Doppelgone for Work privacy notice
Version 1.1, 29 October 2026 (version 1: 27 October 2026). Not yet reviewed by a lawyer; wording may change before general release.
This notice explains what personal information Doppelgone for Work handles, why, and what you can do about it. Doppelgone for Work is run by Computron Tech (Pty) Ltd, a South African company trading as Doppelgone ("we"). Contact: work@doppelgone.app. Our information officer (POPIA) is Juan Hamman, director, at the same address. Postal address: 10 Belgrave Street, Bryanston, Sandton, 2191, South Africa.
Two roles
- For the files in your company's Microsoft 365 we are an operator (POPIA) or processor (GDPR): we act only on your company's instructions, under the data processing agreement. Your company is the responsible party or controller.
- For the people who sign in to Doppelgone for Work (admins, reviewers, viewers) and for billing, we are the responsible party or controller. This notice mostly covers that part.
What we hold, and why
| What | Why | How long |
|---|---|---|
| Your name, work email, Microsoft tenant and user ids | To sign you in, show who did what, and send invitations and reports | While you are a member, then deleted with the organisation |
| What you do in the app (approvals, clean-ups, undo, settings) | The audit log your company can export | While your organisation's account is open; deleted 30 days after it leaves |
| File metadata from your tenant: names, folders, sizes, dates, owners, hashes, and a text fingerprint (MinHash) | To find duplicates (operator role) | Deleted 90 days after the last scan, and with the organisation |
| Short text excerpts of candidate duplicates | Sent to our AI provider to judge near-duplicates; never stored by us | Not kept |
| Purchase records (via Polar, merchant of record) | Invoices and tax | At least 5 years, as tax law requires |
| Sign-in and security logs (IP address, browser) | Abuse protection and incident response | Up to 30 days |
We never store file contents. Text is read in memory to compare documents and then discarded.
Where it comes from. Your name and email come from you or from the colleague who invited you. Information about people in your company's tenant (file owners, editors, users and groups) comes from your company's Microsoft 365, through the access your company's administrator granted. Giving us your details is voluntary, but without them you cannot sign in.
Legal basis. For account data: performing our contract with your company and our legitimate interest in running and securing the service (POPIA section 11(1)(b) and (f); GDPR Article 6(1)(b) and (f)). Purchase records: our legal duty under tax law. For file data, your company decides the basis; we act as its operator.
Who we share it with
Only the subprocessors listed on the subprocessors page (hosting, database, email, payments, AI), under contracts that protect it. We do not sell personal information and we do not use it for advertising. Some subprocessors are outside South Africa: our database is in the EU (Ireland), our application runs in Vercel's EU region, and some providers are US companies. Transfers rely on the GDPR or on written agreements that give the protection POPIA section 72 and the GDPR require. We may also disclose information when the law requires it.
Your rights
You can ask to see, correct or delete your personal information, object to its use, or ask for a copy. Write to work@doppelgone.app; we answer within one business day and act within 30 days. For files in your company's tenant, your company decides: we help it answer. You may complain to the Information Regulator (South Africa), www.inforegulator.org.za, or to your local data-protection authority. We would like the chance to put things right first, but you do not have to come to us before you complain.
Security
Keyless app identity (no client secret), read-only access for the audit and separate write access for clean-ups, encryption in transit and at rest, role-based access, a logged break-glass process, and notice to your company immediately, and within 48 hours, if its data is involved in a security compromise. Details: security sheet and security page.
Changes
We will email account owners at least 30 days before a material change takes effect, and show the date of the current version at the top of this notice.