Privacy notice
Your data, explained plainly.
In force from: [date to be set when Dugzi opens to the public] · Last updated 28 October 2026
This notice explains what personal data Dugzi uses, why, where it is kept, who else handles it, how long we keep it and what your rights are. It covers Dugzi Account, Dugzi Mail, Dugzi Contacts and this website.
The short version
- We store your data in the European Union, with European companies.
- We use your data to run Dugzi for you and to keep it safe. We do not sell it, we do not show advertising, and we do not use your content to train AI.
- Some features learn from how you use them, for example which messages you mark as spam. That learning is used only for you, and it is deleted with your account.
- Our staff do not read your mail or contacts as a matter of routine. Access happens only in the narrow cases described below, and it is recorded.
- You can see, download, correct and delete your data. Write to privacy@dugzi.com for anything the product does not let you do yourself.
1. Who we are
Dugzi is a trade name of AskOwlo B.V., Kattenburgerhof 96, 1018 KG Amsterdam, the Netherlands, Chamber of Commerce (KvK) number 97409618. We decide how and why your personal data is used for Dugzi, so we are its "controller" under the EU's General Data Protection Regulation (GDPR).
- Questions about your data or this notice: privacy@dugzi.com
- Help with Dugzi: support@dugzi.com or +31 20 308 6624
We have not appointed a data protection officer. Our managing director is responsible for data protection and reads every message sent to privacy@dugzi.com.
If an organisation manages your account. A business or other organisation may set up Dugzi for its people and decide what happens to their work content. That organisation is then the controller of that content, and we handle it on its instructions, under a separate agreement. Its own privacy notice then explains its purposes. We stay the controller for your account, its security and our own legal duties.
2. What we use, why, and our legal basis
The GDPR lets us use personal data only for a clear purpose and on a "legal basis". We use four:
- Contract: we need the data to give you the service you signed up for.
- Legitimate interest: we have a genuine reason, such as keeping accounts and mail safe, that does not override your interests and rights. You can object to this use (see your rights).
- Legal obligation: the law requires it.
- Consent: you said yes, and you can withdraw that at any time.
| What | Personal data, and where it comes from | Why, and the legal basis |
|---|---|---|
| Your account | Your name, your Dugzi address, date of birth, your answer to a gender question (you can choose "Prefer not to say"), mobile number, an optional recovery email address, your passkeys and sign-in app setup, and your settings. You give us these, and some are created as you use Dugzi. | To create and run your account, check that you are 16 or older, sign you in and help you back in: contract. To stop fake accounts and account takeovers: legitimate interest in security. |
| Sign-in and security | When and from which device you sign in, IP addresses and related security details, which sign-in methods you use, records of codes and messages we sent you, recovery attempts and any protective limits on the account. | To sign you in and help you recover your account: contract. To protect accounts and investigate abuse: legitimate interest in security. We never receive the private part of your passkeys. |
| Your messages and attachments, addresses, routing details and times, folders, flags, drafts, settings and delivery records. They come from you, from the people who write to you and from their mail providers. | To store, show and deliver your mail: contract. For the people you write with: our legitimate interest in delivering and storing the messages you send and receive. | |
| Contacts | The names, email and phone numbers, postal addresses, notes and groups you save or import. | To keep the address books you choose to keep: contract. For the people in them: our legitimate interest in giving you this service. Sharing address books with others is not offered yet. |
| Spam and safety checks | Spam scores, virus results, signals about a sender's reputation, your decisions about senders, and the learning from your own spam corrections (see section 3). | To protect you, the people you write to and the service: legitimate interest in security. These records are personal data, and we treat them that way. |
| Moving your mail in | Files you upload to import, the progress of the import job, and messages forwarded from your old address. | To copy or forward your mail at your request: contract. We never ask for the password of your old mail account. |
| Notifications | What we notified you about and whether you read it, why a notification was held back, and which summary emails we sent. | To notify you as you chose and avoid repeating ourselves: contract. |
| Support and feedback | What you send us, our notes on your request, and feedback you choose to give. | To help you: contract. To improve and secure Dugzi: legitimate interest. Where the law requires us to keep a record: legal obligation. |
| Terms and choices | Which version of our terms you accepted and when, and the choices you made in Dugzi. | To keep to our agreement and show what you agreed to: contract and legal obligation. You do not "consent" to this notice; we simply tell you what we do. |
| Research, if you take part | Recordings and notes from a research session, described in a separate research notice before you start. | Consent. You can withdraw at any time without affecting your account. |
What you must give us. To open an account you must give your name, a Dugzi address, your date of birth and a mobile number we can verify by text message. Without them we cannot open or protect the account. A recovery email address, profile details and research are your choice.
Your mobile number. We send a code by text message when you sign up, and you can also use text-message codes to sign in or get back into your account. When you prove that you control a number, we show you the Dugzi accounts linked to that number, with their names and addresses, so you can pick yours. If the account has another sign-in method set up, you must also use that method or wait seven days before you get in. We never use your number to let other people find you, and we never use it for marketing.
Sensitive information. Mail and notes can contain sensitive details about you or others, such as health or beliefs. We handle them only to store, deliver and protect your mail, never for any other purpose.
3. Personalisation from your own use
Some Dugzi features get better by learning from how you use them. That learning is about you and is used only for you.
| What the product learns | What it is for | Legal basis |
|---|---|---|
| Messages you mark as spam or not spam | Your own spam filter gets better at sorting your mail | Legitimate interest in security |
| Senders you allow, block or set aside, and conversations you mute | Mail is sorted the way you asked | Contract |
| The people you write to, and how often and how recently | Suggesting addresses as you type | Legitimate interest in making Dugzi easier to use |
| Items and views you used recently | Bringing you back to where you were | Contract |
- This data stays tied to your account. It is used for you alone, never to make suggestions to anyone else.
- Our staff never see it in a form that identifies you.
- We keep it while you have your account. Deleting your account deletes it.
- You can object to suggestions based on legitimate interest by writing to privacy@dugzi.com; we then stop using that data for suggestions.
Anything our staff analyse is anonymous. When people at Dugzi look at how the products are used, they see only totals for groups large enough that nobody can be singled out. Today we do not collect usage statistics. Before we start, we will update this notice and tell you how to object.
4. If you don't have a Dugzi account
You may write to a Dugzi member, or a member may save your details in an address book. We then hold your name, address and the content of your messages. We get this from that member, from you or from your mail provider. We use it only to deliver and store the member's mail and contacts, never for advertising. Access is restricted in the same way as for members.
You have the same rights as members (see your rights). Write to privacy@dugzi.com. We check requests carefully and protect the privacy of others: we will never give anyone access to a member's mailbox.
5. How we check mail
Automated checks look at mail to find spam, viruses and harmful attachments. No person reads mail as part of these checks.
- New incoming mail, mail forwarded from your old address, the mail you send and mail between Dugzi members gets spam and safety checks.
- Mail you import from an old account is checked for viruses and harmful attachments. It is not scored for spam again, and its spam or junk folder is kept.
- If a required check cannot run, the message waits, is held, or is refused. We never let unchecked mail through instead.
- Some content, such as encrypted attachments, cannot be checked. A clean result does not guarantee that a message is safe.
- Checks can be wrong. Look in Requests and Junk, mark messages as spam or not spam, and ask support about any message you think was held by mistake.
These checks are automated, but they never make decisions about you that have legal effects or affect you in a similarly significant way. You can always ask a person at Dugzi to look again.
6. Who else handles your data
We use a few companies to run Dugzi. They handle data only on our instructions, under a contract that protects it ("processors"). We tell you at least 30 days before we add or replace one, and you can object or leave at no cost.
| Company | Where | What it does |
|---|---|---|
| Scaleway SAS | France; data in Amsterdam (Netherlands) and Paris (France) | Hosting, databases, storage and encrypted backups |
| Hetzner Online GmbH | Germany; data in Nuremberg | A second, encrypted copy of our backups |
| ONLINECITY.IO ApS (GatewayAPI) | Denmark | Sending text messages with codes and security notices. It receives your mobile number and the message text, and passes the message to your phone network. |
| Spamhaus Technology Ltd | United Kingdom and Andorra | Checking the reputation of the servers and domains that send mail. It receives the address of a sending server or a domain name, never a message. |
| DNSWL.org | Germany | Checking which mail servers are known to be trustworthy. It receives the address of a sending server or a domain name, never a message. |
Our spam and virus filters run on our own servers. Your mail is never sent to the people who make them.
Others who receive data because of what you do:
- The people you write to, and their mail providers, receive your messages and your address. Where they are, and what they do with your mail, depends on them.
- Other mail providers' feedback programmes. We take part in the feedback programmes of Microsoft, Google and Yahoo, to keep Dugzi mail out of spam folders. They give us totals per Dugzi mail server and per domain about mail their users received from us. When one of their users reports a message from Dugzi as spam, they may send us a report that can include a copy of that message. We handle and keep these reports in the EU, and use them only to protect mail delivery and stop abuse: our legitimate interest.
- Apps and providers you choose, such as a mail app on your phone or the provider that forwards your old mail to Dugzi, receive what they need under their own terms.
- Authorities, only when the law requires it (see section 8).
We do not use any other AI provider, search provider or analytics service.
7. Where your data is kept, and transfers outside the EU
Dugzi runs in Amsterdam, the Netherlands. Encrypted backups are kept in Amsterdam, in Paris (France) and in Nuremberg (Germany). This stays the same wherever you live.
Data leaves the European Economic Area (the EU, Iceland, Liechtenstein and Norway) only in these cases:
- Mail you send to someone abroad goes to their provider, wherever it is.
- A text message to a phone number outside the EU is delivered through phone networks in that country.
- Reputation checks by Spamhaus can be answered from the United Kingdom or Andorra. The European Commission has decided that both countries protect personal data adequately.
For the first two, some of these countries have no EU decision that they protect personal data adequately, and no contract with them protects it either. We send the data because it is needed to do what you asked: deliver your mail, or send you a code. The GDPR permits occasional transfers that are needed to provide a service you ask for (Article 49(1)(b)). It does not permit routine transfers on that basis, and it does not give the protection an adequacy decision or a contract would.
Write to privacy@dugzi.com if you want to know more about these transfers or the safeguards that apply.
8. Who at Dugzi can see your data
Our staff have no routine reason to read your mail or contacts. A person at Dugzi may look at your content only:
- when you ask us to, for example in a support request;
- when it is necessary to investigate a security problem or abuse; or
- when the law requires it.
Every such access must be justified, kept to what is needed, and recorded. The AI tools we use to build Dugzi never receive your content or any other data from our live service.
Requests from authorities. We check every request carefully. We refuse or challenge requests that are unlawful or too broad, hand over only what the law requires, and tell you about the request unless the law forbids it. We accept requests from outside the Netherlands only through the official legal channels that apply.
Copies on your devices. Mail apps can keep their own copies on your devices. Where Dugzi offers to keep mail on a device for offline reading, its settings explain what is stored and how to remove it (see section 12). A device that is offline cannot be wiped remotely until it reconnects. Lock your devices, and don't keep mail on a shared computer.
9. How long we keep data
We keep data only as long as we need it for the purposes above. The table gives how long we keep data, or when it expires. Deleting or expiring something starts its removal; it does not mean every copy is already erased.
| Data | How long |
|---|---|
| Mail and contacts | Until you delete them or your account. Items in Junk, Bin and Blocked are deleted after 30 days. Deleted contacts can be restored for 30 days, and merged contacts can be separated again for 31 days. |
| Personalisation, including your spam learning | For as long as you have your account. Deleted with your mailbox or your account. |
| Notifications | Whether you read a notification: 90 days. Why a notification was held back, and which summary emails we sent: 30 days. |
| Sign-in sessions | 30 days after the session ends |
| Account security events | 13 months |
| Server logs | 30 days. They can contain account identifiers and IP addresses, and we use them only to keep Dugzi secure and to fix faults, never to study what people do. |
| Text-message records, codes and sign-up attempts | 90 days. A code stops working much sooner. |
| Your mobile number | As long as your account has it. A separate record that limits how many accounts one number can create is kept for 12 months from when it was made. |
| Files you upload to import mail | They expire 24 hours after upload. Finishing or cancelling the import starts their removal sooner. A privacy restriction can delay removal, and backup copies follow the 90-day backup deadline. The imported messages are kept like the rest of your mail. |
| Reports from other mail providers' feedback programmes | Until the delivery or abuse problem they report, and any appeal about it, is resolved |
| Support requests | Until your request, and any complaint about it, is resolved |
| Which terms you accepted | While you have your account; deleted with it |
| Privacy requests (for example a request for a copy or for deletion) | 3 years after we close the request |
| Backups | We erase deleted data from backups within 90 days of its deletion. If we ever restore a backup, we delete again what you had deleted before we use it. |
When you delete your account, it is locked straight away. You have seven days to change your mind; after that we start erasing your data. Your Dugzi address is never given to anyone else. Deleting your account does not erase every record at once. Security and abuse records follow the periods listed above: text-message records 90 days, the number limit record 12 months, and account security events 13 months. Closed privacy requests are kept for 3 years. A withdrawal confirmation is available through its link for 90 days. We keep the confirmation for 90 days, or until its email has been delivered if that takes longer. Backups follow the 90-day deadline. After deleting spam learning we also keep, for 90 days, a small technical record that holds no messages and no learning; it stops delayed work from restoring what was erased. Copies of your messages held by the people you wrote to are theirs, and deleting your account does not recall them.
Sometimes the law obliges us to keep specific data for longer, for example during a legal claim. We then keep only that data, only as long as needed, and record why.
10. How we protect your data
Connections to Dugzi are encrypted. Your data is stored in the EU and kept separate per account inside our systems. You sign in with passkeys and codes, so there is no password for anyone to steal.
How is Mail encrypted?
Mail is encrypted in storage. Between Dugzi and other providers, mail is encrypted in transit whenever the receiving server supports it. Mail is not end-to-end encrypted.
This means our service can read your mail in order to deliver, store and check it. The rules in section 8 limit who at Dugzi may access it.
If personal data is lost or exposed, we report it to the Dutch Data Protection Authority within 24 hours. When it puts you at risk, we tell you without delay.
11. Your rights
Under the GDPR you can ask us to:
- give you a copy of your personal data (access);
- correct data that is wrong;
- delete your data;
- limit how we use your data (restriction);
- give you your data in a format you can take to another service (portability). Mail exports your messages as an MBOX file, a standard format other mail services can import, and Contacts exports address books as vCard files.
You can also object to any use based on legitimate interest, and withdraw consent at any time. Withdrawing does not make earlier use unlawful.
Many of these you can do yourself in Dugzi Account. For anything else, including when an export is too large or incomplete, write to privacy@dugzi.com. We reply within one month. If a request is complex and the law allows more time, we tell you why within that month. Requests cost nothing. We ask only for the information we need to confirm who you are.
Complaints. Please tell us first, and we will try to put it right. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the data protection authority where you live or work.
12. Cookies and storage on your device
A cookie is a small file a website stores in your browser. We use cookies and storage on your device only to sign you in, keep your sign-in safe and remember the choices you make. No tracking, no analytics, no advertising, and no cookies from other companies. We don't ask for consent for storage that is strictly necessary to sign you in securely or to provide a feature you ask for. That includes remembering settings you choose, such as your app-bar settings. The same rules apply to cookies and to storage on your device. If we ever wanted to store anything else, we would ask for your consent first. We list each cookie here.
This website
This website sets no cookies of its own and loads no trackers or scripts from other companies. If you use the Dugzi apps, your browser may also send the dz_bar preference cookie described below to this website.
Dugzi Account, Mail and Contacts
| Cookie | What it does | How long it lasts |
|---|---|---|
__Host-dz_acc | Keeps you signed in to Dugzi Account | Until you sign out, or at most 30 days if you chose to stay signed in, otherwise 12 hours |
__Host-dz_accs | Remembers which Dugzi accounts you can switch between on this device | As long as your sign-in; accounts you signed out of are remembered for 30 days |
__Host-dz_did | Remembers whether this is your own or a shared device, and which offline copy of your mail belongs to it | 400 days |
__Host-dz_signup | Keeps your place while you create an account | 2 hours |
__Host-dz_recovery | Keeps your place while you get back into your account | 30 minutes |
__Host-dz_mail, __Host-dz_contacts | Keeps you signed in to Mail or Contacts | Until you sign out, at most 30 days |
__Host-dz_mail_oauth, __Host-dz_contacts_oauth | Makes sure a sign-in finishes in the same browser that started it, which protects you against forged sign-ins | 10 minutes |
dz_bar | Remembers your choices for the app bar across Dugzi apps. A copy is also kept in your browser's storage. | 365 days for the cookie; the copy stays until you clear your browser's storage |
The sign-in cookies are sent only over encrypted connections and cannot be read by scripts on the page.
Storage on your device
The apps also remember choices on your device, such as theme, language, sidebar and keyboard settings. These stay on your device until you clear your browser's storage, and we never use them to track you. Dugzi Account also uses temporary storage while you sign in and while it shows a withdrawal confirmation; that is cleared when you close the tab.
If you tell Dugzi that a device is your own, Mail can keep an encrypted copy of your mail on it for reading offline and writing drafts. The copy becomes unreadable after 30 days without use. Signing out, or removing the device in Dugzi Account, deletes it. A device that is offline is only cleared when it next connects.
Your control
You can delete cookies and device storage in your browser's settings at any time. If you delete the sign-in cookies, you will need to sign in again.
13. Children, messages from us and changes
Children. You must be 16 or older to have a Dugzi account. If you think a child under 16 has an account, tell us at privacy@dugzi.com.
Messages from us. We send you messages about your account, its security and these documents. These are not marketing. We will only send you marketing if you choose to receive it.
Changes to this notice. When we change this notice in a way that matters, we tell you by email and in Dugzi. We do this before the change applies, and before any new use of your data begins. The date at the top shows when it last changed. Earlier versions are available from privacy@dugzi.com.