Legal notice: This document has been drafted to reflect the Duolisting product and data strategy. It will be reviewed by a qualified lawyer before Duolisting accepts paying customers or processes personal data from the public.
This English version is the authoritative text.
1. Who We Are
Duolisting (“we”, “us”, “our”) operates duolisting.com and the Duolisting listing management service. For EU/UK data protection law purposes, Duolisting is the data controller of personal data collected through the Service.
Data Controller contact: support@duolisting.com
2. Data We Collect
We collect business information you provide (name, address, phone, hours, photos), your email address for account creation, and usage analytics via Vercel Analytics (cookieless, GDPR-exempt). We do not use advertising cookies or cross-site tracking.
3. Google Business Profile Connection
If you choose to connect a Google Business Profile, you sign in with Google and grant Duolisting the following permission. We request this access solely to provide the listing-management features you ask for, and we act only on the profiles you have explicitly connected to Duolisting, never on any profile you have not connected. https://www.googleapis.com/auth/business.manage
What we access and why:
- Your Google Business Profile accounts and locations, to create and update your listing.
- Verification status and options, to guide you through verifying your business.
- Reviews and performance metrics, to display them in your dashboard and help you respond.
How we store and protect it: the OAuth tokens that authorise this access are encrypted at rest using Supabase Vault and referenced only by an internal secret identifier. They are never exposed to your browser, never written to our logs, and never shared with third parties. Google-derived data is stored in the EU (Supabase, eu-west-1).
Limited use: Duolisting’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or share it with third parties except as necessary to provide the Service you requested.
Retention and revocation: we keep the connection and its tokens only while your Google Business Profile is connected. You can disconnect at any time from Settings → Connected Accounts; disconnecting deletes the stored tokens from our systems (including the encrypted copies in our secrets vault) and revokes Duolisting’s access at Google. You can also review or revoke that access yourself from your Google Account permissions. Deleting a listing or your Duolisting account likewise removes all stored Google tokens, including the encrypted copies in our secrets vault.
4. Who Else Processes Your Data
We use the services below to run Duolisting. Each one receives only the data it needs for its purpose, and none of them are permitted to use it for their own ends. We do not sell personal data, and we do not share it for advertising.
| Service | What it does | What it receives |
|---|---|---|
| Supabase | Database and sign-in | Your account and business details |
| Vercel | Hosting and cookieless analytics | Request data, including IP |
| Stripe | Payments | Name, email, billing address, payment method |
| Resend | Account and notification email | Your email address |
| Cloudinary | Photo storage and delivery | Photos you upload |
| Upstash | Abuse and rate limiting | Your account ID, or IP if signed out |
| Maps display and publishing your listing | Your business details | |
| Sentry | Error monitoring | Technical error data, no account identity |
| Anthropic | AI writing help | The business text you submit for it |
| n8n (Railway) | Background automation | Listing and contact data in transit |
| PostHog | Product analytics and session replay | Your account ID, pages used, and session recordings with all typed input masked |
| Cloudflare Turnstile | Checking you are not a bot | Your IP address and browser signals |
Some of these providers are outside the EU. Where that is the case, transfers rely on the European Commission’s Standard Contractual Clauses. Your database and its backups are hosted in the EU (Ireland).
5. Your Rights (EU/UK)
You have the right to access, correct, export, or delete your personal data at any time from your account settings. Erasure requests are processed within 30 days.
6. Cookies
We use Vercel Analytics (cookieless, no personal data collected) and the essential cookies required to keep you signed in. No advertising cookies are used, and no third-party analytics cookies are set. You can reset your cookie preference in Settings → Privacy.
7. Contact
Questions about this policy? Email support@duolisting.com.