Privacy Policy

Last updated: August 11, 2026. This date reflects the last material revision.

This page is available in translation for convenience. The English version is the definitive version.

Dedupely Software, Inc. ("Dedupely", "we", "us") operates dedupe.ly and the Dedupely application at app.dedupe.ly (together, "the Service"). This policy explains what personal data we handle and how.

Dedupely handles two kinds of personal data, and we treat them very differently. There's data about you — as a visitor, a prospect, or an account holder. And there's the data in your CRM that you send us to deduplicate. The second kind belongs to you, not to us.

Data about you

When you visit our site, talk to us, or open an account, we collect things like your name, email address, company, postal address, IP address, device and browser information, location, and your account details. This comes from our website forms, live chat, email, calls with our team, and forms you complete on third-party platforms where we advertise, such as LinkedIn and Facebook.

We do not intentionally collect or use sensitive personal information except where necessary to provide the Service or comply with legal obligations. Dedupely is a business tool and isn't directed at children. We don't knowingly collect personal data from anyone under 16.

Support and demo calls may be recorded. We use recordings to answer your question, train our team, and improve the Service.

We use this data to run and support the Service, manage your account and billing, and send you product and marketing communications.

You can opt out of marketing at any time. We'll still send you messages about the Service itself — support responses, security notices, billing, and legal notifications such as the account deletion warning described below.

We share this data with service providers who help us run the business — including our CRM, payment processor, email and support tools, and cloud infrastructure. A full list is on our subprocessors page. We may also disclose personal data where required by law, or where necessary to protect our rights, safety or property.

Our legal basis for using your data

We process data about you on one of these grounds: to perform our contract with you (running your account, providing the Service, billing); our legitimate interests in operating, securing and improving Dedupely, and in marketing to business contacts; your consent, where we ask for it; and compliance with legal obligations such as tax and accounting rules.

For data in your CRM, you're the controller — you decide the purposes and the legal basis, and our role is set out in the Data Processing Addendum.

How long we keep it

We keep your account data for as long as your account is active, and delete it no later than 24 months after your account becomes inactive — that is, after 24 months with no active subscription or trial. Marketing contacts are kept while they remain relevant and are removed on request or when they go inactive. Billing records are kept for at least six years, as required by Canadian tax law.

Cookies

We use cookies for performance, security, login sessions, personalization, and to measure our campaigns. You can manage your preferences through the cookie banner when you visit our site, and change them at any time.

Data in your CRM

When you connect your CRM, or upload a CSV, we act as a data processor and you remain the controller of those records. You choose which objects to sync, and we process them only for the purposes you've set up in your account. Our obligations are set out in our Data Processing Addendum.

What we receive. You choose which objects to sync — contacts, companies, deals, tickets, custom objects. We process the full record for each object you select, including native and custom fields, record identifiers and metadata. In practice that usually means names, email addresses, phone numbers, postal addresses, social profile URLs, city, region and country, and created and modified dates.

What we use it for. To find duplicates, show you the matches, and apply the merges you approve or the rules you set, and to run, support and improve the Service.

What we don't do. We do not sell this data. We never market to the people in your records. We don't send it to AI services or use it to train AI models.

Who else touches it. Your data is processed and stored in the United States, in Amazon Web Services' North Virginia region and in Google Cloud. Google Cloud provides multi-regional encrypted infrastructure backups in the US. A full list is on our subprocessors page. Because we process data in the United States, transfers from the EEA, UK and Switzerland are made under the European Commission's Standard Contractual Clauses, together with the UK Addendum where applicable.

How long we keep it. We keep your CRM and CSV data, and the merge history associated with it, for as long as your account is active. An account is inactive when it has no active subscription or trial. Inactive accounts are deleted no later than 24 months after they become inactive, along with all CRM or CSV data. We send a notice to the email address on the account two weeks before deletion.

You can also request account deletion at any time, and we will complete it within 30 days. Once data is deleted from our production systems, it is removed from our backups within 7 days.

How it's protected. Access to your CRM data is limited to authorized Dedupely personnel who need it to operate the Service and support you. Data is encrypted in transit and at rest. Our controls are certified against ISO 27001, ISO 27017, and ISO 27018.

You can help protect your account by using a strong, unique password and enabling two-factor authentication. IP allowlisting is also available. If you think your account has been compromised, contact us immediately.

Your rights

You have the right to know what personal information we collect, to access the personal data we hold about you as a visitor, prospect or account holder, to have it corrected if it's wrong, and to ask us to delete it. You can also ask us to restrict how we use it, object to certain uses, and receive a copy in a portable format. Where we rely on your consent, you can withdraw it at any time — that doesn't affect anything we did before you withdrew it.

To exercise any of these, email compliance@dedupe.ly. We'll respond within 30 days. To protect your data, we'll verify who you are before acting on a request — usually by confirming it came from the email address on your account, or from an address at your company's domain. We may request additional information reasonably necessary to verify your identity before fulfilling a request. We won't discriminate against you for exercising your privacy rights. You also have the right to complain to your local data protection authority.

Changes to this policy

We may update this policy from time to time. Changes take effect when we post the revised policy here, or when we give notice as required by law, whichever is later. If we make material changes, we'll notify you by email or with a notice on our website.

Contact us

Dedupely Software, Inc.

11871 Horseshoe Way #1103

Richmond, BC V7A 5H5

Canada

compliance@dedupe.ly