Privacy policy
Privacy.
In plain words.
Last updated:
This policy covers calmduck.co and Google sign-in to our private client tools at {client}.calmduck.ing.
1. Who is responsible
Calmduck is owned by Durian Trading Pty Ltd in Australia.
Your organisation decides why and how to use personal data in its client tool. It is the data controller.
Calmduck operates the tool on your organisation’s instructions. For this work, Calmduck is a data processor.
Your organisation controls its database, customer data, access permissions and API keys. Ask it for its own privacy notice and data contact.
Calmduck is responsible for personal data in its own support correspondence. You can contact us at help@calmduck.co.
2. This website and email
This website has no analytics, adverts, forms or tracking scripts. The pages do not set cookies or store data in your browser.
Cloudflare hosts this website. It processes technical request data, such as your IP address, to deliver the pages and protect the service.
If you email us, we receive your email address and message. We use them to answer your request.
3. Google sign-in
Client tools are for invited staff. There is no public account registration.
When you use “Sign in with Google”, Google supplies:
- Your name and email address.
- Your profile picture address.
- Your Google account identifier.
- Your Google Workspace domain, where present.
The sign-in permissions are openid, email and profile. They do not give us access to your email messages, files or contacts.
We use these details to check your identity and invitation, keep you signed in, and protect access to the tool.
We do not use Google sign-in data for advertising or profiling. We do not sell it.
Business data connections are separate from Google sign-in. Your organisation controls those connections and their permissions.
4. Service providers
These providers process data to supply sign-in and the client tool:
- Confirms your identity through your Google account.
- Cloudflare Access
- Checks access to the service. Its sign-in cookie lasts 24 hours.
- Supabase
- Holds account and session data in Singapore. Session data in your browser keeps you signed in.
- Google Cloud
- Hosts application services in Bangkok and Singapore.
Google and Cloudflare use international infrastructure. Their processing is not limited to the application’s hosting regions.
We share sign-in data with these providers only as needed to supply and protect the service. We may also disclose data when the law requires it.
5. How long records stay
Service logs record events such as sign-in attempts, requests and security checks. They may include an account identifier, IP address and time.
| Record | Period |
|---|---|
| Cloudflare Access logs | 24 hours |
| Supabase API and database service logs | 1 day |
| Supabase sign-in audit logs in its log service | 1 hour |
| Google Cloud general logs | 30 days |
| Google Cloud security audit logs | 400 days |
These periods apply to service logs. They do not set a deletion date for account records, audit records held in the database or backups.
Your organisation controls those records and their retention rules. Backups can retain a copy after a record is removed from the live database.
Ask your organisation or contact us for the retention and deletion rules that apply to your account.
6. Your data requests
To request access, correction or deletion, contact your organisation or email help@calmduck.co.
For client data, we refer the request to your organisation and help it respond. We may need to confirm your identity first.
For correspondence with Calmduck, we handle the request ourselves. Legal duties can limit which records may be deleted.
7. Google’s data policy
Calmduck’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.