Who is responsible
doue is operated by the business identified in the company contact details. We are responsible for the information we process for our own activities: accounts, billing, platform security, support and communications.
When a business customer, a “merchant”, uses doue to communicate with its own customers, we process that information on its behalf, under its instructions and the data processing addendum. The merchant is then responsible for that information and for informing its customers.
For any question, write to doue’s privacy officer at privacy@doue.ai.
How we collect your information
We collect information through the website and application forms (sign-up, payment, requests), through emails sent to our addresses, through the chat widget installed on a website, through the integrations a customer turns on, such as Shopify or WooCommerce, and through the cookies described in our cookie policy. Some providers collect information for us: the payment provider, the authentication service and the email delivery service.
Information collected and how it is used
The table below shows the main categories of information, how we use them and who can access them at doue. We collect only what is necessary for these purposes.
| Information | What it is used for | Who can access it at doue |
|---|---|---|
| Identity and business contact details: name, email, company, role | Create and manage the account, contact you, provide support | Support, billing, technical team |
| Billing: plan, purchases, taxes. Card data is processed by the payment provider, not by doue | Bill, manage the subscription, meet our tax obligations | Billing |
| Conversations, attachments and contacts of a merchant’s customers | Provide the service to the merchant, on its behalf | People authorized by the merchant; doue support and technical team only when necessary |
| Order data authorized by an integration (Shopify, WooCommerce) | Show order context in the conversation and, if the merchant turns on Shopify assisted actions, carry out the ones it authorizes, on the merchant’s behalf | People authorized by the merchant |
| Knowledge sources and AI responses | Prepare answers from the sources the merchant authorizes | People authorized by the merchant; technical team when necessary |
| Security logs and technical data: IP address, device, timestamp | Secure the platform, prevent fraud, fix errors | Technical team |
| Consent choices | Respect your choices and be able to show them | Technical team |
Refusing a collection
You can refuse optional cookies: the website stays usable, without the chat widget. You can also email us instead of using the widget. Account and billing information is necessary to provide the service; without it, we cannot open an account.
Consent
We ask for your consent separately for each optional use, such as promotional emails or non-essential cookies. You can withdraw it at any time without affecting your use of the service.
Promotional emails
We send promotional emails only to people who have consented. The box is never pre-checked and is not required to use the service. We keep a record of your choice.
Every promotional email identifies the business, gives its mailing address and includes a free unsubscribe link. An unsubscribe request takes effect no later than ten business days after you make it. Messages needed for the service, such as security, billing or important notices, may continue.
We do not buy lists and do not share our lists with third parties for their own purposes.
Artificial intelligence
Sol, doue’s AI agent, prepares answers from the sources the merchant authorizes. How it works, its limits, handoff to a person and automated decisions are described in the AI agent notice.
Who we share your information with
We share information only with providers that need it to help us provide the service and that are bound by a written agreement: hosting, authentication, payment, email delivery, AI models and technical monitoring. The current list of our subprocessors is available on request at privacy@doue.ai. We do not sell your personal information.
Communication outside Québec
Our application servers (OVH, Beauharnois) and our main database (Supabase, Montréal) are located in Québec. Some providers process information outside Québec: elsewhere in Canada, in the United States (authentication, payment and AI models) and in the European Union (email delivery, in the Czech Republic). The website itself is served through Cloudflare’s global network. Before entrusting them with information, we assess the protection offered and sign a written agreement. In those countries, information may be accessible to courts and authorities under local laws.
Retention
We keep information only as long as needed for the stated purposes, then destroy or anonymize it. Retention periods are listed on the privacy governance page.
Security and incidents
We protect information with access controls, least privilege, encryption in transit and logging. We record every confidentiality incident. If it presents a risk of serious injury, we notify the competent authorities and the people concerned, as required by applicable law. When an incident affects information we process for a customer, we notify that customer without delay and help it meet its own obligations.
Your rights
You can ask to access the personal information we hold about you and to have it corrected. You can also ask that computerized information collected from you be provided in a structured, commonly used technological format, and withdraw your consent to an optional use.
We reply in writing within 30 days of receiving your request. Access is free; reasonable transcription or reproduction fees may apply, and we would tell you first. We may verify your identity in a proportionate way and will ask for an identity document only if necessary.
To exercise a right, use the request page or write to privacy@doue.ai. If you chatted with a merchant’s widget, your request belongs first to that merchant: if you send it to us, we forward it and help the merchant respond, while meeting our own legal obligations.
Complaints and recourse
You can file a complaint with doue by writing to privacy@doue.ai; the process is described on the governance page. You can also contact Québec’s Commission d’accès à l’information or the Office of the Privacy Commissioner of Canada.
Minors
doue accounts are reserved for people aged 18 or older acting for a business. Visitors to a merchant’s widget may be minors: the merchant informs its customers and obtains the required authorizations.
Changes
We publish each new version of this policy on this page, with its date and a notice describing the changes.