This English version is the authoritative text.
1. Who We Are
Duolisting (“we”, “us”, “our”) operates duolisting.com and the Duolisting listing management service. For EU/UK data protection law purposes, Duolisting is the data controller of personal data collected through the Service.
Data Controller contact: support@duolisting.com
2. Data We Collect
We collect the business information you provide (name, address, phone, opening hours, photos), the map coordinates and Google place identifier for the address you confirm, and your email address for account creation. We record when you accept these terms, and — if you arrive through a referral or an agency invitation — which one. We also record usage events as you move through the sign-up wizard so we can see where it fails; these are kept for up to 180 days. If you buy our Concierge service for a licence-regulated category, we collect the identity and licence documents you upload: they are stored encrypted, are never public, and are deleted on a 30-day retention schedule. Product analytics via PostHog runs only if you accept the cookie banner. We do not use advertising cookies or cross-site tracking.
3. Google Business Profile Connection
If you choose to connect a Google Business Profile, you sign in with Google and grant Duolisting the following permission. We request this access solely to provide the listing-management features you ask for, and we act only on the profiles you have explicitly connected to Duolisting, never on any profile you have not connected. https://www.googleapis.com/auth/business.manage
What we access and why:
- Your Google Business Profile accounts and locations, to create and update your listing.
- Verification status and options, to guide you through verifying your business.
- Reviews and performance metrics, only if and when we launch those features — they require separate approval from Google, and we will update this policy before accessing them.
How we store and protect it: the OAuth tokens that authorise this access are encrypted at rest using Supabase Vault and referenced only by an internal secret identifier. They are never exposed to your browser, never written to our logs, and never shared with third parties. Google-derived data is stored in the EU (Supabase, eu-west-1).
Limited use: Duolisting’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or share it with third parties except as necessary to provide the Service you requested.
Retention and revocation: we keep the connection and its tokens only while your Google Business Profile is connected. You can disconnect at any time from Settings → Connected Accounts; disconnecting deletes the stored tokens from our systems (including the encrypted copies in our secrets vault) and revokes Duolisting’s access at Google. You can also review or revoke that access yourself from your Google Account permissions. Deleting a listing or your Duolisting account likewise removes all stored Google tokens, including the encrypted copies in our secrets vault.
4. Who Else Processes Your Data
We use the services below to run Duolisting. Each one receives only the data it needs for its purpose, and none of them are permitted to use it for their own ends. We do not sell personal data, and we do not share it for advertising.
| Service | What it does | What it receives |
|---|---|---|
| Supabase | Database and sign-in | Your account and business details |
| Vercel | Hosting and content delivery | Request data, including IP |
| Stripe | Payments | Name, email, payment method |
| Resend | Account and notification email | Your email address |
| Cloudinary | Photo storage and delivery | Photos you upload |
| Upstash | Abuse and rate limiting | Your account ID, or IP if signed out |
| Maps display and publishing your listing | Your business details | |
| Sentry | Error monitoring | Technical error data, no account identity |
| Anthropic | AI writing help | Nothing today — the AI writing feature is not switched on |
| n8n (Railway) | Background automation | Listing and contact data in transit |
| PostHog | Product analytics and session replay | Nothing today — analytics are configured but not switched on |
| Cloudflare Turnstile | Checking you are not a bot | Your IP address and browser signals |
| GitHub | Encrypted backup storage | An encrypted copy of the database, which GitHub cannot read |
Some of these providers are outside the EU. Where that is the case, transfers rely on the European Commission's Standard Contractual Clauses. Your database is hosted in the EU (Ireland). Encrypted copies of its backups are also retained by GitHub for 90 days, on infrastructure that may sit outside the EU; those copies are encrypted before they leave our systems and GitHub cannot read them.
5. Your Rights (EU/UK)
You have the right to access, export or delete your personal data from your account settings, and erasure requests are processed within 30 days. Most of your business details can be corrected there as well. Three cannot yet be changed after creation — your opening hours, the map pin and your photos — so email us and we will correct those for you.
6. Cookies
We use the essential cookies required to keep you signed in. Product analytics (PostHog) sets its own cookies and runs only if you accept them — section 4 states what it receives today. No advertising cookies are used, and we do not track you across other sites. You can reset your cookie preference in Settings → Privacy.
7. Contact
Questions about this policy? Email support@duolisting.com.