Privacy Policy
Last updated · 22 April 2026
This Privacy Policy explains how Dubsof Limited (“Dubsof”, “we”, “us”) collects, uses, stores, shares, and protects your personal data when you use our services. Dubsof is the data controller for the personal data described in this Privacy Policy, except where we act as a processor or sub-processor (see Part 4). We are a company incorporated in Ireland with registered number 787713 and our registered office is at 55 Merrion Square South, Dublin 2, Dublin D02 YD65, Ireland. We have not appointed a Data Protection Officer as we do not currently meet the mandatory threshold for appointment under Article 37 of the GDPR. We will keep this under review. For data protection queries, contact us at legal@dubsof.com.
Part 1 — General (All Services)
2. What this Privacy Policy covers
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our services, including:
- dubsof.com — our corporate website (Part 2)
- Atrium Beta at atrium.dubsof.com — our AI code generation product (Part 3)
Parts 2 and 3 describe data processing specific to each service. This Part 1 applies to all services.
3. Legal bases for processing
We process personal data on the following legal bases under the GDPR:
- Contract (Article 6(1)(b)) — where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
- Legitimate interest (Article 6(1)(f)) — where processing is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- Consent (Article 6(1)(a)) — where you have given clear consent for us to process your personal data for a specific purpose.
- Legal obligation (Article 6(1)(c)) — where processing is necessary to comply with a legal obligation.
4. Data we collect across all services
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Account data | Name, email, phone number, password hash | Account management, authentication | Contract |
| Billing data | Payment method (via Stripe), billing address, VAT number, invoices | Billing, tax compliance | Contract / Legal obligation |
| Usage telemetry | Feature usage, session data, error logs, device/browser info | Product improvement, debugging | Legitimate interest |
| Support data | Emails, support requests, correspondence | Customer support | Contract / Legitimate interest |
| Security data | Login events, IP addresses, access logs | Security, fraud prevention | Legitimate interest |
5. How we share your data
We do not sell your personal data. We share personal data only with:
- Sub-processors — third-party service providers that process data on our behalf under documented instructions (see Clause 10).
- Independent third-party controllers — parties that receive limited personal data from us and process it for their own purposes (see Clause 10A). This currently includes Stripe for payment processing.
- User-directed third-party recipients — where you choose to export data or connect your account to a third-party service (such as Cloudflare or GitHub), data is shared at your direction (see Clause 10B).
- Professional advisers — solicitors, accountants, and auditors where necessary.
- Law enforcement and regulators — where required by Applicable Law or to protect our legal rights.
- Corporate transactions — in connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations.
6. International transfers
Our primary infrastructure is in AWS EU-West-1 (Ireland). Where personal data is transferred outside the EEA (for example, to sub-processors in the United States), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.
7. Data retention
We retain personal data only for as long as necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required by law.
- Account data: duration of account + 30 days after termination.
- Billing records: 6 years (Irish tax law — Taxes Consolidation Act 1997).
- Security logs: 12 months.
- Support correspondence: 3 years after resolution.
Product-specific retention periods are set out in Parts 2–4.
8. Your rights
Under the GDPR, you have the following rights:
- Access — request a copy of your personal data.
- Rectification — request correction of inaccurate data.
- Erasure — request deletion of your data (subject to legal retention obligations).
- Restriction — request that we restrict processing in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at legal@dubsof.com. We will respond within 30 days (or within the period required by Applicable Law). We may verify your identity before processing your request.
9. Children’s data
Our Services are not directed at individuals under 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected personal data from a person under 18, we will delete it promptly.
10. Sub-processors
We use the following sub-processors to process personal data on our behalf under documented instructions:
| Sub-processor | Purpose | Location | Products |
|---|---|---|---|
| AWS (EU-West-1) | Cloud hosting infrastructure | Ireland (EU) | All Products (Atrium Beta) |
10A. Independent third-party controllers
The following third parties process personal data as independent controllers (not as sub-processors acting on our instructions). Dubsof shares limited personal data with these parties for the purposes described below, and each party determines the purposes and means of its own processing.
| Third party | Purpose | Location | Data shared |
|---|---|---|---|
| Stripe, Inc. | Payment processing and billing | USA/EU (SCCs in place) | Payment method, billing address, VAT number, transaction records |
Stripe processes payment data as an independent controller under its own privacy policy. It does not act as Dubsof’s processor or sub-processor for payment data.
10B. User-directed third-party recipients
Where you choose to export data or connect your account to a third-party service, data is transferred at your direction to that third party. These are not Dubsof sub-processors; once the data leaves Dubsof’s infrastructure, the recipient processes it under its own terms and privacy policy. You should review the recipient’s privacy policy before initiating any export or connection.
| Third party | Purpose | Location | Products |
|---|---|---|---|
| Cloudflare, Inc. | Application hosting (user-initiated export) | USA/EU | Atrium Beta (export feature) |
| GitHub, Inc. (Microsoft) | Code repository (user-linked account) | USA | Atrium Beta (GitHub export) |
Authentication is handled by Dubsof’s own infrastructure. Additional sub-processors, third-party controllers, or user-directed recipients will be disclosed in this policy if engaged in future.
11. Cookies and similar technologies
Dubsof does not currently use analytics cookies, advertising cookies, functional cookies, tracking pixels, or similar technologies on any of its domains. Our authentication system may store strictly necessary session identifiers or tokens on the client side (for example, in a browser cookie). Such storage is exempt from consent requirements under SI 336/2011, as it is strictly necessary for the provision of the service explicitly requested by the user. Dubsof treats all client-side storage of authentication artefacts as “cookies and similar technologies” for the purposes of Irish DPC guidance. Full details are set out in the Dubsof Cookie Policy. If we introduce any non-strictly-necessary cookies in future, we will update both this Privacy Policy and the Cookie Policy before doing so and, where required, obtain your consent.
12. Complaints
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Data Protection Commission (DPC), the Irish supervisory authority: Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. If you are based in the UK, you may also contact the Information Commissioner’s Office (ICO).
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be notified in accordance with the Master Terms. The effective date at the top of this document indicates the date of the most recent revision.
Part 2 — Dubsof.com (Corporate Website)
This Part 2 applies to data collected through dubsof.com.
14. Data collected
- Analytics data: Dubsof does not currently collect analytics data through cookies or similar technologies on dubsof.com. If analytics tools are introduced in future, this policy and the Cookie Policy will be updated before any analytics data is collected. Legal basis: consent (if analytics cookies are introduced).
- Lead generation data: where a contact or partner sign-up form is provided, we collect name, email, company name, and message content. Legal basis: consent or legitimate interest.
- Careers data: if you apply for a role via dubsof.com, we collect your name, email, CV, and application details. Legal basis: legitimate interest (recruitment).
15. Retention
- Analytics data: not currently collected. If introduced, retention periods will be set out in the updated Cookie Policy.
- Lead generation data: 2 years or until you request deletion.
- Careers data: 12 months after decision (unless you consent to longer retention).
Part 3 — Atrium Beta
This Part 3 applies to data collected through Atrium Beta at atrium.dubsof.com. Dubsof is the data controller.
16. Additional data collected
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Conversation Data | Prompts, inputs, system logs, Generated Output | Service delivery, troubleshooting | Legitimate interest |
| Conversation Data | Same as above | Training and service improvement | Consent (opt-in) |
| Usage/billing data | Node Actions consumed, Exports used, tier, billing history | Billing, analytics | Contract |
| Payment data | Processed by Stripe (Dubsof does not store card details) | Billing | Contract |
17. Conversation Data — detailed disclosure
Conversation Data includes your prompts, instructions, and inputs, together with associated system processing logs and Generated Output produced by the Platform.
Service delivery and troubleshooting
We access and process Conversation Data as necessary to provide the Atrium Beta service, investigate errors, and respond to support requests. Legal basis: legitimate interest. This processing cannot be opted out of while your account is active, as it is necessary for service delivery.
Training and improvement
With your explicit consent (opt-in), we may use Conversation Data to train and improve our AI models and the Platform. You may grant or withdraw this consent at any time through your Account settings or by contacting legal@dubsof.com. Withdrawal of consent will not affect your ability to use the service. Where possible, we anonymise Conversation Data before using it for training purposes.
Retention
Conversation Data is retained for the duration of your account + 30 days. Where you withdraw consent for training use, Conversation Data used for training purposes will be deleted or anonymised within 90 days of withdrawal. Anonymised data (which no longer constitutes personal data) may be retained indefinitely. Billing records are retained for 6 years.
18. Third-party hosting
Where you export an application from Atrium Beta, it may be deployed on third-party infrastructure (currently Cloudflare). Your data will be processed by Cloudflare under their terms and privacy policy. We recommend reviewing Cloudflare’s privacy policy before exporting.
Contact
For all data protection queries, to exercise your rights, or to make a complaint: Dubsof Limited, 55 Merrion Square South, Dublin 2, Dublin D02 YD65, Ireland. Email: legal@dubsof.com. CRO 787713 — Ireland.