Privacy Policy
Last updated
This policy explains how Numbers Ventures Limited (“Du3”, “we”) handles personal data when you use usedu3.com, the Du3 apps, company sites on *.usedu3.com and the Du3y app for Slack and Discord.
Two roles
- For our customers’ invoice data — invoices, clients, contractors, custom field answers, uploaded files — the customer company decides what is collected and why. The customer is the controller and Du3 is the processor. Our Data processing agreement covers this. If you’re a contractor or client with questions about that data, contact the company you deal with first; we’ll help them respond.
- For our own account, billing and website data, Du3 is the controller, and this policy applies directly.
What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email, profile picture, sign-in method | You, or Slack, Google or Apple sign-in |
| Company details | Company name, web address, logo, default currency, billing country | The owner |
| Slack workspace data | Workspace and user IDs, member names and pictures, channel names, user groups | Slack, when you connect Du3 |
| Discord server data | Server, channel and user IDs, channel names | Discord, when you connect Du3 |
| Invoice data | Invoices, line items, amounts, due dates, notes, activity history | You and your team |
| Client and contractor details | Name, email, company, phone, address, tax ID, bank details | You, or the contractor through a link |
| Files | Invoice PDFs and attachments | You or contractors |
| Billing data | Plan, receipts, the last 4 digits and brand of your card | Paystack (we never see full card numbers) |
| In-app purchases | Plan, purchase and renewal status (no card details) | Apple App Store or Google Play, through RevenueCat |
| Du3y messages | What you ask Du3y in Slack or Discord | You |
| Technical data | IP address, device and browser, rough location from IP, logs | Your device |
| Usage data | Which pages and screens you open and which features you use (for example “invoice sent” or “plan bought”), tied to your user ID and your company’s ID | Your device and our servers |
Why we use it
- To provide Du3 — run your account, post alerts in Slack or Discord, send invoice emails, host submission forms and branded sites. (Contract)
- To bill you — take payments and set your price by country. (Contract; legal obligation for tax records)
- To keep Du3 safe — prevent fraud, spam and abuse, scan uploaded files, check branded sites, and keep audit logs. (Legitimate interests; legal obligation)
- To improve Du3 — understand which features are used and where people get stuck. We keep our own records and use PostHog, a product analytics service. PostHog only gets your user ID and your company’s ID, never your name, email, invoice contents, client details or what you write to Du3y; amounts are sent only as rough ranges (for example “250–1k”). On usedu3.com and our docs, we also use Google Analytics to see how visitors find and use the site. We don’t use advertising tools. (Legitimate interests)
- To talk to you — service emails, and product news if you agree. You can unsubscribe from news at any time. (Contract; consent)
We don’t sell personal data, and we don’t use your invoice data to advertise.
Sensitive financial details
Bank details, tax IDs and Slack tokens are encrypted when stored. They are only shown to people with access to the invoice or profile, and are never sent to AI models.
Du3y and AI
When you ask Du3y something in plain words, we send the minimum needed to answer — your request and the relevant invoice summaries — to OpenRouter, which passes it to the AI model. We don’t include the bank details or tax IDs stored in Du3, but anything you type to Du3y is sent as you wrote it, so don’t type bank details in a chat. We have turned off OpenRouter’s data sharing, so neither OpenRouter nor the AI model’s maker may keep your requests or use them to train their models.
Who we share data with
We use trusted service providers (“sub-processors”) to run Du3. They may only use your data to provide their service to us.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Database and file storage | Ireland (database), United States (files) |
| Slack | The Du3y app and alerts in your workspace | USA / global |
| Discord, Inc. | The Du3y app and alerts in your Discord server | USA / global |
| Cloudflare, Inc. | Carries traffic to our websites and apps, and the private connection to our database | United States / global |
| Paystack | Subscription payments in Nigeria | Nigeria |
| RevenueCat, Inc. | Checks plans bought in the Du3 app through the App Store or Google Play | United States |
| OpenRouter, Inc. | Passes Du3y’s plain-English requests to the AI model | United States |
| Resend, Inc. | Sign-in, verification code, invoice and notice emails | United States |
| Google LLC | Google Analytics on usedu3.com and our docs (visits, pages viewed, device and rough location; not the Du3 app) | United States |
| PostHog, Inc. | Product analytics on our websites, the Du3 apps and Du3y (pages and features used, user and company IDs, device, app version and rough location; no names, emails or invoice contents) | United States |
If you buy a plan in the Du3 app, Apple or Google takes the payment under their own privacy policies, and we only receive what you bought and whether it is active.
The current list lives in our Data processing agreement. We may also share data if the law requires it, or with a buyer if Du3 is sold (we’ll tell you first).
International transfers
Du3 is run from Nigeria. Your data is stored with Amazon Web Services in Ireland and the United States, and some of the providers above are based in the United States. So your data may be handled outside the country you live in. When that happens, we only use providers that protect it to the standard the law asks for, for example through the standard contractual clauses in their data protection terms.
How long we keep data
- Account and invoice data: while your company has a Du3 account.
- Deleted invoices: can be restored for 30 days, then permanently deleted with their files.
- When a company is deleted: kept for 90 days, then permanently deleted with all its invoices, contacts and files.
- When you delete your account: your sign-in details are deleted straight away, and we ask PostHog to delete the usage data tied to your user ID.
- Billing records: up to 7 years, as tax law requires.
- Security logs and usage statistics: up to 12 months.
Your rights
Depending on where you live (for example under the Nigeria Data Protection Act 2023, the UK GDPR or the EU GDPR), you can ask to see, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent. Email [email protected]. If your data is part of a customer’s invoices, we’ll pass your request to them. You can also complain to your data protection authority, such as the Nigeria Data Protection Commission.
Cookies
The Du3 app uses essential cookies to keep you signed in. The Du3 app and docs also remember a few choices in your browser, such as your light or dark theme and the company you last opened. These don’t need your consent.
Analytics cookies are only set if you choose Accept in the cookie banner. Your choice is saved in a du3_consent cookie and applies to usedu3.com, our docs and the Du3 web app.
| Cookie | Set by | Where | What for |
|---|---|---|---|
_ga, _ga_* |
Google Analytics | usedu3.com and docs | Count visits and see which pages are read |
ph_* |
PostHog | usedu3.com, docs and the Du3 web app | Recognise a returning browser so we can see how Du3 is used |
If you choose Decline, or haven’t chosen yet, neither sets cookies: Google Analytics only receives cookieless signals, and PostHog keeps its ID in memory for that page visit only. To change your choice, use Cookie settings at the bottom of usedu3.com or the docs; choosing Decline also removes analytics cookies already set. The Du3 mobile apps don’t use cookies; they send the same usage data to PostHog with an ID kept on your device. Company sites on *.usedu3.com (submission forms and hosted invoices) never set analytics cookies. None of these are advertising cookies.
Children
Du3 is for businesses and is not meant for anyone under 18.
Changes
We’ll update this page when things change and tell account owners about significant changes.
Contact
Privacy questions: [email protected].