Privacy Policy

DutyDocs ("we", "us", "our") is operated by Chris Smith, trading as DutyDocs, a UK-based sole trader business, who is the data controller for the personal data described in this policy. This policy explains how we collect, use, and protect your personal data when you use the DutyDocs app and website (dutydocsapp.com). For any questions about this policy or your data, contact us at hello@dutydocsapp.com.

Account information — name, email address, and password (stored as a secure hash).

Records you create — risk assessments, incident reports, training records, and similar compliance records you enter into the app.

Technical data — IP address, browser type, and device information, collected automatically for security and performance.

Payment information — if you upgrade to a paid plan, payment is processed by Stripe. We do not store your card details ourselves.

We use your data to provide and maintain your account and the records you create, send essential account emails (signup confirmation, password resets), improve the app, and meet legal obligations where applicable. We do not sell your data to third parties, and we do not use it for advertising.

Records you create may include personal data about people in your organisation — for example, the name of a person involved in an incident or holding a training certificate. For that data, you are the data controller and we act as your data processor: we store and process it only on your instructions and never use it for our own purposes. You are responsible for having a lawful basis to record it.

Contract — to provide the service you've signed up for.

Legitimate interest — to maintain, secure, and improve the app.

Consent — for optional communications, where applicable.

Cloud-synced data is stored using Supabase, a secure cloud database provider, encrypted in transit and at rest. On the Free plan, your records are stored locally on your own device and do not leave it — which also means we cannot recover them if your device is lost or its storage is cleared. We take reasonable technical measures to protect your data, but no online service can guarantee absolute security.

We retain your account and record data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required to retain it by law (for example, invoicing records for tax purposes).

Under UK GDPR, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion of your data, request a copy of your data in a portable format, and object to certain types of processing. To exercise any of these rights, email hello@dutydocsapp.com and we will respond within one month.

We use the following third-party services, which may process your data under their own privacy policies: Supabase (database and authentication), Stripe (payment processing, paid plans only), and Vercel (hosting). We will disclose data if the law requires it. There are no other recipients.

DutyDocs uses only what is essential for login sessions to function and to store your records for offline use. We do not use tracking or advertising cookies.

DutyDocs is intended for business use by adults. It is not directed at, and we do not knowingly collect data from, children.

We may update this policy from time to time. Material changes will be reflected on this page with an updated "last updated" date, and we will notify you of significant changes by email or in the app. Questions or data requests: hello@dutydocsapp.com.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.