Privacy Policy

1. Data Controller

The data controller responsible for your personal information under this Privacy Policy is:

Powerduck Limited
Email: contact@neatico.com
Website: https://www.powerduck.com

For the purposes of the General Data Protection Regulation (GDPR) and applicable UK data protection laws, Powerduck Limited is the data controller of your personal information. We have not appointed a Data Protection Officer (DPO) as we are not required to do so under applicable law. However, all privacy inquiries should be directed to contact@neatico.com.

2. Overview

Powerduck ("we", "us", "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what information we collect when you use Powerduck (the open-source library) and Powerduck (the hosted service), how we use it, and the choices you have.

Important: The open-source editor itself does not collect any data. When you embed the editor in your own application, all content stays on your servers and devices. This policy primarily applies to Powerduck and our website.

This policy applies to all users of our website and services, including visitors, registered users, and organizations that access the Services on behalf of a business entity.

3. Information We Collect

3.1 Information You Provide

Account information: name, email address, and password when you create a Powerduck account.
Billing information: payment card details (processed by our payment provider Paddle, not stored on our servers), billing address, and tax identification numbers.
Content: markdown documents, files, and other data you upload or create through Powerduck.
Communications: messages you send to our support team or through feedback channels.
Profile information: optional information such as company name, job title, and avatar.

3.2 Information Collected Automatically

Log data: IP address, browser type, operating system, referring URLs, pages visited, and timestamps.
Usage data: features used, document counts, and performance metrics to help us improve the service.
Device information: device type, screen resolution, and language settings.
Optional desktop usage statistics: in updated clients, “Help improve Powerduck” is off by default for new and existing installations without explicit consent. Enabling it sends a random installation ID, app version, OS and architecture, event ID, name, time, limited outcome and example/project categories, and an internal-test marker. This ID correlates one installation and is not fully anonymous. No file contents, paths, API payloads, license ID, key suffix or timezone are included. Disable it in application settings to stop new events. Older clients may still send launch statistics including license ID, key suffix, plan and timezone; the updated statistics endpoint ignores those fields. Previously stored records are not retroactively erased by this change.
Data flows: Google or GitHub sign-in is required to use the desktop and browser workspaces. Project files remain local. AI requests send selected code and conversation context to Powerduck’s managed model providers. Publishing uploads selected content when you choose to publish. API debugging sends requests to the endpoint you choose. Disabling optional statistics does not disable authentication or these user-initiated requests.
Download requests: we record redirects to installers, not completed downloads or installations. Download records may include edition, version, limited campaign attribution, user agent and IP address. Network infrastructure can also retain access logs separately from the optional desktop statistics payload.
Cookies and similar technologies: as described in our Cookie Notice.

桌面数据流摘要

本地功能无需账号。规范在本机读写；远程 AI 向配置的模型发送相关上下文，主动发布 Cloud 时上传所选内容。新版可选使用统计默认关闭，可在应用设置中开启或关闭。字段为随机安装 ID、版本、系统与架构、事件 ID、名称、时间及有限结果和示例/项目类别。安装 ID 可关联同一安装，并非完全匿名。不采集文件、路径、接口内容、授权 ID、密钥末四位或时区。关闭会清空待发送事件，但不影响授权校验、更新检查或主动发起的 AI/Cloud/API 请求。旧版可能仍发送授权及位置字段；新版服务端忽略这些字段，历史记录不会因此自动删除。下载记录是跳转请求，不是完成下载或安装。网络访问日志与可选统计独立。

デスクトップのデータ通信

ローカル機能にアカウントは不要です。仕様は本機で読み書きし、リモート AI には関連情報を、Cloud 公開時には選択内容を送信します。新版の任意の利用統計は初期状態でオフで、アプリ設定から変更できます。送信項目はランダムなインストール ID、バージョン、OS、アーキテクチャ、イベント ID・名前・時刻、限定された結果とサンプル/プロジェクト区分です。同じインストールを関連付けるため完全な匿名ではありません。ファイル、パス、API 内容、ライセンス ID、キー末尾、タイムゾーンは含みません。オフにすると待機イベントを破棄しますが、ライセンス確認、更新確認、利用者が開始する AI・Cloud・API 通信は継続します。旧版の送信項目は新版サーバーで無視しますが、過去の記録は自動削除されません。ダウンロード統計は転送要求の件数で、完了やインストール数ではありません。通信ログは任意の統計とは別です。

3.3 Information from Third Parties

We may receive information about you from third parties, including:

Payment providers: Paddle may provide us with transaction information, billing address, and tax details.
Analytics providers: aggregated and anonymized usage data from analytics services.
Authentication providers: if you sign in using a third-party service, we may receive your name and email address from that provider.

4. How We Use Your Information

We use the information we collect for the following purposes:

To provide and maintain the Service: including creating accounts, processing transactions, and delivering features.
To process payments: including managing subscriptions, invoicing, and collecting applicable taxes.
To authenticate users and secure accounts: including verifying your identity and preventing unauthorized access.
To improve the Service: including analyzing usage patterns, fixing bugs, and developing new features.
To communicate with you: including sending service-related notifications, billing confirmations, security alerts, and support responses.
To personalize your experience: including remembering your preferences and settings.
To comply with legal obligations: including responding to legal requests and enforcing our Terms of Service.
To prevent fraud and abuse: including monitoring for suspicious activity and protecting our users and services.

We do not sell your personal information to third parties for commercial purposes. We do not use your personal information for targeted advertising.

5. Legal Basis for Processing (GDPR)

Under the GDPR, we rely on the following legal bases for processing your personal information:

Contractual necessity (Article 6(1)(b)): processing is necessary for the performance of our contract with you, including providing the Service, processing payments, and maintaining your account.
Legitimate interests (Article 6(1)(f)): processing is necessary for our legitimate interests, including improving the Service, ensuring security, preventing fraud, and communicating with you about updates.
Consent (Article 6(1)(a)): where we rely on your consent, such as for non-essential cookies and marketing communications. You may withdraw your consent at any time.
Legal obligation (Article 6(1)(c)): processing is necessary for compliance with a legal obligation, including tax reporting, accounting, and responding to legal requests.

We may share your information with the following categories of recipients:

6.1 Service Providers

We share information with third-party service providers who help us operate the Service. These providers are contractually required to protect your data and may only process it on our behalf and in accordance with our instructions.

Payment processors: Paddle (billing, invoicing, tax collection, refund processing).
Hosting providers: cloud infrastructure providers who host our servers and data.
Analytics services: privacy-friendly analytics providers who help us understand usage patterns.
Email service providers: providers who help us send transactional and support emails.
Customer support tools: providers who help us manage support tickets and communications.

6.2 Legal Authorities

We may disclose your information when required by law, court order, or government request, or when we believe in good faith that disclosure is necessary to:

Comply with applicable laws, regulations, or legal process.
Protect our rights, property, or safety, or that of our users or the public.
Detect, prevent, or address fraud, security, or technical issues.
Enforce our Terms of Service or other agreements.

6.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you before your personal information is transferred and becomes subject to a different privacy policy.

6.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Category of Data	Retention Period
Account information	For the duration of your account, plus 30 days after deletion
Billing and transaction records	7 years (as required by tax and accounting laws)
Content (documents, files)	For the duration of your account, plus 30 days after deletion
Log and usage data	12 months (anonymized after 90 days)
Support communications	3 years after the last communication
Marketing communications	Until you opt out or unsubscribe

When we no longer need your personal information, we will securely delete or anonymize it in accordance with applicable law.

8. Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption in transit: all data transmitted between your browser and our servers is encrypted using TLS 1.2 or later.
Encryption at rest: sensitive data is encrypted using industry-standard encryption algorithms.
Access controls: access to personal information is restricted to authorized personnel who need it to perform their duties.
Regular security audits: we conduct regular security assessments and penetration testing.
Data minimization: we collect only the information necessary to provide the Service.
Secure payment processing: payment card data is processed by Paddle and never stored on our servers.

Despite these measures, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

9. Your Rights (GDPR)

If you are a resident of the European Economic Area (EEA) or the United Kingdom, you have the following rights under the GDPR and UK GDPR:

Right of access (Article 15): you have the right to obtain a copy of the personal information we hold about you.
Right to rectification (Article 16): you have the right to request correction of inaccurate or incomplete personal information.
Right to erasure (Article 17): you have the right to request deletion of your personal information, where we no longer have a legitimate reason to process it.
Right to restriction of processing (Article 18): you have the right to request restriction of processing in certain circumstances.
Right to data portability (Article 20): you have the right to receive your personal information in a structured, commonly used, and machine-readable format, or to request transfer to another controller.
Right to object (Article 21): you have the right to object to processing based on our legitimate interests or for direct marketing purposes.
Right to withdraw consent (Article 7(3)): where we rely on your consent, you have the right to withdraw it at any time.
Right to lodge a complaint (Article 77): you have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, please contact us at contact@neatico.com. We will respond to your request within 30 days. There is no fee for exercising your rights, unless your request is excessive, repetitive, or manifestly unfounded, in which case we may charge a reasonable fee.

10. International Data Transfers

Your personal information may be transferred to, and processed in, countries other than the country in which you reside. These countries may have data protection laws that differ from, and in some cases may be less protective than, the laws of your country.

When we transfer personal information from the EEA or UK to countries that have not been deemed adequate by the European Commission or UK Secretary of State, we use appropriate safeguards to ensure an adequate level of protection, including:

Standard Contractual Clauses (SCCs): we use the European Commission's Standard Contractual Clauses for transfers to third countries.
Data Processing Agreements (DPAs): we enter into DPAs with our service providers that include appropriate data protection safeguards.
Encryption and security measures: we implement technical measures to protect personal information during transfer and storage.

For more information about international data transfers or to obtain a copy of the relevant safeguards, please contact us at contact@neatico.com.

11. Cookies & Tracking

We use cookies and similar technologies to collect information about how you interact with our website and services. For detailed information about the cookies we use, their purposes, and how to control them, please see our Cookie Notice.

You can control cookies through your browser settings. Most browsers allow you to refuse or accept cookies, delete existing cookies, and set preferences for certain websites. Please note that disabling essential cookies may affect the functionality of our website.

12. Children's Privacy

Our Service is not intended for children under the age of 16, and we do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information as soon as possible.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at contact@neatico.com.

13. California Privacy Rights (CCPA/CPRA)

If you are a resident of California, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

Right to know: you have the right to request information about the personal information we collect, use, and disclose about you.
Right to delete: you have the right to request deletion of your personal information, subject to certain exceptions.
Right to opt out of sale: we do not sell your personal information. If we were to do so in the future, you would have the right to opt out.
Right to correct: you have the right to request correction of inaccurate personal information.
Right to limit use: you have the right to limit the use of sensitive personal information.
Right to non-discrimination: we will not discriminate against you for exercising your CCPA rights.

To exercise any of these rights, please contact us at contact@neatico.com. We will verify your identity before responding to your request.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date at the top of this page. For significant changes, we may also send you an email notification or display a prominent notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the Service after the effective date of the updated policy constitutes your acceptance of the changes.

15. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: