Privacy Policy

Last updated

This Privacy Policy explains how Workduo Inc. ("TeamDuo", "we", "us") collects, uses, stores, and discloses personal data when you use our website at www.teamduo.ai and the TeamDuo application (together, the "Service").

1. Overview of the Policy

TeamDuo is a governed gateway between the data sources you connect and the AI agents you authorize. Queries run against your database. We do not copy, replicate, or warehouse the contents of your connected data sources. What we hold is the configuration you create — connection settings, your semantic layer, and your access rules — together with a log of the requests made through the gateway.

In short:

  • We collect the data you give us when you register, and technical data about how the Service is used.
  • We process it to run the Service, enforce the access rules you configure, and produce the audit history we make available to you.
  • We share it with service providers who help us operate, and with other members of your organization at your direction.
  • We apply technical and organizational safeguards, and store data in encrypted form.
  • We do not sell personal data, and we do not use your database contents or your queries to train models.
  • Retention varies by data type. You can ask us to delete your data.
  • The Service is not directed to children under 13.

2. Definitions

  • Account — the unique account created for you to access the Service.
  • Affiliate — an entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of 50% or more of the shares or voting securities.
  • Company ("we", "us", "our") — Workduo Inc., a Delaware corporation.
  • Connected Source — a database, repository, or other system you connect to the Service.
  • Cookies — small files placed on your device that record details of your browsing.
  • Device — any device that can access the Service, such as a computer or phone.
  • Personal Data — information relating to an identified or identifiable individual.
  • Semantic Layer — the metric definitions, descriptions, masking rules, and access policies you author in the Service.
  • Service Provider — a third party that processes data on our behalf.
  • Usage Data — data collected automatically by using the Service or its infrastructure.
  • You — the individual accessing the Service, or the entity on whose behalf they do so.

3. Collection of Personal Data

Data you provide

  • Account information — your name, work email address, and organization name. If you sign in with Google, we receive your name, email address, and profile picture from your Google account.
  • Connection credentials — the connection details for the sources you configure. These are encrypted at rest and used only to execute requests you or your authorized agents initiate.
  • Configuration content — your semantic layer, including metric definitions, table and column descriptions, masking rules, and access policies.
  • Payment information — billing details, handled by our third-party payment processor. We do not store full card numbers.
  • Communications — messages you send us for support, sales, or feedback, including demo requests.

Data collected automatically

  • Query audit records — for each request made through the gateway we record who made it, which agent, when, which resources were reached, and whether it was allowed or denied. These records exist so you can audit access; they are available to your organization's administrators.
  • Usage and device data — IP address, browser type and version, operating system, pages visited, time and date of visit, time spent, and similar diagnostic data.

Data we do not collect

  • We do not retain the rows returned by your queries beyond what is needed to serve the response to the requesting agent.
  • We do not collect data from columns you have masked or denied — those rules are enforced at query time.
  • We do not sell personal data, and we do not share it with data brokers.

4. Tracking Technologies and Cookies

We use cookies and similar technologies for a limited set of purposes:

  • Necessary / essential (session) — authentication and fraud prevention. Without these the Service cannot keep you signed in.
  • Policy acceptance (persistent) — records whether you have accepted our use of cookies.
  • Functionality (persistent) — remembers preferences such as your last-used workspace.

Our marketing website loads only what is required to serve the page. You can refuse cookies through your browser settings, though parts of the application may then not work. We do not use advertising cookies or third-party advertising pixels.

5. Use of Your Personal Data

We use personal data to:

  • provide, operate, and maintain the Service, and manage your account and registration;
  • authenticate users and enforce the access rules, masking, and row filters you configure;
  • produce the audit history we make available to you;
  • provide technical and customer support;
  • detect, prevent, and investigate security incidents, fraud, and abuse;
  • measure, debug, and improve the reliability and performance of the Service;
  • contact you about the Service, including security, availability, and change notices; and
  • comply with legal obligations and enforce our agreements.

Marketing email is opt-in and you can unsubscribe at any time. We process personal data only as necessary and proportionate to these purposes.

We do not use the contents of your connected sources, or the queries run against them, to train machine learning models.

6. Retention of Your Personal Data

We retain personal data only as long as necessary for the purposes set out in this policy. Usage data is generally kept for a shorter period, except where it is needed to strengthen security or improve functionality, or where we are legally obliged to keep it longer. Audit records are retained according to the retention period of your plan.

7. Transfer of Your Personal Data

We operate in the United States, and your data may be processed in the countries where we and our service providers operate. By using the Service you agree to that transfer. We take reasonable steps to ensure your data is treated securely, in line with this policy and with appropriate safeguards for transfers out of the EEA, the UK, and Switzerland, before any transfer takes place.

8. Disclosure of Your Personal Data

We may disclose personal data:

  • To service providers — hosting, cloud infrastructure, monitoring, email delivery, payment processing, and analytics, to the extent they need it to perform services for us.
  • To other members of your organization — at your direction, within your workspace. Administrators can see the audit history for their organization.
  • To affiliates — for administrative and IT purposes, under this policy.
  • In business transfers — in connection with a merger, acquisition, financing, or sale of assets, with notice before your data becomes subject to a different privacy policy.
  • For legal reasons — where required by law or a valid government request, to protect our rights or property, to investigate wrongdoing, to protect the safety of users or the public, or to defend against legal liability.

A current list of subprocessors is available on request at support@teamduo.ai.

9. Security of Your Personal Data

We apply physical, technical, and organizational controls designed to protect personal data against loss, misuse, and unauthorized access, disclosure, alteration, or destruction:

  • data is encrypted in transit with TLS and at rest with AES-256;
  • connection credentials are stored encrypted and are never displayed back to you in full;
  • access to connected sources is read-only by default, and write access requires explicit, scoped opt-in;
  • internal access to production systems is limited to those who need it, and is logged.

No method of transmission or storage is completely secure. While we use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. If you believe you have found a vulnerability, please contact support@teamduo.ai.

10. Children's Privacy

The Service is a business product and is not directed to anyone under 13, and we do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will remove it. Where consent is a legal basis for processing and local law requires parental consent, we require it.

11. Links to Other Websites

The Service contains links to sites we do not operate, and connects to third-party systems you choose. We have no control over, and accept no responsibility for, the content or privacy practices of those third parties. We encourage you to review their policies.

12. Aggregated and Analytical Data

We use industry-standard analytics tools to understand how the Service is used. Those tools operate under their own privacy policies and may set their own cookies. We may share aggregated or anonymized information — which cannot reasonably be used to identify you — with partners for business purposes.

13. Data Retention and Deletion

Different categories of data are retained for different periods, depending on the purpose of processing, our legitimate business interests, and our legal obligations. Contact details are retained until you ask us to delete them at support@teamduo.ai. Data that is no longer actively used may be retained where it is relevant to actual or anticipated legal proceedings. Aggregated, non-identifiable data may be retained indefinitely.

When you delete your account, we delete or anonymize your personal data and your configuration within 30 days, except where we are required to retain it by law or where copies persist in routine backups, which remain subject to confidentiality obligations and are deleted on their normal cycle.

14. TeamDuo Data & Security Policy

Data is stored in encrypted databases hosted on Amazon Web Services. Data is encrypted in transit with TLS and at rest with AES-256.

The Service uses Anthropic's API to draft documentation for your schema and to interpret requests. Only the specific data required for a given operation is sent — schema and semantic-layer content, not the contents of columns you have masked or denied. That data is not used to train models and is not retained on the provider's infrastructure for training purposes.

You choose which agents to connect. When you point an external agent — for example Claude, Cursor, or ChatGPT — at your TeamDuo endpoint, the data you have chosen to expose is handled by that agent's provider under its own terms and privacy policy. TeamDuo governs and logs what leaves your database; it does not control what a third-party agent does with a response.

15. Google API Usage Disclosure

TeamDuo's use of information received from Google APIs — including data obtained when you sign in with Google — adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use data obtained through Google Workspace APIs to develop, improve, or train generalized artificial intelligence or machine learning models.

16. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. Residents of the EEA, the UK, and Switzerland, and residents of certain U.S. states, have additional rights under local law. To exercise any of these, contact support@teamduo.ai. We will respond within the time required by applicable law, and we will not discriminate against you for making a request.

17. Changes to this Policy

We may update this policy from time to time. We will post the updated policy on this page and revise the "Last updated" date above. Where changes are material, we will give notice by email or a prominent notice in the Service before they take effect. We encourage you to review this page periodically.

18. Contact Us

If you have questions about this policy or how we handle your data, contact us: