Privacy Policy

1. Introduction

Ducted ("we", "us", "our") operates https://ducted.app. This Privacy Policy explains how we collect, use, and protect your personal data when you use our services, which include a self-serve feed management platform and professional scraper setup and maintenance services.

2. Data we collect

• Account data - name, email address, phone number (if provided for verification), and password (hashed).
• Billing and business data - company name, VAT number, billing address, and payment information processed by Stripe. We do not store card numbers.
• Usage data - pages visited, features used, feed configurations, and scraper job settings.
• Service request data - if you submit a scraper setup request, we collect the details you provide (source URLs, desired fields, output format).
• Scraped data - when we build and run a scraper on your behalf, the extracted product data is stored in your account and processed solely to provide the service.
• Free feed validator - feeds submitted to the public validator (URL or file) are parsed in memory and deleted within 15 minutes; the short window exists only so you can re-check the same feed against another platform. When a feed URL refuses our primary server, we may retry the fetch once through our own US relay server; the same processing and deletion rules apply. We never store the feed content, its records, or the full feed URL. We keep an anonymous summary of each run (issue types found, platform chosen, record count, the feed URL's domain) for up to 180 days, plus a salted, daily-rotating hash of your IP address used solely to count unique visitors and prevent abuse - it cannot identify you across days. The validator form is protected by Google reCAPTCHA, which may set its own cookies subject to Google's privacy policy.

3. How we use your data

• To provide, operate, and improve our services.
• To send transactional emails (account verification, password reset, invoice delivery, service notifications).
• To send SMS messages for account verification and two-factor authentication only. Your phone number is never used for marketing.
• To process payments and issue invoices.
• To comply with legal obligations.

4. Legal basis (GDPR)

For users in the European Economic Area, we process your data under the following legal bases:

• Contract performance - to provide the service you signed up for.
• Legitimate interests - service security, fraud prevention, product improvement.
• Legal obligation - compliance with applicable laws.
• Consent - where you have given explicit consent (e.g. marketing emails).

5. Data retention

We retain your account data for as long as your account is active. Upon account deletion, personal data is removed within 30 days. Anonymised aggregate statistics may be retained indefinitely.

6. Sharing your data

We do not sell your personal data. We share data only with trusted sub-processors necessary to deliver our service:

• Stripe - payment processing
• Twilio - SMS verification and 2FA
• Email delivery provider - transactional emails

All processors are bound by data processing agreements.

7. Cookies & Analytics

We use one cookie:

• Session cookie (necessary) - keeps you logged in during your session. This cookie is strictly necessary for the service to function and does not require consent.

We use PostHog for product analytics in cookieless mode (memory-only persistence, no IP collection). No analytics cookies are set. No advertising or third-party marketing cookies are used.

8. Your rights (GDPR)

You have the right to: access, rectify, erase, restrict, or port your personal data; withdraw consent at any time; and lodge a complaint with your local supervisory authority. To exercise these rights, contact us at admin@ducted.app.

9. Contact

Ducted
Bulgaria, Varna 9000, Hristina Hranova 11
admin@ducted.app
DPO: admin@ducted.app