Privacy Notice

Dudill is operated by Nosoft Pte Ltd. ("Nosoft", "we", "us"). We are the data controller for the personal data described in this notice. This notice explains what we collect, why, who we share it with, how long we keep it, and the rights you have.

• Account data — your email address, password (stored only as a secure hash), and company name and username. Used to create your account, provide the service, and secure your rooms. Legal basis: performance of our contract with you.
• Room content — documents you upload, links, folder structures, labels, comments, and room descriptions. Used to store and present your data rooms to the visitors you invite. Legal basis: performance of our contract.
• Visitor data — the email addresses visitors enter to open a shared room, and analytics about which files they opened, when, and for how long. This tracking is the core of the service and is visible to the room owner. Legal basis: performance of our contract with the room owner and our legitimate interest in providing the analytics the service exists to deliver.
• Usage and device data — log data, IP addresses, browser type, and interactions with the app. Used for security, fraud prevention, and improving the product. Legal basis: legitimate interests.
• Support messages — anything you send us when you ask for help. Legal basis: legitimate interests.

Payment card and billing details are collected and processed by Paddle, our Merchant of Record — we never see or store your full card number.

• Service providers and subprocessors — cloud hosting, database, storage, and analytics providers that help us run the service;
• Paddle — our Merchant of Record, for selling subscriptions, processing payments, tax compliance, and invoicing;
• Professional advisers — legal and accounting, where necessary;
• Authorities — where required by law.

We do not sell personal data. Visitor emails and view analytics in a room are visible to that room's owner — that is the service, and visitors are told their viewing is tracked before they enter.

We are based in Singapore and our providers may process data in other countries, including outside the UK/EEA. Where data leaves those regions, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions.

We keep personal data for as long as your account is active or as needed to provide the service, meet legal obligations, resolve disputes, and enforce agreements. When data is no longer needed, we delete or anonymise it. Deleting a room deletes its files and visitor analytics.

Depending on your country, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent where processing is based on consent. You also have the right to complain to your local data protection authority. We respond to requests within one month. To exercise any right, contact us at the support address on our website.

We apply appropriate technical and organisational measures, including encryption in transit, row-level access controls on stored data, short-lived signed access to files, and view-only visitor sessions.

We use essential cookies only — to keep you signed in and to keep visitor room sessions working. We do not use advertising or third-party marketing cookies. You can block cookies in your browser, but sign-in and room access will stop working.

We may update this notice from time to time. We will post the new version here and update the date above.