Privacy Policy

Last updated: 14 July 2026

1. Who we are

DuWorks ("we", "us") operates a suite of business tools including DuChat, run by Aoomle Technologies Limited (RC 9560530), Plot 12A, Wills Court Estate, Abuja, FCT, Nigeria. Contact: support@duworks.xyz.

2. What this covers

How we handle data for customers (companies using DuWorks) and visitors (people who chat through a customer's widget). For visitor data, the customer is the controller and DuWorks is the processor.

3. Data we process

• Account data: name, email, password hash, workspace details.
• Conversation data: chat messages, attachments, optional visitor name/email, and approximate location (city/country) and browser/device type. The visitor's IP address is processed transiently — including via a geolocation service provider — to derive this, but is not stored in our database; infrastructure providers may process IPs in short-lived service logs. Chat messages are free-form: we do not ask for sensitive personal data, but people may include it in what they write, and it is protected like all conversation data.
• Usage data: conversation counts and feature usage for billing and limits.

4. How we use it

To provide the service, route and store conversations, generate optional AI summaries, send transactional email, enforce plan limits, and secure the service. We do not sell personal data. Our lawful bases under the NDPA: performance of a contract (providing the service you signed up for), legitimate interests (security, abuse prevention, service improvement), legal obligation (accounting and tax records), and consent where we ask for it. We share personal data only with the service providers that run DuWorks — cloud and database hosting, content delivery and file storage, payment processing, email delivery, and IP geolocation — under their data-protection terms.

5. Retention & deletion

Conversation data is retained while the workspace is active and deleted within 60 days of workspace termination. Customers can delete a visitor's data from the agent console at any time, and may request deletion or export by contacting us. Billing records are kept for 6 years (statutory accounting requirement); security and audit logs for up to 12 months. Deleted data also ages out of our infrastructure providers' backups on their standard backup cycles.

6. Cookies

We do not use advertising or analytics cookies. The service uses only strictly necessary storage: login sessions for signed-in users, and local browser storage in the chat widget (an anonymous conversation identifier and your sound preference).

7. Security

Data is encrypted in transit (TLS). Access is tenant-isolated, and sensitive operations require authentication. No method is 100% secure, but we work to protect your data.

8. International transfers

Our infrastructure providers are located in the United States (and Ireland for email delivery), and personal data is stored with them under contractual data-protection safeguards, encrypted in transit and at rest.

9. Your rights

Under the Nigeria Data Protection Act 2023 (and, where it applies, the GDPR), you have rights to access, correct, export, or delete your data, to object to or restrict processing, and to withdraw consent. Contact our Data Protection Officer, Abdulmalik Muhammad, at support@duworks.xyz. You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC).

10. Children

DuWorks is a business tool and is not directed at children. If you believe a child's personal data has been submitted through the service, contact us and we will delete it.

11. Changes

We may update this policy; material changes will be posted here with a new date.