings) and the page you sent the form from
• Your IP address, as recorded by our server when the form is submitted

When you use Duna

• Account data: name, email address, company details, role and login information
• Billing data: billing contact, invoices and payment status (card details are handled by our payment provider, not stored by us)
• Usage data: actions in the product, settings and support conversations

When you browse this website

• Technical data our web server needs to deliver pages securely, such as IP address, browser type and request time, kept in short-lived server logs
• Your language preference, stored on your own device (see our Cookie Policy)

We do not use analytics or advertising trackers on this website.

We do not sell personal data and do not use it for automated decisions that have legal or similarly significant effects on you.

To run Duna, our customers connect social media accounts, calendars, CRMs and messaging channels. Through these connections Duna processes data such as comments, direct messages, lead details, contact records and appointment times. For this data our customer is the controller and DodoLabs is the processor. We process it only on the customer's documented instructions and under a data processing agreement (DPA) that we make available to every customer.

If you are a member of the public and your data reached Duna through one of our customers (for example because you messaged a business that uses Duna), please contact that business first. We will help them handle your request.

Duna uses large language models to draft posts, captions, replies, outreach messages and reports. Our AI provider is OpenAI, used through its business API. When a feature needs AI, Duna sends the provider only the information needed for that task, for example your brand guidelines, the post brief, or the comment or message that needs a reply. Under our agreement with OpenAI, data sent through the API is not used to train its models; OpenAI may keep it for up to 30 days to detect abuse, after which it is deleted unless the law requires otherwise.

• AI output is a draft. By default every post and reply goes through your approval queue before anything is published or sent.
• Duna does not make decisions with legal or similarly significant effects about people (GDPR art. 22). Lead scoring and suggested replies only help your team prioritise and respond.
• We do not use your content or your audience's data to train our own or third-party AI models.
• Please do not put special categories of personal data (such as health information) into prompts or brand guidelines unless you have a valid legal basis.

We use a small number of service providers (sub-processors) that process data on our behalf under a written agreement:

We will add our payment provider to this list before online payments start; until then subscriptions are invoiced by DodoLabs directly. We also share data with:

• Connected platforms: the social networks, CRMs and calendars you choose to connect, which receive data when Duna publishes or syncs on your instruction. They act as independent controllers under their own terms.
• Agency partners: if you work with Duna through an agency, that agency can see your workspace.
• Advisers and authorities: our accountant and legal advisers under confidentiality, and authorities where the law requires it or to protect our rights in a dispute.

We will update this list when a sub-processor changes and inform customers in advance of material changes, as set out in our data processing agreement.

Our servers and the contact form database are in Germany. Some providers, in particular OpenAI, Google and our DNS and email routing provider, may process data in the United States or other countries outside the European Economic Area (EEA). For these transfers we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and in all cases on the European Commission's Standard Contractual Clauses (SCCs) included in the provider's data processing terms, together with supplementary measures such as encryption in transit. You can ask us for a copy of the relevant safeguards.

• Enquiries and demo requests: up to 24 months after our last contact, unless you become a customer
• Account data: for as long as your account is active, and up to 90 days after it ends so you can export your data
• Customer content processed for you: deleted or returned at the end of the contract, as set out in the DPA
• Invoices and bookkeeping records: 7 years, as required by Dutch tax law
• Server logs: up to 30 days
• Data sent to our AI provider: not stored by the provider beyond its abuse-monitoring period of up to 30 days

We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), access controls on a need-to-know basis, encrypted storage of connection tokens and regular updates of our systems. No system is perfectly secure; if a breach affects your data we will inform you and the authorities where the law requires it.

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure of your data where there is no longer a reason to keep it
• Restriction of processing in certain situations
• Data portability: receive your data in a structured, commonly used format
• Object to processing based on our legitimate interest, including direct marketing
• Withdraw consent at any time, where processing is based on consent

To exercise a right, email privacy@heyduna.com (or use the contact form and mention "privacy request"). We reply within one month, which we may extend by two months for complex requests after telling you why, and we may ask you to confirm your identity. Exercising your rights is free of charge.

If you are not satisfied with how we handle your data, please tell us first at privacy@heyduna.com so we can try to fix it. You also have the right to lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag, the Netherlands
autoriteitpersoonsgegevens.nl

If you live or work in another EU or EEA country, you can also complain to the supervisory authority there.

We may update this policy when our service or the law changes. The date at the top shows the latest version. If a change is significant, we will inform customers by email or in the product before it takes effect.

For any question about this policy or your personal data, contact us:

DodoLabs PropTech Solutions B.V., Vinkenburgstraat 2A, 3512 AB Utrecht, the Netherlands. Chamber of Commerce (KvK) no. 97693464, VAT no. NL868186806B01
Email: hello@heyduna.com · Privacy: privacy@heyduna.com