1. Introduction

Duende Health LLC ("we," "us," "our") operates the Duende application. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use Duende.

2. Information We Collect

We collect the following information when you use Duende:

• Name and email address provided at signup
• Age and intake questionnaire responses
• Session transcripts — the text of conversations with your AI guide
• Journal entries you write within the app
• Session metadata — dates, times, session numbers
• Voice transcripts from voice input features
• Payment information processed through Stripe

3. How We Use Your Information

We use your information to:

• Provide and personalize the Duende experience
• Generate session summaries, morning reviews, and emotional profiles that improve your sessions over time
• Send morning review emails and session reminders
• Process payments and manage your subscription
• Improve the Service

4. AI Processing

Duende uses the Anthropic API to power its AI guides. Your conversation data is transmitted to Anthropic's servers to generate responses. Anthropic's privacy policy governs their handling of this data. We do not use your data to train AI models, and we do not permit Anthropic to use your data for model training under our API agreement.

5. Data Storage

Your data is stored in a secure PostgreSQL database. Session transcripts, journal entries, and personal information are stored to enable continuity and personalization across sessions. Data is transmitted over encrypted connections.

6. Data Sharing

We do not sell your personal information. We do not share your data with third parties except as necessary to operate the Service:

• Anthropic — AI processing of session conversations
• Railway — secure database and application hosting
• Resend — email delivery (email address only)
• Stripe — payment processing (payment information only)

7. HIPAA

Duende is not a HIPAA covered entity and does not provide healthcare services. We are not subject to HIPAA requirements. However, we take the sensitivity of your personal and emotional data seriously and implement reasonable security measures to protect it.

8. Data Security

We implement industry-standard security measures including encrypted data transmission and secure database storage. No system is completely secure and we cannot guarantee absolute security of your data.

9. Data Retention

We retain your data for as long as your account is active. You may request deletion of your account and all associated data at any time by emailing hello@duende.health. We will process deletion requests within 30 days.

10. Your Rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and all associated data
• Withdraw consent at any time by cancelling your account

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of your personal information. We do not sell personal information.

12. Children's Privacy

Duende is not intended for users under 18 years of age. We do not knowingly collect information from minors. If you believe a minor has provided us with personal information, please contact us at hello@duende.health.

13. Changes to This Policy

We may update this Privacy Policy at any time. We will notify you of significant changes by email. Continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact

For privacy questions, data requests, or to exercise your rights contact us at hello@duende.health