Privacy Policy

Last updated: 21 July 2026

Plain-English summary: we store the minimum we need to run your gifting (names, email addresses, key dates), we never sell it, reward recipients only ever get a gift link (no marketing), and you can ask us to export or delete everything at any time.

1. Who this covers

This policy covers personal information handled by Dukky: information about workspace users (admins and approvers) and about the people they reward (employees and clients, "recipients"). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. What we collect

Account data: your name, work email, and workspace details. Sign-in is passwordless via magic links; we never store passwords.
Recipient data you provide: names, email addresses, teams, and key dates (birthday, start date). We use it solely to run the reward plans you configure.
Billing data: handled by Stripe. We never see or store full card numbers.
Service data: reward events, approvals, and activity logs for your workspace; basic technical logs for security and debugging.

3. How we use it

To detect milestones and send approval and reward emails.
To charge your stored payment method for approved rewards.
To provide support and keep the service secure.
We do not sell personal information, and we do not use recipient data for marketing. Recipients only ever receive reward emails triggered by your workspace.

4. Who we share it with

Only the processors needed to run the service: Supabase (database, authentication, hosting), Stripe (payments), Tremendous (reward fulfilment; receives the recipient name and email needed to deliver the gift), Resend (transactional email), and Vercel (hosting). Some providers store data outside Australia (our database is hosted in Singapore, and other providers operate primarily from the United States); we take reasonable steps to ensure they protect it consistently with the Australian Privacy Principles.

5. Security

Data is encrypted in transit and at rest. Workspace data is isolated per customer, approval and claim links are signed and expire, and access to production systems is restricted.

6. Retention and deletion

We keep workspace data while your subscription is active and for 30 days after termination, then delete it. You can request export or deletion of your data (including a specific recipient's data) at any time by emailing hello@dukky.co; we will action deletion requests within 30 days, except records we must keep by law (for example, transaction records).

7. Cookies

The app uses essential cookies for sign-in sessions only. This marketing site sets no advertising or analytics cookies.

8. Access, correction, and complaints

You may request access to or correction of personal information we hold about you. If you have a complaint, contact us at hello@dukky.co and we will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC).

9. Changes

We will notify workspace admins by email of material changes to this policy. See also our Terms of Service.