Privacy Policy
This Privacy Policy explains how Carelius Nexus AS (org. no. 937 872 305) ("Duewell", "we", "us", "our"), based in Oslo, Norway, collects, uses, and protects personal data in connection with the Duewell service (the "Service").
We are based in Norway, and we process personal data in accordance with the EU General Data Protection Regulation (GDPR) as it applies in the EEA, and Norwegian data-protection law.
1. Who is responsible for your data
For personal data about you, the account holder (your email, profile, and how you use the Service), Duewell is the data controller.
For personal data about your clients that you enter into the Service (see section 3), the position is different and important — see section 4.
2. What data we collect about you (the account holder)
- Account data: the email address you sign up with (used as your account identifier and to sign the letters and emails you generate), and your password (stored only as a secure hash — we never store it in readable form).
- Profile data: your name, business name, country, and signature preferences, which you provide to personalize the messages you generate.
- Payment data: if you subscribe, your payment is handled by Stripe. We do not receive or store your full card details; we receive limited billing information and subscription status from Stripe.
- Usage and technical data: basic, privacy-friendly analytics (via Plausible, which does not use cookies and does not track you across sites), and standard technical information such as approximate region and device/browser type, used to operate and improve the Service.
3. What data you enter about your clients
To use the Service, you enter information about the invoices you are chasing, which may include personal data about your clients, such as: client or business name, client email address, client postal address (optional, for formal letters), invoice amounts, and due dates.
We process this data only to provide the Service to you — that is, to generate the follow-up messages and letters you request, to track invoice status, and to notify you (the account holder) when an invoice is due for follow-up. We do not use your clients' data for our own purposes, do not sell it, and do not send anything to your clients ourselves.
4. Your clients' data — your responsibilities and ours
When you enter data about your clients, you decide why and how that data is used (to pursue payment of your invoice). In data-protection terms, you are generally the controller of your clients' personal data, and Duewell acts as a processor handling that data on your behalf and on your instructions, solely to provide the Service.
This means:
- You are responsible for having a lawful basis to process your clients' data (for chasing a genuine debt, this is typically your legitimate interest in recovering payment) and for meeting any transparency or other obligations you owe your clients under applicable data-protection law.
- We process your clients' data only as needed to provide the Service to you, protect it as described in section 8, and do not use it for any other purpose.
5. AI processing
Duewell uses AI (provided via our backend, Blink) to generate the follow-up messages and letters. The invoice and profile information you provide is processed by this AI to produce the drafts you request. This processing happens to deliver the feature you asked for; the generated drafts are made available to you to review and send.
6. Purposes and legal bases (GDPR)
We process personal data for the following purposes and legal bases:
- To provide the Service (generate messages, manage your account and invoices) — performance of a contract with you.
- To process payments and manage subscriptions — performance of a contract and legal obligation (e.g. accounting).
- To operate, secure, and improve the Service (including privacy-friendly analytics) — our legitimate interests in running a functioning, secure product.
- To communicate with you (service notifications, follow-up reminders, support) — performance of a contract and legitimate interests.
- Where required, with your consent — which you may withdraw at any time.
7. Who we share data with (subprocessors and providers)
We share data with service providers who help us run the Service, under agreements that require them to protect it:
- Stripe — payment processing and subscription management.
- Blink — backend infrastructure, authentication, database, and AI processing.
- Vercel — application and website hosting.
- Plausible — privacy-friendly, cookieless analytics.
We do not sell personal data. We may disclose data if required by law or to protect our legal rights.
8. International transfers
Some of our providers may process data outside Norway/the EEA. Where that happens, we rely on appropriate safeguards recognized under GDPR (such as EU Standard Contractual Clauses or an adequacy decision).
9. Data retention
We keep personal data for as long as your account is active and as needed to provide the Service. When you delete your account or specific data (such as an invoice), we delete or anonymize the associated personal data, except where we must retain certain records to meet legal obligations (for example, tax and accounting records related to payments).
10. Security
We use technical and organizational measures to protect personal data, including secure authentication, encrypted transport, and hashed password storage. No system is perfectly secure, but we take reasonable steps to protect the data in our care.
11. Your rights
Subject to applicable law, you have the right to: access your personal data; correct inaccurate data; request deletion; restrict or object to certain processing; data portability; and withdraw consent where processing is based on consent. You can exercise many of these directly in the Service (for example, editing your profile or deleting your account), or by contacting us at support@duewell.app.
If your clients wish to exercise rights over their data that you have entered, they should generally contact you (as the controller of that data); we will assist you as your processor as required.
12. Cookies and tracking
Duewell aims to minimize tracking. Our analytics provider (Plausible) is cookieless and does not track you across websites. We use only cookies or local storage strictly necessary to operate the Service (such as keeping you signed in).
13. Children
The Service is not directed to children and is intended for users aged 18 and over. We do not knowingly collect data from children.
14. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified (by email or in-app) and reflected in the "Last updated" date.
15. Contact and complaints
For privacy questions or to exercise your rights: support@duewell.app Carelius Nexus AS (org. no. 937 872 305), Lørenvangen 21A, 0585 Oslo, Norway.
If you are in the EEA and believe we have not handled your data properly, you have the right to lodge a complaint with your local data-protection authority. In Norway, this is Datatilsynet (the Norwegian Data Protection Authority).