Privacy Policy

1. Coverage

Duewick is operated by Dreamway Labs LLC, a limited liability company organised in New Mexico, United States (1012 Marquez Place, Ste 106-B, Santa Fe, NM 87505, United States). This policy covers visitors, subscribers and people named in invoices or communications, including individual customers without a Duewick account. Privacy contact: hello@duewick.com.

We process invoice information for the subscribing business. Inclusion in its records does not prove a person owes money. We also process information for our own administration, security, billing and legal responsibilities.

2. Information and sources

• Visitors: chat messages, conversation identifiers, campaign parameters and technical data such as IP addresses processed by hosting/security services.
• Subscribers: sign-in identity, email, business details, settings, mandates and service interactions. Google sign-in does not give mailbox access.
• Invoices: business and individual names, contacts, amounts, dates, payments, credits and files supplied by the business or its authorised accounting connection.
• Messages: follow-ups, replies, attachments, delivery events, disputes, promises and case decisions. Information may come directly from a recipient or representative.
• Billing: Stripe customer/subscription references and status, not full card numbers.

3. Purposes

We organise invoices, prepare plans, check balances, send authorised messages, handle replies, raise exceptions and record actions. Information also supports security, support, subscriptions, complaints and legal obligations.

Campaign attribution uses visit and conversion information, not invoice contents. We do not sell personal information. Collection messages must not advertise unrelated products.

4. AI and automated processing

OpenAI processing is part of the account access terms. We record the version, information shown, time and verified account making that choice. Existing accounts are not treated as having accepted a new choice merely by viewing a page. You can withdraw permission in Settings. If you later choose an AI action with its data-use notice, that choice is recorded again before new transfers.

AI helps extract invoice information, draft wording and interpret replies. Relevant contact, invoice and conversation content may be sent to our AI provider. Rules use balances, dates, contact history, mandates and case status to prioritise work, allow or block messages and request business decisions.

This may affect when reminders arrive or a case is reviewed. AI can make mistakes and does not determine legal liability. Promises and unverified payment claims are not counted as recovered cash. Subscribers can choose supervised sending. Recipients can request review by replying or contacting the business; privacy concerns can be sent directly to us.

We do not run model-training jobs using customer invoices or conversations. This is not a promise of zero retention by providers; their processing and security practices also apply.

5. Sensitive information

Please do not send unnecessary medical records, identity documents or other sensitive material. Explain the practical help needed without disclosing a diagnosis. Replies and attachments may be stored and processed before human review; sensitive content is not automatically stripped.

Contact us about unnecessary sensitive information. We will assess whether it may be retained, limit unnecessary use and arrange correction or removal where appropriate and lawful. Never send passwords or full card details.

6. Sharing and overseas processing

The subscribing business can see its case records and replies. Service providers include:

• Cloudflare: hosting, security and sending/receiving email.
• Supabase: database, authentication and file storage.
• OpenAI: AI processing for extraction and conversations.
• Stripe: subscription payments.
• Google Workspace: support and business communications.
• PostHog (United States): product analytics, as described in section 7.
• Xero: the accounting connection authorised by the business, when used.

Information can be processed in Australia, the United States and other provider locations. Australian database hosting alone does not mean all data stays in Australia. Contact us about providers relevant to your information; access, support, backups and security processing are also relevant to overseas handling.

A business may share an authorised export with its adviser. Creating a legal handoff pack does not automatically send it to a lawyer. Disclosures may also be necessary for legal obligations or security investigations. We do not publish debts or disclose them to unrelated people to exert pressure.

7. Cookies

• duewick_visitor: unsigned-in chat continuity, up to one year.
• duewick_attribution: campaign attribution, up to 90 days.
• duewick_aid: product analytics, a random identifier, up to 180 days.
• Authentication cookies maintain sign-in; payment providers may use their own cookies.

Blocking cookies may prevent sign-in or continuity. Cookie expiry does not delete associated server records. We do not currently embed advertising tracking pixels.

Website analytics: on our public website (duewick.com and its Australian site) we use Cloudflare Web Analytics to count page views and measure loading speed. It records the page path (not query strings), referring site, browser, device type and country; Cloudflare states that it does not collect or use visitors’ personal data. It is not loaded for visitors in the EU and is not used inside the application.

Product analytics: on our websites and in the application we use PostHog, a provider based in the United States, to understand how people move through sign-up and set-up. Our server sends a small set of events: pages viewed (the page pattern only, without query strings or record identifiers), sign-up and set-up milestones and error codes, together with the site, device type, campaign source and an approximate location (country, state or region and city) that Cloudflare derives from the connection. That location can be wrong, for example with a VPN or a mobile network; we never send street addresses, postcodes, coordinates or your IP address, and webhooks from payment or accounting providers are never treated as your location. Events are linked over time by the random identifier in the duewick_aid cookie and, once you have an account, by a coded identifier derived from your account, so they are pseudonymous rather than anonymous. We do not send names, email addresses, your IP address, invoice or customer details, or the content of chats and files, and we do not use session recording, screen capture, advertising or remarketing. We do not send these events if your browser sends Do Not Track or Global Privacy Control, for visitors in the EU, EEA, UK or Switzerland, or after you ask hello@duewick.com to stop.

8. Security and retention

We use access controls, encrypted transport and protected accounting credentials. No system guarantees absence of incidents. We investigate and assess notifications to affected people and authorities where required.

Cancellation does not automatically erase account, invoice or communication records. Deletion requests are reviewed, including records needed for disputes, security investigations or legal obligations. We do not promise instant deletion from backups or providers.

Ask hello@duewick.com for deletion or retention information. We assess purpose and obligations and explain what is retained or action taken. Fixed retention periods have not yet been established for every category; this is a current service limitation, not permission to retain information indefinitely.

9. Access, correction and complaints

Contact hello@duewick.com to request access, correction, deletion or review, or complain about processing. We may need proportionate identity verification; do not send identity documents unless requested through an appropriate channel. We will explain lawful reasons for declining a request.

Reply to a reminder or contact the named business to dispute the invoice, report payment, correct a recipient or discuss your circumstances. No Duewick account is needed. Complaints about Duewick can be made directly to us. See our Contact and complaints policy.

If unresolved, you may contact the Office of the Australian Information Commissioner where it has jurisdiction. Other applicable privacy rights and complaint routes are not excluded.

10. Updates

We show the date and version when practices change and notify subscribers of material updates. Updates do not remove rights relating to earlier processing.