Privacy Policy

When you register and use the Service, we collect:

• Account Information: Your name, email address, and Google profile photo (obtained via Google Sign-In).
• Profile Information: Display name, bio, and avatar you choose to set within the Service.
• Identity Information: Brand names, descriptions, and metadata you enter when creating digital identities.
• Billing Information: Subscription plan, payment history, and transaction IDs processed via Razorpay. We do not store your full credit card number or banking details.
• Support Communications: Emails, messages, and attachments you send to contact@duiid.com for support or inquiries.

When you access the Service, we automatically collect:

• Usage Data: Pages visited, features used, time spent, actions taken, and error logs. This helps us improve the Service.
• Device Information: Browser type, operating system, screen resolution, and device identifiers.
• IP Address: Used for security, fraud prevention, and approximate geolocation for analytics.
• Authentication Tokens: Firebase Auth tokens used to maintain your session securely.

The following categories of data are stored in your encrypted Vault. This data is encrypted client-side before transmission — meaning your browser or app encrypts the data using a key derived from your password, and only the encrypted ciphertext is sent to our servers. We never receive or store the plaintext version:

• Passwords and login credentials for third-party accounts
• Documents, PDFs, images, and other files uploaded to the Vault
• Brand assets (logos, color palettes, font files) stored within an identity
• API keys and secret tokens stored as credentials
• Notes and text content within identity profiles

We may receive information from:

• Google (Authentication): Your name, email, and profile photo when you sign in with Google.
• Razorpay (Payments): Payment status, transaction ID, and subscription status. Razorpay handles all card/bank details directly.
• Domain/Social APIs: Availability status for domain names and social media handles (we only send the name being checked, not your personal data).

• To create and manage your account and authentication.
• To store and retrieve your encrypted Vault data when you request it.
• To process Subscription payments and allocate Credits.
• To generate AI-powered brand names, logos, and brand kits based on your input.
• To check domain and social handle availability for identities you create.
• To enable team delegation and shared access features.

• To send you service-related notifications (e.g., breach alerts, security updates).
• To send billing receipts and subscription renewal notices.
• To respond to your support requests and inquiries.
• To notify you of changes to the Service, Terms, or this Privacy Policy.

• To analyze usage patterns and improve the Service's features, performance, and user experience.
• To detect, prevent, and respond to fraud, abuse, security incidents, and unauthorized access.
• To comply with legal obligations and respond to lawful requests from authorities.
• To monitor and enforce the Acceptable Use Policy defined in our Terms and Conditions.

We use the following third-party service providers to operate the Service:

1. Google Firebase: Authentication, Firestore database, Cloud Storage, Cloud Functions, and Hosting. Data is stored in the asia-south1 (Mumbai) region. Subject to Google\'s privacy policy.
2. Razorpay: Payment processing. Razorpay collects and processes payment data directly — we only receive transaction status and IDs.
3. OpenAI: AI generation for brand names, logos, and brand kits. Only the text prompt you submit for generation is sent to OpenAI — no Vault data is ever sent.
4. Domain/Social APIs: Third-party APIs to check domain and social handle availability. Only the name being checked is transmitted.

We may disclose your information if required to do so by law, court order, or government directive. However, because Vault data is encrypted client-side, even if we are compelled to hand over data, we can only provide encrypted ciphertext that is meaningless without your encryption key. This is a fundamental privacy guarantee of the zero-knowledge architecture.

In the event of a merger, acquisition, or sale of all or a portion of the Company's assets, your information may be transferred to the acquiring entity. You will be notified via email before any such transfer occurs.

We may share your information with any other third party with your explicit, informed consent. You can withdraw consent at any time by contacting us at contact@duiid.com.

We retain your personal information for as long as your account is active. Encrypted Vault data is retained for as long as your account exists, unless you manually delete specific items or your entire account.

When you delete your account, the following happens:

1. All encrypted Vault data is permanently deleted from our servers within 30 days.
2. Your authentication credentials are revoked immediately.
3. Your public profile is removed.
4. All delegated access links are revoked.
5. Subscription is cancelled and unused Credits are forfeited.

Certain records may be retained beyond account deletion as required by Indian law:

• Financial transaction records: up to 7 years (per Indian tax law).
• Security incident logs: up to 3 years for audit and compliance.
• Legal correspondence: until the matter is fully resolved.

• In Transit: All data transmitted between your browser and our servers uses TLS 1.2+ encryption (HTTPS).
• At Rest (Vault): Vault data is encrypted client-side using AES-256-GCM before transmission. The encryption key is derived from your password and never leaves your device in plaintext.
• At Rest (Infrastructure): Firestore and Cloud Storage data are encrypted at rest by Google Firebase using AES-256.

• Internal access to infrastructure is restricted to authorized personnel using role-based access control (RBAC).
• All administrative access is logged and audited.
• No employee has access to your Vault plaintext — the zero-knowledge architecture makes this technically impossible.
• Multi-factor authentication (MFA) is enforced for all internal administrative accounts.

The Service enforces the following security headers via Firebase Hosting configuration:

• Content-Security-Policy (CSP) to prevent cross-site scripting (XSS)
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY (prevents clickjacking)
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy (restricts camera, microphone, geolocation)

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Data Protection Board of India within 72 hours of becoming aware of the breach, as required by the DPDP Act, 2023.