Loading Due Agent...
Last Updated: November 2025
Effective Date: November 2025
OPTFLOW AI LIMITED, trading as Due Agent ("we", "our", or "us"), is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our professional automated billing notification and payment reminder service.
We are a UK-based company and the data controller responsible for your personal data under the General Data Protection Regulation (GDPR), UK GDPR, and other applicable data protection laws.
Data Location: All personal data is processed and stored exclusively within the European Union (United Kingdom and EU regions) to ensure full GDPR compliance.
Legal Entity: OPTFLOW AI LIMITED
Trading Name: Due Agent
Company Number: 14990157
Registered Office: 43 Fairfoot Road, London, England, E3 4EG
Jurisdiction: United Kingdom
Contact Email: privacy@dueagent.com
Data Protection Officer: dpo@dueagent.com
We process your personal data under the following legal bases as defined by GDPR:
You have the following rights regarding your personal data:
You can request a copy of all personal data we hold about you. We will provide this in a machine-readable format within one month of your request (which may be extended by a further two months for complex requests, as permitted by UK GDPR Article 12).
You can correct inaccurate or incomplete personal data through your dashboard or by contacting us.
You can request deletion of your account and personal data. Note: We must retain certain financial records for 7 years to comply with legal obligations.
You can receive your data in JSON format and transfer it to another service provider.
You can object to processing based on legitimate interests, including marketing communications and analytics tracking.
You can request temporary suspension of data processing while we resolve disputes about accuracy or lawfulness.
You can withdraw consent at any time for marketing and analytics. This will not affect processing based on other legal bases.
Exercise Your Rights
Visit your Privacy Settings to export data, manage consents, or delete your account. For assistance, contact privacy@dueagent.com.
We share your data with the following trusted third-party processors under Data Processing Agreements (DPAs):
Purpose: User authentication and session management
Location: European Union (London, eu-west-2) | EU Data Storage | DPA: Available upon request
Purpose: Email delivery infrastructure for both transactional and marketing communications
Email Types Processed:
Bounce & Complaint Handling: AWS SES automatically processes email bounces (hard and soft) and spam complaints. Invalid email addresses are added to our suppression list to prevent future sending attempts. Complaint data is retained for abuse prevention and sender reputation management.
Location: European Union (London, eu-west-2) | GDPR Compliant | DPA: Available at aws.amazon.com/compliance/gdpr-center
Purpose: AI-powered email generation
Location: European Union (Belgium, europe-west1) | GDPR Compliant | Data Retention: Configurable retention policy | DPA: Available at cloud.google.com/terms/data-processing-addendum
Purpose: Background job processing, workflow orchestration, and serverless caching
Location: European Union (Frankfurt, eu-central-1) | GDPR Compliant | DPA: Available at upstash.com/trust/dpa
Purpose: Application hosting and CDN services
Location: European Union regions configured | Transfer Mechanism: Standard Contractual Clauses | DPA: Available at vercel.com/legal/dpa
Purpose: Subscription billing and payment processing
Location: Europe, United States | Transfer Mechanism: EU-US Data Privacy Framework certified | DPA: Available at stripe.com/legal/dpa
Purpose: Accounting system integration (when you connect)
Location: Per your Xero/QuickBooks account configuration | Covered by your provider agreement
International Data Transfers (GDPR Chapter V)
The majority of our core processing infrastructure is located within the European Union to ensure full GDPR compliance and data sovereignty. All authentication, email delivery, AI processing, and background job processing occurs exclusively within EU regions (London, eu-west-2 and Belgium, europe-west1).
Where we use processors that operate internationally (such as Stripe for payments or Vercel for hosting), we ensure that all international data transfers comply with GDPR Chapter V requirements through appropriate safeguards:
We continuously monitor legal developments regarding international data transfers, including guidance from the European Data Protection Board (EDPB) and decisions from the Court of Justice of the European Union (CJEU), to ensure ongoing compliance.
You have the right to request copies of the safeguards we have in place for international transfers, including our Standard Contractual Clauses and transfer impact assessments, by contacting privacy@dueagent.com.
UK GDPR Compliance Note
As a UK-based data controller, we comply with UK GDPR requirements for international data transfers. We rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs where appropriate.
We retain your personal data only as long as necessary for the purposes outlined in this policy:
| Data Type | Retention Period | Reason |
|---|---|---|
| Active accounts | Duration of service | Contract performance |
| Closed accounts | 7 years | Legal obligation (accounting) |
| Client records | 7 years post-deletion | Business records requirement |
| Invoices and payments | 7 years | Tax and accounting laws |
| Audit logs | 7 years (anonymized) | GDPR accountability |
| Web analytics | 90 days | Performance optimization |
| Email engagement metrics | 90 days (aggregated) | Email deliverability optimization |
| Email bounce/complaint data | 2 years | Sender reputation and anti-spam compliance |
| Suppression list (unsubscribes) | Indefinite | Legal obligation (must honour opt-outs permanently) |
Email Data Retention Note
Email addresses on our suppression list (due to unsubscribes, bounces, or complaints) are retained indefinitely to ensure we never send unwanted emails. This is a legal requirement under anti-spam regulations. You can request removal from the suppression list by contacting privacy@dueagent.com, but we must verify the request to prevent abuse.
We implement industry-leading technical and organisational security measures to protect your personal data in accordance with GDPR Article 32:
Privacy by Design and Default
In accordance with GDPR Article 25, we implement data protection principles by design and by default. This means we build privacy considerations into our systems from the ground up, ensuring that only necessary data is processed, with appropriate security measures, and that privacy settings are set to the most protective level by default.
When you use Due Agent to send payment reminders to your clients, you act as the data controller for your clients' personal data, and we act as your data processor. You are responsible for:
A Data Processing Agreement (DPA) is available in your account settings, which sets out the terms under which we process your clients' data on your behalf, in accordance with GDPR Article 28.
Important Legal Requirement
You must have appropriate legal grounds (such as contract performance or legitimate interest) to send payment reminders to your clients. Ensure your own terms of business and privacy policy cover the use of automated payment reminder services.
We use cookies and similar technologies for the following purposes:
You can manage your cookie preferences through the cookie banner that appears on your first visit or via your Privacy Settings.
Cookie Retention Periods
We collect email addresses through the following legitimate methods:
We never: Purchase email lists, scrape email addresses from websites, use harvested addresses, or send to addresses obtained without explicit permission or legitimate business relationship.
These emails are essential to our service and cannot be opted out of while you maintain an active account:
Legal Basis: Contract Performance (GDPR Article 6(1)(b)) - these emails are necessary to provide the service you requested.
We will only send you marketing communications if you have explicitly opted in. Marketing communications may include:
Legal Basis: Consent (GDPR Article 6(1)(a)) and compliance with the Privacy and Electronic Communications Regulations (PECR) 2003.
Every marketing email includes a clear and conspicuous unsubscribe link in the footer. You can unsubscribe from marketing communications at any time by:
Once you unsubscribe, your email address is added to our permanent suppression list and you will not receive further marketing emails. Unsubscribe requests are processed within 10 business days.
We comply with international anti-spam regulations including:
Company Contact Information
As required by CAN-SPAM and other anti-spam regulations, our physical postal address appears in all marketing emails:
OPTFLOW AI LIMITED (trading as Due Agent)
43 Fairfoot Road, London, England, E3 4EG
Company Number: 14990157
Email: privacy@dueagent.com
We actively monitor and manage email deliverability to maintain our sender reputation and comply with anti-spam best practices:
For Users Sending Payment Reminders
When you use Due Agent to send payment reminders to your clients, you are responsible for ensuring you have appropriate legal grounds to contact them (typically contract performance or legitimate interest). We recommend including unsubscribe options in your own terms of business. Our bounce and complaint data helps you maintain clean contact lists and comply with anti-spam requirements. See Section 10 for your responsibilities as a data controller.
In the unlikely event of a data breach, we will:
We use AI technology (Google Vertex AI) to generate personalised email content for payment reminders. This processing does not constitute automated decision-making as defined by GDPR Article 22, as:
We do not engage in profiling activities that would produce legal effects or similarly significantly affect data subjects. Our usage analytics are aggregated and anonymised for service improvement purposes only.
In accordance with GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. Our service design ensures human oversight of all material decisions.
Due Agent is a business-to-business (B2B) service not directed at children under the age of 16. We do not knowingly collect personal data from children. If we discover we have inadvertently collected such data, we will delete it immediately and notify the parent or guardian.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will:
We encourage you to review this Privacy Policy periodically.
If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:
Email: privacy@dueagent.com
Data Protection Officer: dpo@dueagent.com
Privacy Settings: /dashboard/settings/privacy
You have the right to lodge a complaint with a supervisory authority if you believe we have violated your data protection rights.
Legal Disclaimer: This is a template for informational purposes. Whilst we have endeavoured to ensure accuracy and compliance with applicable regulations, you should consult with a qualified solicitor for legal advice specific to your situation.
© 2025 OPTFLOW AI LIMITED, trading as Due Agent. All rights reserved.