Duedee Privacy Policy

1. What we collect

• Account: your email address; if you sign in with Google, also the name and profile picture Google shares with us. We also keep when you agreed to this policy and your language choice.
• Statements: the statement emails you forward to your private Duedee address and the PDFs you upload. From them we keep only the figures: bank, last 4 digits of the card, the card nickname you choose, statement date, due date, amount due, minimum payment, credit limit, previous balance, whether you marked it paid, and any correction you make.
• PDF passwords you choose to give us so we can open your statements.
• Bank payment codes: the bill-payment QR code or barcode printed on a statement, so you can scan it in Duedee. It contains your full card number.
• Reading summaries: only when a PDF you upload can't be fully read, a summary of its first page with your name, address, email and shop names removed and long numbers cut to their last 4 digits.
• Forwarding setup: the confirmation link Gmail sends to your Duedee address, and whether you ticked that you confirmed it.
• Technical data: sign-in and language cookies, and request logs (IP address, time, browser) kept by our hosting provider for security and troubleshooting.

We never ask for your national ID number or date of birth. Apart from the bank payment code, we never store more than the last 4 digits of a card number.

2. Information from Google

If you choose “Sign in with Google”, Google shares with Duedee only your email address, your name and your profile picture (the basic “openid”, “email” and “profile” permissions). We use them only to create your Duedee account and sign you in.

Duedee does not ask for access to your Gmail, Google Drive, contacts or any other Google data. Statements reach Duedee only through the email forwarding you set up yourself, or the PDFs you upload.

We do not sell Google user data, use it for advertising, or share it with anyone except the service providers in section 5 that run Duedee for us. Duedee's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Duedee's access at any time in your Google Account (Security → Your connections to third-party apps & services). Deleting your Duedee account deletes this data.

3. Why we use it

• To provide Duedee (performance of our agreement with you): signing you in, reading your statements, showing what is due and reminding you before due dates.
• With your consent, given in the app before you start: processing the contents of your statements, keeping your PDF passwords and bank payment codes, and, only if you tick “share” for a statement, keeping its reading summary to improve how we read that bank's statements.
• For our legitimate interests: keeping Duedee secure, stopping abuse (for example the bot check on the sign-in form) and fixing errors.
• To meet legal obligations.

We do not sell your data, show you advertising, or use your statements to profile you for anyone else.

4. How long we keep it

• Forwarded emails and their PDFs: deleted as soon as they are read. One that can't be read yet (for example while waiting for a PDF password) is kept at most 30 days.
• Uploaded PDFs: read and discarded, never stored.
• Reading summaries: at most 7 days while you check the figures; if you choose to share one, at most 30 days.
• Bank payment codes: deleted when you mark the statement paid, or one week after its due date.
• Cards, statement figures and PDF passwords: until you delete them or your account.
• Your account: until you delete it. “Delete my account” in Settings erases your account, cards, statements, passwords and any stored mail at once.

5. Who processes it for us

These providers process personal data only on our instructions and under their data-protection terms:

• Supabase: database, sign-in and encrypted storage (Tokyo, Japan).
• Google Cloud: reading statement PDFs (Tokyo, Japan).
• Cloudflare: hosting the website, receiving forwarded mail and holding it until it is read, sending sign-in emails, and the bot check (Cloudflare's global network).
• Google: sign-in with Google, only if you choose it.

Your data is therefore processed outside Thailand, in Japan and on Cloudflare's network. We use providers with appropriate safeguards for personal data and transfer only what is needed to run Duedee.

6. How we protect it

• All connections use HTTPS, and data is encrypted at rest.
• PDF passwords and bank payment codes are kept in an encrypted vault, used only by Duedee's servers and never shown back as text.
• Database rules make sure each user can read only their own data.
• A forwarded statement is trusted only if the bank's email signature checks out.

7. Your rights

Under the PDPA you may ask to access and get a copy of your data, correct it, delete it, receive it in a usable format, object to or restrict its processing, and withdraw your consent at any time. Withdrawing consent does not affect processing done before, but Duedee can no longer read your statements.

You can correct statement figures and delete cards or your whole account yourself in the app. For anything else, email support@muszubi.com; we reply within 30 days. You may also complain to Thailand's Office of the Personal Data Protection Committee.

8. Data breaches

If a breach puts your rights at risk, we notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, and tell you without delay when the risk to you is high.

9. Cookies

Duedee uses only the cookies it needs: one keeps you signed in and one remembers your language. There are no advertising or tracking cookies.

10. Age

Duedee is meant for credit card holders aged 20 or over.

11. Changes to this policy

We update the date above when this policy changes. If a change affects how we handle your statements, the app asks you to review and agree again before you continue.

12. Contact

Muszubi · support@muszubi.com