Duelpoint Privacy Policy
Version 2026-11-11.2. In force from 11 November 2026.
Duelpoint LLC, a Florida limited liability company in the United States ("Duelpoint", "we"), is responsible for the personal data described here. Duelpoint is a service for businesses and is not meant for anyone under 18.
What we collect
- Your account: your business name and details (including a contact name and phone number for the business), the names and work emails of the people in your account, logins and two-step login settings.
- Your tests: your test setup (rules, products, prices and made-up test data), your agent's address and key, the conversations between your agent and our test customers, and the reports.
- Orders: what you bought, the price and when you paid. Card details go to our payment provider; we never see or store your card number.
- Safety records: sanctions screening results, an activity log of changes in your account, and our notes if we suspect misuse.
Please do not put real customers' personal data into your test setup; the acceptable-use policy forbids it.
How we use it
- To run your tests and deliver your reports.
- To improve Duelpoint's testing for every customer. We never sell your data. While we hold your data we may use it for this. After the deletion dates below we keep only anonymized copies of test conversations, from which your business, your people, your products, prices, codes, emails, phone numbers and web addresses have been removed, checked by a person before use.
- To keep Duelpoint safe and lawful: sanctions screening, abuse monitoring, the activity log.
- To bill you and keep the records tax law requires.
Who sees it
- AI providers. Your test conversations are sent to an AI provider so that our test customers can talk to your agent, so that what your agent did can be read, and so that honesty and tone can be judged. You can choose "Anthropic only" on the "Your data" page.
- People at Duelpoint. An Agent Check and a Re-test are automated: no person reads them before you do. An Assessment, an Expert Assessment and each Continuous testing report are read and signed by a person at Duelpoint before release.
- The companies that run our systems: hosting, the database and file storage, email and payments.
Every company that handles data for us is listed on our subprocessor page (/subprocessors), with what it receives and where it keeps it. We tell you before a new one receives your data.
How long we keep it
| Data | Kept for |
|---|---|
| Test conversations | 30 days after the report is delivered (you get them all in your evidence pack) |
| Your agent's key | Until each test ends; for Continuous testing, if you agree when you buy it, until your last month ends (or at once when you ask) |
| Agent Check and Re-test report and test setup | 90 days after delivery (we remind you 14 days before) |
| Assessment, Expert Assessment and Continuous testing report and test setup | 1 year after delivery (we remind you 30 days before) |
| Your account and its people | While it is open; deleted 30 days after you close it. After 2 years without use we ask first, then close it |
| Order records | 7 years, for tax law |
| Sanctions screening records | 10 years, for US sanctions law |
| Activity log | 1 year |
| Our notes on suspected misuse | 2 years |
Backups can outlive these dates by a short period before they too are overwritten.
Your choices and rights
- Download a copy of your account's data, and your reports and evidence packs, from the dashboard.
- Delete a report and its conversations at any time ("Delete now").
- Choose "Anthropic only" so that no other AI provider handles your data.
- Cancel Continuous testing at any time; ask us to delete your agent's kept key at once.
- Close your account; it is deleted 30 days later. Order and screening records stay for the periods the law requires.
- Ask us to correct your details.
Why we are allowed to use it
Where the law asks for a reason (a "legal basis"): running your tests, billing and your account rest on our contract with you; improving Duelpoint's testing, and keeping Duelpoint safe, rest on our legitimate interests, which you may object to by writing to us; keeping order and screening records rests on our legal obligations.
Where your data is processed
Duelpoint is run from the United States, and your data is processed in the United States and wherever the companies on our subprocessor page keep it (shown there for each one).
If privacy laws give you more rights
If you are in the European Union or the United Kingdom, or in a US state with its own privacy law, you may have further rights: to see the personal data we hold about you, to have it corrected or deleted, to object to or limit how we use it, and to complain to your data protection authority. Write to admin@duelpointai.com; we answer within 30 days. We never sell personal data and do not share it for targeted advertising.
Cookies
The dashboard uses only the cookies needed to keep you signed in. The website sets no tracking cookies.
Security and breaches
Each customer's data is walled off from every other customer's in the database, agent keys are sealed, and two-step login is available. If a breach affects your data we tell you without undue delay, and the regulator within the legal deadline (72 hours under GDPR).
Contact
Duelpoint LLC, Florida, United States. admin@duelpointai.com is our only email address.