Privacy Policy

Last updated: 28 August 2026

Controller

The data controller for personal data processed through duxloop is the entity named in the Imprint. This policy explains what we collect, why, and what rights you have over your data.

What we collect

We collect the account data you provide when you sign up, such as your name and email address, and the workspace content you and your team create (feedback posts, roadmap items, changelog entries, docs pages). For portal users, we collect the email address used to sign in via magic link and, where enabled, to receive notifications. We also collect basic usage logs (such as request timestamps and error logs) needed to operate and secure the Service, and billing information handled by Stripe — we do not store your card details ourselves.

Purposes & legal bases

We process account and workspace data to perform our contract with you (providing the Service you signed up for), and usage logs on the basis of our legitimate interest in keeping the Service secure and reliable. Where we send optional emails, such as product updates, we rely on your consent, which you can withdraw at any time.

Sub-processors

We use the following sub-processors to operate the Service:

• Netcup GmbH — application and database hosting, Nuremberg, Germany
• Stripe — payment processing and billing
• Brevo — transactional email delivery
• Anthropic — AI processing of text you submit to AI features
• Google Ireland Ltd — website analytics (Google Analytics 4 via Google Tag Manager), only with your consent
• GetTerms — cookie consent management on our website

Cookies & consent

duxloop uses a small number of strictly necessary cookies that are required to operate the Service — for example the session cookie that keeps you signed in, and the cookie that stores your consent choice. These do not require your consent.

Everything else is optional and is only activated with your consent. When you first visit our website, a consent banner (provided by our consent management tool GetTerms) asks for your choice, and your choice is stored so we do not have to ask on every page.

You can change or withdraw your consent at any time, with effect for the future: click Manage cookie preferences or the cookie icon shown in the corner of the page, and adjust your settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Legal basis for non-essential cookies and similar technologies: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Web analytics

With your consent, our website uses Google Analytics 4, loaded through Google Tag Manager. Both are services of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). We use them to understand how visitors find and use our website so we can improve it.

Before you consent, Google tags run in a cookie-less "consent mode": no analytics cookies are set and no identifiers are stored on your device. Only after you accept does Google Analytics set cookies (such as _ga) and collect usage data — for example pages visited, interactions, approximate location derived from a truncated IP address, and device and browser information — under a pseudonymous client ID.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw as described above. Where data is transferred to Google LLC in the USA, the transfer is covered by the EU-US Data Privacy Framework, for which Google LLC is certified. Analytics data linked to cookies and client IDs is retained for 14 months and then deleted automatically.

Retention

We retain your account and workspace data for as long as your account exists. When an account or workspace is terminated, we delete the associated data within 30 days, except where we are required to retain records for longer (for example, billing records for tax purposes).

Your rights

Depending on your location, you may have the right to access, correct, delete or export your personal data, and to object to certain processing. To exercise any of these rights, contact us using the details below. You also have the right to lodge a complaint with a data protection supervisory authority.

Portal users

If you interact with a duxloop-powered feedback portal, your data is processed by duxloop on behalf of the workspace owner who operates that portal. For questions about how your data is used, please contact the workspace owner directly; they are the responsible party for that portal.

Contact

For privacy questions or to exercise your rights, email Show email address.