Privacy Policy

1. Introduction

DualBlaster ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our SMS and Email marketing platform.

By using DualBlaster, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, do not use our services.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect:

• Name and email address
• Company name and business information
• Password (stored in hashed form using bcrypt)
• Billing information and subscription tier

2.2 API Credentials

To enable messaging functionality, you provide your own third-party API credentials:

• Twilio credentials: Account SID, Auth Token, and phone numbers for SMS campaigns
• SendGrid credentials: API Key and sender email addresses for email campaigns
• Amazon SES credentials: AWS Access Key ID, Secret Access Key, AWS region, and sender email addresses for email campaigns

2.3 Contact Data

When you import or create contacts, we store:

• Contact names, email addresses, and phone numbers
• Custom fields you choose to import
• Contact list memberships and segments
• Opt-out and unsubscribe status

2.4 Campaign and Usage Data

We collect data about your platform usage:

• Campaign content, recipients, and scheduling
• Message delivery status and results
• Monthly SMS and email send volumes
• Platform feature usage and preferences

2.5 AI-Generated Content

When you use our AI Message Composer feature, we process:

• Your message descriptions and prompts
• Selected tone and style preferences
• Generated message content (stored only if you save or send the campaign)

3. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain our platform
• Process and execute your SMS and email campaigns via your connected Twilio, SendGrid, and/or Amazon SES accounts
• Track your usage for billing and plan limits
• Generate AI-powered message content when requested
• Send you service-related communications (account alerts, usage notifications)
• Improve and personalize your experience
• Detect, prevent, and address technical issues or abuse
• Comply with legal obligations

4. Third-Party Services

Our platform integrates with the following third-party services. Your use of these services through our platform is subject to their respective privacy policies:

4.1 Messaging Providers (Your Accounts)

• Twilio: SMS delivery service. Messages are sent directly from your Twilio account. See Twilio's Privacy Policy
• SendGrid (a Twilio product): Email delivery service. Emails are sent directly from your SendGrid account. See Twilio's Privacy Notice
• Amazon SES: Email delivery service. Emails are sent directly from your AWS account. See the AWS Privacy Notice

Each of these providers is an independent company with its own privacy policy, which governs the data you send through your account with them. DualBlaster is an independent software layer and is not affiliated with or endorsed by Twilio, SendGrid, or Amazon Web Services. We transmit your campaign content and recipient phone numbers or email addresses to the provider you selected solely to carry out the sends you request, using the credentials you supplied; we do not sell or share that data with these providers for any other purpose.

4.2 AI Services

Our AI Message Composer may use third-party AI providers (such as Fireworks AI) to generate content. Your prompts and generated content may be processed by these providers according to their privacy policies and data handling practices.

5. Data Retention

We retain your data as follows:

• Account data: Retained while your account is active and for 30 days after deletion request
• API credentials: Deleted immediately upon your request or account termination
• Contact data: Retained while your account is active; deleted within 30 days of account termination
• Campaign history: Retained for 12 months for your records, then archived
• Usage records: Retained for billing and compliance purposes for 7 years

6. Data Security

We implement industry-standard security measures to protect your information:

• Encryption at rest: API credentials are encrypted using AES-256-GCM
• Encryption in transit: All data is transmitted over HTTPS/TLS
• Password security: Passwords are hashed using bcrypt with salt
• Access controls: Role-based access with authentication via secure JWT tokens
• Infrastructure security: Regular security updates and monitoring

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

7.1 Access and Portability

You can access and export your data at any time through your account settings. This includes your contacts, campaign history, and usage data.

7.2 Correction

You can update your account information and contact data directly through the platform.

7.3 Deletion

You can delete your account through the Settings page. Upon deletion:

• Your API credentials are immediately and permanently deleted
• Your contacts and campaigns are deleted within 30 days
• Some data may be retained for legal compliance

7.4 GDPR Rights (EU Users)

If you are in the European Union, you have additional rights under GDPR including the right to object to processing, right to restrict processing, and right to lodge a complaint with a supervisory authority.

7.5 CCPA Rights (California Users)

California residents have the right to know what personal information is collected, request deletion, and opt-out of the sale of personal information. We do not sell personal information.

8. Cookies and Tracking

We use essential cookies to:

• Maintain your authenticated session
• Remember your preferences
• Ensure platform security

On eligible public pages we use Google Analytics with first-party _ga cookies (up to 13 months) to measure page views, sessions, approximate country, device and browser. Google receives a pseudonymous cookie identifier and technical connection information. We send approved public paths and referring website hosts, never private page URLs, query parameters, form contents, account IDs or contact details. Admin, login, account, payment and other private pages are excluded. Enhanced measurement, Google signals and advertising personalization are disabled. We do not share this data with advertisers.

Analytics is disabled for EEA/UK visitors, unknown locations, saved opt-outs, Global Privacy Control and Do Not Track. You can change your browser preference below; clearing browser storage may remove it. Cloudflare separately processes traffic for delivery, security and aggregate operational reporting; this control stops Google Analytics, not necessary service processing.

9. Children's Privacy

DualBlaster is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers in compliance with applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the platform after changes constitutes acceptance of the updated policy.