Privacy Policy

Content saved through the sealed personal vault is encrypted with a two-part (split) key — one half on your device, one half on our network — so neither side alone can decrypt it. Supported chat paths use PromptShield to replace personal details before hosted processing. File extraction and connected services may process readable content; this protection does not cover every workflow. Voice features may send audio or text to speech providers. The provider and processing path depend on the feature you choose; see AI & third parties below. Account deletion reports local and server outcomes separately.

Account basics (email/identifier) to sign you in; customer contact details you provide (including name, phone, address or social handle) and order history for business workflows; the content you create (notes, tasks, messages, documents, business records) to provide the service; usage/diagnostic signals to keep it working. We do not sell your data, and we do not use your private content to train shared models without your explicit, revocable consent.

Sealed personal-vault content is encrypted at rest with the split-key scheme (HKDF → AES-GCM); the operator cannot derive the key from the network half alone. On supported hosted chat paths, PromptShield replaces personal details on your device before prompts leave; the real→placeholder map never leaves the device. On-device inference is available only where supported by your device and selected feature. Hosted inference and document extraction send content to server providers. Voice processing can use device speech services or cloud transcription; do not assume that a voice feature stays on-device. These protections do not establish a whole-app end-to-end encryption guarantee.

Private attachments use server authorization and expiring download links. Authorized service operators and storage providers can process their bytes; private storage is not end-to-end encryption. Removing access prevents new links, but an issued link can remain usable until expiry and downloaded copies cannot be recalled. Historical public uploads require a separate migration and provider revocation; they must not be assumed private.

If you connect Google Drive to attach scans to an order, DualFlow asks only for access to the files you choose in Google's picker (the drive.file permission) — not your whole Drive. Broader read-only folder search is off unless you separately turn it on for one folder you already chose. We read file names, folder names and basic details to show and suggest matches, and download only the files you assign. Each assigned file is stored as a private copy on that order, with a note of which Drive file and version it came from. Your Google sign-in tokens stay on our server and are never sent to your browser or phone. We do not read file contents to find matches, we do not use Drive data for advertising or to train AI models, and we do not share it except to provide this feature. Disconnecting Drive revokes our access with Google; copies you already attached stay on the order until you remove them. DualFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cloud AI features can share messages and selected content with OpenAI, Anthropic or Google, depending on the route. Document extraction can send uploaded documents or images to Base44 hosted extraction. Cloud transcription can send audio to OpenAI; voice generation can send text or voice samples to ElevenLabs. Cloud AI use is covered by the in-app AI disclosure and consent controls. Optional integrations, including TrueLayer banking and Stripe or App Store payments, process information under their own policies. Provider retention and processing depend on the service and configuration; we do not promise universal zero retention.

To request deletion, open Account Settings → Privacy & your data → Delete my account & data. Confirm the deletion in the app; deletion of server-synced account data requires an authenticated account. The app clears local app data and requests deletion of server-synced data; it reports whether the server confirmed completion. A local receipt does not by itself confirm deletion of server records, storage objects or provider copies. If server deletion is unconfirmed or you cannot access your account, contact support@dualflowai.co.uk. You can also find export and privacy controls in Account Settings.

Subscriptions use secure card payment. Tycoon Coin is earned via verified good work that runs off-device — never by mining on your device. Tycoon Coin is a non-tradable, in-app utility credit earned through verified useful work; it is not an investment and carries no profit promise.

DualFlow is intended for adults aged 18 and over. The onboarding flow asks for an 18+ self-attestation; we do not request a date of birth for that check.

For account access, product support or data requests, email support@dualflowai.co.uk. Describe the issue and the account email involved; do not send passwords or payment card details. We update this policy as the product evolves; material changes will be surfaced in-app.