Privacy policy

This policy explains what data DueChase collects and how we use it. DueChase is an early pilot product run by a very small team, and this policy describes what the product does today, not what we hope it will do later.

Who we are

DueChase is operated by [LEGAL ENTITY NAME: not yet filled in]. Our postal address is [POSTAL ADDRESS: not yet filled in]. You can reach us at [email protected]. Every request in this policy goes to that address.

What we collect and why

Website visitors and the waitlist

You can read the public pages without giving us anything. If you join the waitlist, we store:

• your email address, in lower case
• your practice or business name, if you enter one
• the accounting software you chose (Xero, QuickBooks Online or other), if you chose one
• the time you signed up
• a salted hash of your IP address

We do not store your raw IP address. We keep the hash to spot abuse, such as one network submitting the form many times. We use the other details to write to you when pilot places open and to understand which software practices use. The form also has a hidden field that real visitors never fill in. Submissions that fill it are discarded.

To limit abuse, the server temporarily counts sign-in attempts and waitlist submissions by IP address in memory. These counts are not written to the database and are lost when the server restarts.

Practices using the product

If you are a bookkeeper or accountant in the pilot, we store the information needed to run your account. That includes the clients you add (client name, the sender name used in reminders, an optional reply-to address and your sequence settings), the reminders created for them, and an activity log of what happened, such as imports, approvals, sends and failures. Each person who signs in has an account with their name, email address, role and a salted hash of their password, and we record when they last signed in. We keep an audit log of who did what in the app, such as approvals, imports and changes to settings, with the time and a salted hash of the IP address. The log does not store message text or passwords. We also record delivery results from our email and SMS providers, such as delivered, bounced or complained, and STOP replies to texts, and we use them to avoid contacting the same address again.

If you email us, we keep the correspondence so we can answer you and support the pilot.

Your customers' data that we process for you

To send reminders, you give us data about the people and businesses that owe your clients money. Today that is imported from CSV files. It can include a customer's name, email address and phone number, invoice numbers, amounts due, currency, issue and due dates, whether the invoice is open, paid or void, and a payment link. For each reminder we also store the message text, the recipient address or number, the status, the time, the provider's message ID and any error returned.

For this data, DueChase acts on the practice's instructions. We use it to plan, show, send and record reminders and for nothing else. The practice decides what to upload, who to contact and what to say. The practice is responsible for having a lawful basis and any permission it needs to contact its customers, as set out in our terms. If you are a customer who received a reminder, please contact the practice that sent it first. You can also write to us and we will pass your request on or act on it as the practice directs.

Who we share data with

We do not sell personal data. We use these services to run DueChase, and each receives only what its job needs.

• Fly.io hosts the application and stores the database on a volume attached to our server. The data sits in the Fly region we choose at deployment.
• Resend delivers reminder emails. It receives the recipient address, the sender and reply-to details, and the message content.
• Twilio delivers reminder SMS messages once SMS is switched on. It would receive the recipient phone number and the message content. SMS is not enabled yet.
• Cloudflare runs our domain's DNS. Microsoft 365 hosts our email, so messages you send to our contact address are stored there.
• GitHub holds our source code and runs the scheduled job that triggers reminder runs. It does not receive customer data.
• Xero, only when a practice connects its Xero account. The connection is not available yet. When it is, we will read invoice and contact data from Xero with the practice's authorisation, and this policy will be updated.

A Stripe connection exists in the code but has only been tested against a mock service. We do not use it with real accounts. If that changes, we will name it here.

We may also disclose data if the law requires it, or to protect our rights, our users or other people. If the business is ever sold or merged, the data could move to the new owner.

Xero data and AI

We do not use data obtained from Xero to train artificial intelligence or machine learning models, and Xero's developer terms do not allow it. We do not send customer data to AI models to write or improve reminders. Reminder messages are built from fixed templates.

Cookies

We set one cookie, and only when you sign in to the app. It is called duechase_session. It is a signed token with an expiry time, it holds an internal account number and the expiry time, not your name or email address, and it expires after 14 days. It is HttpOnly and SameSite=Lax, and it is marked Secure in production. It keeps you signed in.

We do not use analytics, advertising or tracking cookies, and the site does not load third-party scripts for them. Visitors who do not sign in receive no cookies from us.

What we log

The server writes short log lines when something fails, such as a failed waitlist signup, health check or scheduler run. Our host may also keep standard request logs. On the live service, nothing is sent or recorded as sent until real email or SMS is configured. A test mode can be switched on that records reminders as sent without delivering them. In that mode the server log gets one line per reminder with the channel, the domain of the email address or the last two digits of the phone number, and the length of the message. It does not log the full address, the number or the message text.

Security

We have taken some basic steps. We cannot promise that data will never be lost or accessed without permission.

• The site is served over HTTPS, and plain HTTP requests are redirected to HTTPS.
• App pages and actions require sign-in. Passwords are stored as salted scrypt hashes, and the sign-in form limits attempts to 5 per 15 minutes per IP address and 10 per email address.
• Practice administrators can deactivate an account, which ends its sessions.
• The session cookie is signed, so it cannot be altered without detection.
• The waitlist form is rate limited, and we store only a hash of the IP address.
• Reminders wait for a person at the practice to approve them unless the practice turns on auto-send for a client.
• Access to the scheduler endpoint needs a secret.

We do not currently make any statement about encryption of stored data. The database is a file on a hosting volume. Backup copies of it may exist, including volume snapshots taken by our host and copies we take ourselves. The audit log lives in the same database file, so it is not tamper-proof.

How long we keep data

We do not have a fixed retention schedule yet. We keep data while the pilot runs and while it is useful for the purpose it was collected for. We delete data when you ask us to. Backup copies are not deleted at the same moment, and they may keep a deleted record until they are overwritten or removed. We will update this section when we set retention periods.

Your choices and rights

There is no self-service export or deletion in the product yet. To see, correct, export or delete data we hold about you, or to be removed from the waitlist, email [email protected]. We will do it by hand. We may need to confirm who you are first. If the data is customer data we process for a practice, we may need to involve the practice.

The rights you have depend on where you live, and some places give you more than this policy describes. We do not claim compliance with any particular privacy law here. If you think we have handled your data wrongly, tell us and we will look into it. You may also have the right to complain to a data protection authority in your area.

Children

DueChase is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children. If you think a child has given us data, email us and we will delete it.

Changes to this policy

We will change this policy as the product changes, for example when we add a Xero connection, turn on SMS or set retention periods. The date at the top shows when it last changed. For a significant change we will try to tell pilot practices by email.

Contact

Email [email protected]. Postal address: [POSTAL ADDRESS: not yet filled in].