Privacy Policy

1. Introduction

DuoHelix ("we," "us," or "our") is an independently operated product based in the United Arab Emirates. For privacy questions or requests, contact us at the address in Section 13. This notice describes the data flows implemented in the application as of the date above.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Platform.

2. Information We Collect

2.1 Information You Provide Directly

• Account and profile information: Firebase account identifier, email and available display name; the Terms and Privacy Notice versions you accepted or acknowledged and when; plus the business details and answers you enter in your company profile. Firebase Authentication handles passwords.
• Decision Data: Information about business decisions you enter into the Platform, including decision context, category, timeline, and outcomes you're analyzing.
• Uploaded documents: A supported PDF, DOCX or TXT document is parsed to extract a draft profile. The application does not save the original upload as a Firestore document; extracted text is sent to OpenAI for extraction and the returned draft is shown for your review.
• Communication: Any messages, support requests, or feedback you send to our team.

2.2 Information Collected Automatically

• Service and usage data: Request and security logs generated by the hosting provider. Optional Vercel Analytics is off unless you opt in through Account & Privacy settings.
• Authentication and preferences: Firebase Authentication keeps a persistent sign-in state in your browser by default, and the application also uses an HTTP-only Firebase session cookie for protected requests. A sidebar-preference cookie stores interface state. Signing out clears the Firebase sign-in state and server session.
• Analytics preference: Your optional analytics choice is stored locally in this browser so the application can keep analytics disabled unless you opt in.

2.3 Company case records

• The application contains case records about other companies, with sources and research limitations where available. These are historical business records, not information supplied by your account.

3. How We Use Your Information

• Providing and improving the Platform and our services
• Generating personalized decision analysis and risk assessments
• Comparing decisions with available historical case records and displaying source links where the records include them
• Authenticating users and maintaining account security
• Responding to your support requests and feedback
• Sending administrative updates and service notifications (not marketing)
• Complying with legal obligations and law enforcement requests

4. Data Sharing and Disclosure

4.1 When We Share Information

We do not sell your personal data. We may share information only in these circumstances:

• Firebase / Google Cloud: account authentication and Firestore storage.
• OpenAI: receives extracted document text for profile extraction and profile/decision information for AI-generated analysis.
• Vercel: application hosting and, only if you opt in, Vercel Analytics.
• Legal Requirements: When required by law, court order, or government request.
• Business Transfers: In the event of merger, acquisition, or sale of assets.

4.2 Case Study and Aggregated Data

Your profile, reports and outcome feedback are stored in your account and are not added to the shared company case library by the current application. Signed-in users can browse company case records. The records describe third-party companies and are not represented as anonymous or as independently verified unless a human review marker is shown.

5. AI processing and external providers

When you request document extraction, decision analysis or insights, the server sends the relevant document text or business context to OpenAI's API. The application sets store: false on its Responses API generation calls to prevent those responses from being stored as application state; this does not disable abuse-monitoring logs. The OpenAI API Default project used by DuoHelix currently reports Global residency, not UAE residency. Its project settings list Standard Retention for external storage, but the storage details did not load, and no Zero Data Retention or Modified Abuse Monitoring control was visible. Assume OpenAI may include prompts and responses in abuse-monitoring logs retained for up to 30 days by default unless the operator verifies an approved retention control. Until UAE-specific residency is approved and configured for eligible endpoints and models, assume information sent to OpenAI may be processed outside the UAE. Review OpenAI API data controls before entering highly confidential information.

Firebase Authentication processes account data in the United States. The current Cloud Firestore database is configured in me-central1 (Doha, Qatar). Vercel hosts the application; its current server-side functions run in iad1 (Washington, D.C., United States), and Vercel may process or transfer data in other regions. Other Firebase services, backups, support data, and provider processing can have separate locations or retention settings. See Firebase privacy and processing locations, Cloud Firestore locations, the Firebase Data Processing and Security Terms, Vercel security and compliance information, and the Vercel Data Processing Addendum. The application currently does not add a separate live market-data or news feed to decision reports.

6. Data Security

The application uses Firebase Authentication, server-side Firestore access, HTTP-only session cookies and HTTPS in production. Firestore client rules deny direct client reads and writes; server routes use privileged credentials and must enforce account ownership. This is not end-to-end encryption: the service and its AI provider can process the content described above. No claim of a recurring independent security audit is made here.

• Firebase Authentication for login
• Firestore security rules block direct client reads and writes
• Server routes enforce authentication and record ownership
• HTTP-only session cookies with production secure flags

While we maintain strong security practices, no system is completely secure. You are responsible for maintaining the confidentiality of your login credentials.

7. Data Retention

• Account profiles, reports, insights and outcomes remain in Firestore until you delete your account or the operator deletes them. Account data can be exported or deleted from Account & Privacy settings.
• Deleting your DuoHelix account does not immediately delete records already processed by OpenAI, Firebase/Google Cloud, Vercel, or backups. Those providers may retain records under their own retention schedules and settings.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct inaccurate information
• Delete your account and associated data
• Export your data in a portable format
• Opt out of non-essential communications

You can download a copy or delete your account in Account & Privacy settings. Send other privacy requests to the contact below; we will review and respond in accordance with applicable law.

9. Cookies and Tracking

The application uses:

• Firebase Authentication's persistent browser sign-in state and an HTTP-only server session cookie for authentication
• Sidebar preference state
• Optional Vercel Analytics only when enabled by you in Account & Privacy settings

Analytics is off by default. Your opt-in choice is stored in your browser and can be withdrawn at any time in Account & Privacy settings.

10. Third-Party Links

Case records may link to source websites. Following those links takes you to the source provider, whose privacy policy and content terms apply there.

11. Children's Privacy

Our Platform is intended for business users aged 18 or older. If you believe a person under 18 has provided personal information, contact the operator so the report can be reviewed and handled under applicable law.

12. Changes to This Policy

Material changes will be reflected in this notice. Where applicable law requires notice or consent, the operator must provide it rather than relying only on continued use.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at: