Privacy Policy

Information We Collect

Duly collects information you provide, information from public and third-party property sources, and technical information about your use of the service:

• Property addresses, search details, and generated research
• Account and contact information, including your name and email
• Saved properties, map places, bookmarks, tags, and preferences
• Shortlists, invitations and recipient emails, membership, notes, tasks, reminders, and uploaded attachments
• Account security information such as password hashes, passkey public credentials, and two-factor settings
• Assistant messages and answers, report feedback, and contact-form messages
• Report email recipients and any personal message you choose to send
• Usage and diagnostic data, including IP addresses, device and browser details, pages visited, and session identifiers

You can browse public tools and report previews without an account. Account details are needed for research and account-only features. Notes, attachments, feedback, and contact messages are optional. Only provide information you have the right to share, and avoid sensitive personal details in research requests or assistant messages.

How We Use Your Information

• Research properties, generate AI reports, and answer assistant questions
• Provide customer support and respond to enquiries
• Understand usage, diagnose failures, and improve the service
• Send account and report notifications, requested report emails, shortlist invitations, and notebook reminders
• Authenticate your account and protect access to account-only features
• Maintain your dashboard, saved properties, shortlists, and notebooks, including shared access you enable
• Store and scan uploaded attachments for malware before making them available for download

Data Security

We use account authentication, access controls, password hashing, and private attachment storage to protect account information. No online service can guarantee absolute security. Public property reports are not confidential documents. Duly never receives biometric data used by your device to approve a passkey.

Service Providers and Overseas Processing

We do not sell your personal information. We use hosting, storage, email, monitoring, analytics, property-data, web-research, and AI providers to operate Duly. Integrations include Synthetic for AI processing, Firecrawl for web research, Google Places for address lookup, and Google Analytics and PostHog for analytics when configured. Report context and assistant messages are sent to AI providers to generate answers. Analytics events may include searched addresses, account or session identifiers, assistant message content, and report-email recipient details.

Providers may process or store information outside New Zealand. We remain responsible for our obligations under the Privacy Act 2020, including safeguards required for overseas disclosures. We may also disclose information when required by law. This policy does not promise that every provider has identical retention or AI-training practices; contact us if you need details before submitting personal information.

Public Reports and Private Notebooks

Property reports are public, shareable web content and may be indexed by search engines. Guests can see previews; any verified Duly user can read full reports, not just the requester. Report links are not secret access tokens. If you email or redistribute a report, recipients receive the content you send, and Duly cannot recall their copies. Keep private information out of content intended for public reports.

Private bookmark notebooks are accessible to their owner. Shared shortlists, preferences, notebook entries, and attachments are accessible to current shortlist members. A public report link does not grant notebook access. These account-only areas are separate from public reports; browser analytics and session recording are disabled on bookmark, shortlist, and notebook pages.

Connected AI Apps

A verified Duly account is required to connect an AI app to our MCP server. You sign in with your existing account, choose which public tools the app can use, and approve the connection. You can change permissions or disconnect the app in connected-app settings. MCP connections do not grant access to property reports, private notebooks, attachments, or account changes.

We store the app identifier, callback address, approved permissions, and connection and last-use dates. For 30 days, we retain tool names, outcomes, duration, and timestamps linked to your connection and account to understand usage and diagnose failures. These usage records do not include tool arguments, results, or credentials. Deleting your account removes its MCP connections and usage records.

Browser analytics and session recording are disabled on consent and connected-app settings pages. Your AI app receives the public information returned by approved tools and handles it under its own privacy policy. Duly cannot delete copies retained by that app or its providers.

Cookies and Analytics

We use cookies and browser storage for sign-in, session security, and site operation. When configured, Google Analytics and PostHog collect usage events and may use cookies or browser storage. PostHog session recording may capture interactions on pages where it is enabled. You can manage cookies through your browser, but blocking essential cookies may prevent sign-in and account features from working. Browser cookie controls do not remove records already stored or stop all server-side event logging.

Retention and Account Deletion

We retain personal information for as long as needed to operate the service, resolve support issues, protect against abuse, and meet legal obligations. You can delete your account in profile settings. This removes your profile, bookmarks, private notebook entries, and shortlists you own, and disconnects your account from generated reports. Deleted notebook attachments are removed through background cleanup, not necessarily immediately.

Public property reports may remain available after account deletion. Contributions to a shortlist owned by someone else may remain for its members with your account attribution removed. Search, chat, diagnostic, email, and analytics records are not all automatically erased by account deletion. Contact us about personal information in retained records or public reports so we can assess a correction or deletion request.

Your Rights

Under the New Zealand Privacy Act 2020, you can:

• Request access to personal information we hold about you
• Request correction, or ask for a statement of correction to be attached if we do not make the change
• Raise a privacy complaint with us and, if unresolved, with the Office of the Privacy Commissioner

You can also request deletion, subject to applicable retention obligations, and manage report notifications and notebook reminders in the relevant feature. Essential account and security emails may still be needed to operate your account. We may verify your identity before acting on a personal-information request.

Contact Us

For privacy questions, access or correction requests, or complaints, email [email protected] or use our contact form. Duly operates online and has no physical office for visits. We may update this policy as the service changes; the date above identifies the latest revision.