Privacy Policy

Effective Date:July 15, 2026

This Privacy Policy explains how Duplocate Inc. (“we”, “us”, “our”) handles information submitted through our duplicate payment detection platform. The Service is designed around strict data minimization and secure temporary processing. This Privacy Policy should be read together with our Terms of Service and the Data Processing Addendum (DPA) incorporated into them, which govern your use of the Service and our handling of Personal Data; in the event of a conflict regarding Uploaded Data or Personal Data we process on your behalf, the Terms of Service and DPA control.

1. Information We Collect

When you use Duplocate, you may upload an accounts payable (AP) register or similar financial dataset (“Uploaded Data”). We process this data solely to identify potential duplicate payments and generate a report. Uploaded Data may contain Personal Data — for example, vendor or employee names, email addresses, or other identifying details embedded in an AP register. We do not require you to include Personal Data in Uploaded Data, and we process any such data only on your behalf as a Data Processor, in accordance with the Data Processing Addendum (DPA) incorporated into our Terms of Service.

Duplocate is built to operate with:

• No user accounts or logins
• No API keys or persistent identifiers

Contact Information: To provide the Service, we collect limited personal information that you give us directly — specifically your name and email address — so that we can deliver your Report and secure download link and communicate with you about your use of the Service. Apart from this contact information and any Personal Data contained in Uploaded Data, we do not intentionally collect information that identifies you or your company.

2. How We Use Your Data

Uploaded Data is processed in secure, temporary environments to:

• Analyze the file for potential duplicate payments
• Generate a downloadable report

We may retain only fully anonymized, aggregated patterns and heuristics (such as invoice number structures or string similarity fingerprints) to improve our detection algorithms. These patterns cannot be used to identify any user, company, vendor, or transaction.

We use the contact information you provide (your name and email address) to deliver your Report and secure download link, respond to your inquiries and provide support, protect the security and integrity of the Service and prevent misuse, and administer and enforce our Terms of Service, and as otherwise required to comply with applicable law. We process Uploaded Data solely as necessary to provide the Service and for the limited service-improvement purposes described in our Terms of Service, consistent with the license you grant us under those Terms.

3. Data Retention and Deletion

• Uploaded Data: processed using secure temporary file handling and permanently deleted immediately after processing.
• Reports: available for download for up to 15 minutes, then automatically and permanently deleted.
• Anonymized Patterns: may be retained indefinitely, but contain no original data or personally identifiable information.
• Contact Information: retained for as long as necessary to administer and enforce our rights and obligations under the Terms of Service, including delivering Reports and secure download links, responding to and resolving your inquiries and support requests, maintaining the security and integrity of the Service and detecting, preventing, or investigating misuse, and complying with our legal, tax, audit, and recordkeeping obligations. Once no longer required for these purposes, contact information is securely deleted or de-identified.

4. Data Sharing

We do not sell, share, or use your Uploaded Data for benchmarking, marketing, or any third‑party purpose. If we ever engage sub‑processors, they will be bound by data protection obligations no less protective than those described here.

5. Security

We use industry‑standard security measures, including:

• TLS 1.2+ encryption for uploads and downloads
• Secure temporary file handling
• Access controls and automated deletion processes

Contact information and any other personal information we hold are stored and safeguarded in accordance with this Privacy Policy and the DPA. Duplocate minimizes exposure to Uploaded Data by keeping it encrypted in transit, ephemeral, and auto-deleted.

6. Your Rights

Subject to applicable privacy and data protection laws (including, in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation), you may have the right to access, correct, or update the personal information we hold about you; to request its deletion; to withdraw your consent to our processing; and to lodge a complaint with the applicable privacy or data protection regulator. To exercise any of these rights, contact us using the details in Section 9, and we will respond within the timeframes and to the extent required by applicable law. Because we process Uploaded Data solely as a Data Processor on your behalf, requests from individuals relating to Personal Data contained in Uploaded Data should be directed to you as the Data Controller, and we will assist you in responding as described in the DPA.

7. Children’s Privacy

The Service is not intended for individuals under 18 years of age.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

9. Contact

If you have any questions about this Privacy Policy or our data practices, please contact:

Email: privacy@duplocate.com