Privacy Policy

Duoly, Vienna, Austria is responsible (“controller”) for the personal data processed on duoly.gg. For anything about your data, use the contact form (pick “Privacy & data”).

We don’t ask for sensitive data and we never ask for your game account password.

• Contract (Art. 6(1)(b) GDPR): your account, orders, payments, balance, the session chat and support.
• Legitimate interests (Art. 6(1)(f) GDPR): keeping Duoly safe (reports, fraud and abuse checks, blocking accounts), fair order routing for teammates, and improving the service.
• Legal obligation (Art. 6(1)(c) GDPR): keeping invoices and payment records for as long as tax law requires.
• Consent (Art. 6(1)(a) GDPR): optional things like browser notifications for admins. You can withdraw consent at any time.

• Your teammate sees what they need for the session: your first name, profile picture, rank, server, in-game name, your note and the order chat. They don’t see your email or what you paid.
• Duoly’s teammate Discord: if an order waits a while, our bot posts it in the teammate server so someone grabs it. That post shows the service, rank, server, your note and the teammate’s pay. It never shows your name or email.
• The Duoly team (admins) can see orders, chats, reports and support messages to help you and keep the platform safe.
• Service providers who process data for us under contract: our hosting provider, our payment provider, Google and Discord (only if you sign in with them), and Discord for the teammate bot.
• Authorities, only where the law requires it.

Some of these providers can be outside the EU/EEA. In that case we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the EU’s Standard Contractual Clauses.

Necessary cookies keep the site working. You can allow Analytics, Marketing and Creator link separately, or accept or refuse all optional purposes in one click. The creator cookie remembers whose link you used for 30 days so they get credit for your first order. Change your choices any time through Cookie settings. Ad measurement is planned and is not active yet.

Fonts are loaded from Google Fonts, which means your browser connects to Google’s servers and shares your IP address with them. Exchange rates come from a public European Central Bank feed; no personal data is sent there.

We use GDPR compliant analytics. Nothing is tracked before you make a choice in the cookie banner, your data stays in the EU, and you can change your choice at any time.

With your permission, we use PostHog (PostHog Inc.), with data stored in PostHog EU Cloud, Frankfurt, to improve the site and fix errors.

We collect pages visited, clicks, booking and checkout steps, device and browser type and approximate country. Session recordings show the site with everything you type and chat text hidden. We never send your name, email, Discord name, in-game name or messages to PostHog. When you are signed in, we link events to your account ID only.

The legal basis is your consent (Art. 6(1)(a) GDPR). Withdraw any time through Cookie settings. If you decline, we only count visits anonymously without cookies, using a daily changing hash that cannot identify you.

Analytics events are kept for up to 1 year and recordings for up to 30 days. We also record payments, orders and reviews on our servers to measure how the service works: amounts, game and service, with no personal details in these measurements. If you allowed Analytics, they are linked to your account ID.

Server-side ad measurement is planned for our ads and is not active yet. If you allow Marketing, when you arrive from an ad we keep the ad click ID. After you book, our servers send Meta Platforms Ireland and Google Ireland the purchase value, time and that click ID so they can count the conversion and help us measure and improve our ads. For Meta we also send a hashed email only with this consent. No ad pixels run on the site.

The legal basis is your consent (Art. 6(1)(a) GDPR). Withdraw any time through Cookie settings. Without this consent, nothing goes to ad platforms.

• Account data: as long as you have an account. After you delete it we remove or anonymise it within 30 days.
• Orders and payment records: 7 years, because Austrian tax law requires it.
• Session chats, proof and reports: up to 2 years after the order, so we can handle disputes and abuse.
• Support chats and contact messages: up to 2 years after the last message.
• Applications that weren’t accepted: 6 months.

Under the GDPR you have the right to:

To use any of these, use the contact form (pick “Privacy & data”). We reply within one month. You can also complain to a data protection authority; in Austria that’s the Datenschutzbehörde (dsb.gv.at).

Passwords are stored only as salted hashes, the site runs over HTTPS, and only the Duoly team can access the admin tools, with every admin action logged. No system is perfect, but if something ever goes wrong we’ll tell you and the authorities as the law requires.

Duoly is for people aged 18 and over. We don’t knowingly collect data from anyone younger. If you think someone under 18 has an account, let us know and we’ll delete it.

When we change this policy we update the date at the top, and we tell you about important changes before they apply.