Privacy policy
This policy describes how Dubinga handles personal data. It is written for the product as it exists today and is updated when the product changes, not once a year.
Who we are
Dubinga is a multi-tenant marketing platform operated by the Dubinga team. For data you put into your workspace we act as a processor on your instructions; for your own account and billing details we act as a controller.
What we collect
Account data (name, email, organization and role), workspace content (brand knowledge, campaigns, discussion transcripts, approvals), platform connection metadata and tokens, billing identifiers from our payment processor, and server logs needed to operate and secure the service.
Why we process it
To run the service you asked for, to bill you, to keep the platform secure and available, and to comply with law. We do not sell personal data, and we do not use your workspace content to train models.
How tenants are separated
Tenant data is separated inside PostgreSQL by row-level security, enforced by the database itself rather than by application code remembering to filter. Access within your workspace follows the member roles you set.
AI model providers
Discussion content is sent to the model provider that runs your agents. If you store your own provider key, requests go to your own provider account and we never see the content of that exchange beyond what your workspace records. Provider choice and key storage are visible in your settings.
Subprocessors
We use a small set of subprocessors: cloud hosting and managed PostgreSQL, transactional email delivery, a payment processor, and the AI model provider you select. The current list, with purposes and regions, is available on request and before any material change.
How long we keep it
Workspace content lives as long as your workspace does. Deleting a workspace deletes its content, with backups ageing out on their own rotation shortly afterwards. Billing records are kept as long as tax law requires.
Your rights
You can request access, correction, export, deletion or restriction of your personal data, and object to processing. Most of it you can do yourself in settings; for the rest, write to us and we will respond within one month.
International transfers
The service runs in a single region today. Where a subprocessor moves data outside your region, the transfer relies on standard contractual clauses or an equivalent lawful mechanism.
Security
Encryption in transit, encryption at rest for secrets such as provider keys, least-privilege database roles, and an approval audit trail that cannot be edited after the fact. We are not SOC 2 certified today; Type II is planned and we will say so here when it is done, not before.
Contact
Privacy questions: privacy@dubinga.com. Everything else: hello@dubinga.com. We answer data-subject requests within one month.
This page is written to be read, not to be survived. If anything here is ambiguous, ask us and we will fix the wording.