Privacy policy

Who is responsible

DueHub, operated by Lean Mobility LLC is the controller of your account data. For the content of the files you upload, we act on behalf of your organization: we process it only to provide the service to you. You can write to us at support@duehub.app.

What data we process

• Account data: your email, your password (stored only as an Argon2id hash, never in readable form), the organization you belong to, your role and your email verification status.
• Billing and support: contact and billing details you provide, customer, transaction and subscription references, plan, currency, amounts, taxes, payment status, support inquiries and replies. We do not receive or store your full card number or security code.
• Content you upload: the files for sources A and B, the column and rule settings, the results of each reconciliation, review decisions and the templates you save.
• Minimal technical data: internal identifiers and audit records that do not include the content of your files. For security and usage limits we keep a cryptographic fingerprint of the IP address (HMAC), not a reversible version of the full address. Network providers receive the IP needed to deliver the connection.

What we use it for

• Providing the service: preparing your files, reconciling them, showing you the results and letting you review and download them.
• Security: keeping your session, protecting forms, preventing abuse and applying your plan's limits.
• Service communications: email verification, password recovery, invitations, account notices and support.
• Commercial administration: fulfilling purchases, managing subscriptions, preventing fraud, handling refunds and maintaining applicable accounting and tax records.

We do not sell your data or use the content of your files for advertising.

Who can access it

Your uploads, reconciliations, templates and results are only accessed within your session's active organization, according to each member's role.

Authorized team access is limited by function: support may consult your messages and technical context; administration may consult necessary billing data. Reconciliation files are not automatically attached to chat or accounting records. Additional content is accessed only as necessary to resolve an authorized request or meet a legal obligation.

Providers and international transfers

Service infrastructure uses DigitalOcean for hosting, Cloudflare R2 for storage and backups, and Resend for email. They may process data in the United States and other countries depending on the service used. We do not promise exclusive residency in a particular country; specific location requirements or processing agreements must be agreed before uploading data.

When you buy through Paddle, the Paddle entity identified at checkout is the seller of the transaction and processes payment, billing, tax and fraud prevention data under its own policy. DueHub receives references and status information needed to provide and administer the service; it does not receive your full card details.

• Paddle privacy policy

Basis and purpose of processing

We process data to perform the requested service, protect its security, answer inquiries and meet legal obligations. Where required by law, additional processing is based on your consent. Transfers and rights are handled under applicable law and relevant processing agreements; you can request information at support@duehub.app.

Assistants and customer support

When you use Claude, ChatGPT or another assistant, its provider also processes the data you share there under its own terms. The reconciliation engine does not need to send your files to a language model to compare the sources.

DueHub Chat retains the messages you send to continue support. An assistant may prepare drafts using public information and the current inquiry; replies in that channel require team review. Local models or API providers, including DeepSeek when enabled, may be used. These providers may process the inquiry outside your country. Do not send passwords, card details or complete files through support when unnecessary; conversation separation does not give chat unrestricted access to another organization's data.

How long we keep data

Uploaded files and results are deleted automatically according to your organization's plan:

Deleting your organization

The owner can delete the organization from Settings (or ask us at support@duehub.app). The request can be cancelled within the next 24 hours; after that, the organization's files, results, runs, templates, invitations, memberships and sessions are deleted.

As deletion evidence we keep an anonymous record for seven years (dates and counts by category), with no personal or financial data and none of your files' content. Your user account is separate from the organization, and you can ask us to delete it the same way.

Billing, support and backups

File and result retention periods do not determine how long invoices, payments, support incidents or security evidence are kept. Those records are retained separately for their purpose and applicable obligations. Backups have their own retention cycle and are not erased immediately when an account is deleted. They are restricted to recovery and deletion requests must be reapplied after restoration. You can ask about the scope of deletion at support@duehub.app.

Cookies

We only use the cookies the service needs to work: the session cookie, the form protection cookie (CSRF), the one that remembers the language you chose and, when you create an account, one that expires in 24 hours and signs you in when you verify your email in the same browser. The light or dark theme is stored in your browser. The DueHub Match website does not install advertising cookies. When you open checkout, Paddle may use technologies needed for payments and fraud prevention under its own policy.

Security

Communication is encrypted in transit (TLS). Passwords are stored with Argon2id, and session, verification and recovery tokens only as HMAC. Each organization is isolated from the others. No system is infallible: if we detect an incident that affects your data, we will notify you as the law requires.

Your rights

You can request access to, correction, export or deletion of your data, or object to its processing, by writing to support@duehub.app. The results of each reconciliation can also be downloaded as Excel or CSV from the app. We will respond within the time limits set by applicable law.

Changes to this policy

If we change this policy, we will update the effective date and, if the change is significant, we will let you know by email or in the app before it takes effect.