Legal and services we use

• Dupath runs its own service with care: the pages and buttons, preparing and sending the requests you say yes to, keeping track of replies and deadlines, keeping your account secure and deleting data on time. If something on our side goes wrong, we put it right.
• Scans look across the open web, so a result can sometimes be about someone with the same name. That is why you decide which results are you, and nothing is sent without your yes.
• Dupath asks. Companies decide. UK law gives a company one month to reply, and Dupath keeps track for you; the decision is theirs, and the law lets them keep a little information in some cases.
• Dupath is a privacy service, not a law firm, so it does not give legal advice.
• Your rights as a consumer and under data protection law always apply.

What it does for Dupath: Runs the Dupath app, keeps its encrypted backups (14 days; the keys that open your records only 3 days, so a deleted account cannot be read in them after about 3 days) and sends the emails Dupath sends (Amazon SES).

What Dupath gives it: Your account and case records, sealed with our encryption before they are stored; the emails we send you and the requests we send to companies for you.

What they say: Amazon says it will not move or copy customer content out of the region the customer chooses without the customer's agreement (Dupath chooses London), that the customer owns its content, and that it does not use customer content for marketing or advertising.

Their own page: aws.amazon.com, read on 27 October 2026.

What it does for Dupath: Runs the web searches for your scans, and the optional web search on Check a number.

What Dupath gives it: The search words for a scan: your name with your town, and searches for your phone numbers and email addresses. Never your date of birth or address. For Check a number, only the number, and only if you press the search button.

What they say: Brave's Search API privacy notice says a record of the searches made through a customer's account is kept for at most 90 days, for billing and troubleshooting, and that Brave does not collect identifiers that link a search to a person or their device.

Their own page: api-dashboard.search.brave.com, read on 27 October 2026.

What it does for Dupath: Our own email: the messages you send to support@, privacy@ and our other addresses, and companies' replies to requests@.

What Dupath gives it: What you or a company choose to write to us.

What they say: Google says Workspace customers own their data, that it does not use Workspace core services data for advertising, and that under its data processing terms it acts as a processor for that data.

Their own page: workspace.google.com, read on 27 October 2026.

What it does for Dupath: Delivers the dupath.uk website and protects it against attacks.

What Dupath gives it: What any visitor's browser sends when it opens the site, such as the network (IP) address.

What they say: Cloudflare's privacy policy says it processes visitors' interactions with its customers' sites, which may include IP addresses, acts as a processor for the logs it makes available to customers, and keeps personal information for a period consistent with its business purposes. It does not give a fixed number of days.

Their own page: www.cloudflare.com, read on 27 October 2026.

What it does for Dupath: Takes card payments for plans and reports, on Stripe's own payment page, and stops a plan renewing when you cancel.

What Dupath gives it: The name and price of what you are buying, a reference number that is only a code to us, and the addresses to return you to. Your card details, and the email address you type on Stripe's page, go straight to Stripe, never through Dupath. Dupath receives only that reference and whether a payment worked, was refunded or was cancelled.

What they say: Stripe's privacy policy says it keeps data for as long as it provides its services, and afterwards for legal compliance and fraud prevention, following the limitation periods and record-keeping rules the law sets; that for payments for a business it acts as a service provider (data processor); and that it may transfer data to other countries, including the United States and India, using lawful methods such as adequacy decisions and standard contractual clauses. It does not give a fixed number of days.

Their own page: stripe.com, read on 02 November 2026.

What it does for Dupath: Provides Dupath's public support phone number, which Stripe requires on every UK account. Dupath has no phone line: callers hear a message asking them to email support@dupath.uk, and may leave a voicemail.

What Dupath gives it: Nothing about you. If someone phones the number, Zadarma handles the call and emails us any voicemail as a sound file; we answer by email only, and delete the voicemail email once answered.

What they say: Zadarma's privacy policy says its group keeps personal data in databases in the European Union and keeps it no longer than its purposes require, then destroys or anonymises it unless the law requires otherwise (telecom subscriber data is kept for the periods national law sets); it does not give a fixed number of days, and it does not mention voicemail. It says you may ask for access or erasure at privacy@zadarma.com and that it answers within 30 days. Its terms say incoming calls are free and that it can limit or stop services at its discretion.

Their own page: zadarma.com, read on 02 November 2026.

What it does for Dupath: Would run the Dupath Travel VPN server.

What Dupath gives it: Your VPN traffic, which passes through the server encrypted between your device and the server.

What they say: DigitalOcean's privacy policy says it does not apply to information or content its customers process when using its services, and points to its Data Processing Agreement for that.

Their own page: www.digitalocean.com, read on 27 October 2026.