This policy explains what personal data Duebolt collects, why, who it’s shared with and what your rights are. In short: invoices you make without an account never leave your device, we only keep what we need to run the service, and we never sell your data.
1. Who is responsible
The data controller is Shamil Musaev, a sole trader (enskild firma) registered in Sweden, VAT number SE950129797301. Contact for anything about your data: support@duebolt.com.
For personal data that you enter about your own clients, you are the controller and we are your processor; see section 7 of our Terms of Service.
2. Using Duebolt without an account
Invoices, business details, clients and items you enter without logging in are stored only in your browser’s storage on your device. PDFs are created on your device. We don’t receive this data. Our hosting provider still processes basic technical data (see section 3) to deliver the website.
3. What we collect
- Account data: your email address, login codes and login history.
- Content you create: business details and logo, clients, saved items and invoices, including your clients’ names, email addresses and addresses.
- Billing data: your plan, Stripe customer and subscription IDs, billing country and postal code, and tax ID if you give one. Card details are collected and stored by Stripe; we never see them.
- Invoice link activity: when someone opens an invoice link you sent, we record that it was viewed and when, and whether they marked it as paid.
- Emails: the recipient, subject and delivery status of emails sent through Duebolt, and messages you send to us.
- Technical data: IP address, browser and device type, and pages requested, in server and security logs.
- Usage statistics: anonymous counts of what happens on the site, such as a page being opened, a PDF being downloaded or the upgrade button being clicked, with the page, the referring website and your country. These are not linked to your account, contain no IP address and use no cookies or stored identifiers.
4. Why we use it, and the legal basis
- Providing the service you asked for: your account, storing and sending invoices, showing their status (performance of a contract, GDPR art. 6(1)(b)).
- Payments, bookkeeping and tax: we must keep accounting records and report VAT (legal obligation, art. 6(1)(c)).
- Security, fixing problems and improving Duebolt with anonymous usage statistics; preventing fraud and abuse (legitimate interest, art. 6(1)(f)).
- Service emails such as login codes, receipts and important changes (performance of a contract). We send marketing emails only with your consent, and you can unsubscribe at any time.
We don’t use your data for automated decisions that have legal or similarly significant effects on you.
5. Who we share it with
We use these service providers (processors), bound by data processing agreements, who may use the data only on our instructions:
- Supabase Inc. (database and login): data stored in the United States.
- Vercel Inc. (website hosting): United States and a global network of servers.
- Resend (sending emails and receiving emails sent to our support address): United States.
- Stripe Payments Europe Ltd. (payments and tax calculation): Ireland, with processing in the United States. Stripe is also an independent controller for some payment data under its own privacy policy.
Transfers outside the EU/EEA are protected by the EU–US Data Privacy Framework where the provider is certified, and otherwise by the European Commission’s Standard Contractual Clauses. We may also disclose data when required by law, for example to the Swedish Tax Agency. We don’t sell or rent personal data and we don’t show ads.
6. How long we keep it
- Account data and content: until you delete it or close your account; deleted data leaves our backups within 30 days.
- Payment and accounting records: 7 years after the end of the financial year, as required by the Swedish Bookkeeping Act.
- Server and security logs: up to 30 days.
- Support emails: up to 2 years after the conversation ends.
7. Cookies and local storage
We only use storage that is necessary for the service to work: a login cookie when you have an account, and your browser’s local storage for drafts and your saved details. These don’t need consent. We don’t use advertising, cross-site tracking or third-party analytics cookies. If that ever changes, we’ll ask for your consent first.
8. Security
Data is encrypted in transit (HTTPS) and at rest. Access to stored data is limited to what is needed to run the service. Each account can only access its own data. No system is perfectly secure; if a breach affects your personal data in a way that is likely to put you at high risk, we’ll tell you without undue delay.
9. Your rights
You have the right to access, correct, export (data portability) or delete your personal data, to restrict or object to how we use it, and to withdraw consent at any time. You can delete invoices and clients in the app yourself. For anything else, email support@duebolt.com; we’ll answer within one month. We may need to confirm your identity first, and some data we must keep by law (see section 6).
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or to the data protection authority where you live or work.
10. Children
Duebolt is not intended for anyone under 18, and we don’t knowingly collect data about children.
11. Changes
We’ll update this policy when our practices change. For important changes we’ll email account holders before they take effect.