Legal notice: This document has been drafted to reflect the Duolisting product and data strategy. It will be reviewed by a qualified lawyer before Duolisting accepts paying customers or processes personal data from the public.
1. Who We Are
Duolisting (“we”, “us”, “our”) operates duolisting.com and the Duolisting listing management service. For EU/UK data protection law purposes, Duolisting is the data controller of personal data collected through the Service.
Data Controller contact: support@duolisting.com
2. Data We Collect
We collect business information you provide (name, address, phone, hours, photos), your email address for account creation, and usage analytics via Vercel Analytics (cookieless, GDPR-exempt). We do not use advertising cookies or cross-site tracking.
3. Google Business Profile Connection
If you choose to connect a Google Business Profile, you sign in with Google and grant Duolisting the https://www.googleapis.com/auth/business.manage permission. We request this access solely to provide the listing-management features you ask for, and we act only on the profiles you have explicitly connected to Duolisting, never on any profile you have not connected.
What we access and why:
- Your Google Business Profile accounts and locations, to create and update your listing.
- Verification status and options, to guide you through verifying your business.
- Reviews and performance metrics, to display them in your dashboard and help you respond.
How we store and protect it: the OAuth tokens that authorise this access are encrypted at rest using Supabase Vault and referenced only by an internal secret identifier. They are never exposed to your browser, never written to our logs, and never shared with third parties. Google-derived data is stored in the EU (Supabase, eu-west-1).
Limited use: Duolisting’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or share it with third parties except as necessary to provide the Service you requested.
Retention and revocation: we keep the connection and its tokens only while your Google Business Profile is connected. You can disconnect at any time from Settings → Connected Accounts; disconnecting deletes the stored tokens from our systems (including the encrypted copies in our secrets vault) and revokes Duolisting’s access at Google. You can also review or revoke that access yourself from your Google Account permissions. Deleting a listing or your Duolisting account likewise removes all stored Google tokens, including the encrypted copies in our secrets vault.
4. Apple Business / Apple Maps Connection
If you choose to appear on Apple Maps, you connect your business through Apple Business (formerly Apple Business Connect) and delegate access to Duolisting from within your own Apple Business account. We request this access solely to provide the listing-management features you ask for, and we act only on the business locations you have explicitly delegated to Duolisting, never on any location you have not delegated.
What we access and why:
- Your Apple Business location (place card), to create and update your Apple Maps listing with the details you entered in our wizard.
- Submission and verification status, to show you whether your listing is live and guide you if Apple needs anything from you.
- Place-card insights, to display interaction metrics in your dashboard.
How we store and protect it: the credentials that authorise this delegated access are encrypted at rest using Supabase Vault and referenced only by an internal secret identifier. They are never exposed to your browser, never written to our logs, and never shared with third parties. Apple-derived data is stored in the EU (Supabase, eu-west-1).
Limited use: Duolisting’s use of information obtained through the Apple Business and Apple Business Connect APIs is limited to providing the listing-management features you requested, in accordance with the applicable Apple Business and Apple Maps program terms. We do not sell Apple-derived data, use it for advertising, or share it with third parties except as necessary to provide the Service you requested.
Retention and revocation: we keep the delegation and its credentials only while your Apple Maps listing is connected. You can revoke Duolisting’s access at any time from within your own Apple Business account, and you can disconnect from Settings → Connected Accounts; disconnecting deletes the stored credentials from our systems (including the encrypted copies in our secrets vault). Deleting a listing or your Duolisting account likewise removes all stored Apple credentials.
5. Your Rights (EU/UK)
You have the right to access, correct, export, or delete your personal data at any time from your account settings. Erasure requests are processed within 30 days.
6. Cookies
We use Vercel Analytics (cookieless, no personal data collected) and optional Crisp chat session cookies (accepted via the cookie banner). No advertising cookies are used. You can reset your cookie preference in Settings → Privacy.
7. Contact
Questions about this policy? Email support@duolisting.com.