Privacy policy

Who we are

Duvet Pro is operated by DUVET LIMITED, company 15010518, registered in England and Wales. We are responsible for personal information used to administer this trial. Contact contact@duvet.house about privacy or account removal.

What we collect

We process login email addresses, account identifiers, authentication sessions, workspace memberships and invitations. You provide these directly, or a colleague supplies your email and role when inviting you. We also receive enquiries you send us and technical records such as IP addresses, requested pages, timestamps and errors needed to run and secure the website.

Shared workspaces save organisation names, imported spreadsheet rows, reviewed mappings, groups, jobs and dated changes. Workspace members can see information permitted by their role. The current trial accepts demonstration housing data only; do not upload real resident or confidential customer records.

Why we use it

We rely on our legitimate interests in providing requested trial access, administering workspaces, answering enquiries and protecting the service against misuse. Account information is needed to sign in and control access. We may also retain information required to meet legal obligations. We do not use this trial for advertising or sell personal information.

Optional product analytics

When configured and you accept analytics, PostHog collects pseudonymous page views and workflow usage. Page paths use templates; no organisation IDs, home references, imported rows, authentication tokens, form contents or search text are sent. Session replay and person profiles are disabled. The default ingestion region is EU.

For supplied demo accounts, optional analytics links successful sign-ins, sign-outs and subsequent usage to the account's reviewer code. Rejected sign-ins are recorded without the submitted email or password. This lets us understand which trial accounts have been used and their last recorded activity; it does not show whether someone is currently online. Essential authentication audit records are kept separately by Supabase, including when optional analytics is declined.

You can withdraw analytics permission through cookie settings. Essential authentication and workspace storage continue to work when analytics is declined.

Optional AI assistance

With your consent, the spreadsheet importer sends selected worksheet names and column headers to OpenAI for mapping suggestions. It does not send workbook data rows or the filename. Names and headers can themselves contain personal information, so check them first. Manual review remains available; untick the permission to stop future AI requests. Withdrawal does not undo earlier processing. Suggestions require your review and do not automatically save changes or make decisions with legal or similarly significant effects.

Service providers and transfers

Supabase provides authentication and the shared database, configured in London. Vercel hosts the website and technical logs. Mapbox receives map requests, including network information. PostHog provides optional consented product analytics. OpenAI receives the optional AI input described above; our email provider handles messages you send us. Authorised Duvet staff may access information for support and administration.

These providers may process information outside the UK, including in the US; a London database does not mean all processing stays in the UK. Their published data-processing terms describe transfer safeguards, including contractual clauses and UK addenda where applicable: Supabase, Vercel, Mapbox and OpenAI. Contact us for information about the arrangements applicable to your trial.

Storage and retention

We retain account and shared workspace records while needed to operate and evaluate the trial, handle follow-up enquiries, investigate security issues or meet legal obligations. Access expiry does not automatically delete them; contact us to request removal. Provider logs and backups may persist under their retention arrangements.

The sample estate uses account-scoped browser storage for saved records and files. Signing out retains them. Reset browser demo clears those local records, but does not delete shared workspaces or copies you downloaded. Essential authentication cookies and browser storage support sign-in and saved preferences; we do not set advertising cookies in this trial.

Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction or a portable copy of your personal information. You can withdraw consent for optional processing. Email contact@duvet.house to exercise these rights; we may need to verify your identity.

Right to object: you can object to processing based on our legitimate interests for reasons relating to your situation.

You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.