Esquseo Privacy Policy

Effective date: 18 June 2026 · Last updated: 8 October 2026

This Privacy Policy explains how DUB SERVICES LLC ("DUB SERVICES", "we", "us") processes personal data through the Esquseo service at app.esquseo.com, dock.esquseo.com and store.esquseo.com (the "Service"). It is specific to Esquseo; our company-wide practices are described in the DUB SERVICES Privacy Policy. It is written to align with the EU and UK GDPR and the California Consumer Privacy Act (CCPA/CPRA).

1. Who we are

The data controller is DUB SERVICES LLC, 0009, 18/1 Zarobyan Str., Yerevan, Armenia. For any privacy request, contact [email protected].

2. What we collect

• Account data: your email address and your credit balance. Sign-in uses a one-time link sent to your email — there is no password.
• Assessment inputs: information you enter about an organization you assess — its name, country of incorporation, and optionally its website and tax identification number. These are processed to produce the assessment; we do not keep a history of your assessments.
• Dock review inputs and results: the website address you submit to Esquseo Dock; technical facts we observe when fetching that one public page (for example, the scripts and third-party services it loads, the fields its forms ask for, the cookies and security headers it sends, and whether it links to legal pages); a sample of the page’s visible text; and the review and privacy policy draft generated from them. If the page itself shows personal data — such as a contact person’s name or email — that data is processed incidentally as part of the page text. We do not store the page’s text.
• Payment and order data: credits are bought through Paddle, our Merchant of Record. From Paddle we receive what we need to add the credits to your account: your email, the pack purchased, and the transaction's identifier and status. Card and billing details are entered on Paddle's checkout; we never receive or store card details. For purchases made before 8 October 2026 by local payment in Armenian dram, we keep the order record (email, pack, amount, currency, status, and the country derived from your IP at the time of purchase) for accounting and tax purposes.
• Technical and security data: your IP address and a session cookie operate and protect the Service. We also store a small "cookie notice acknowledged" cookie and, if you choose one, an appearance-theme preference cookie (see Cookies below) — and, after account deletion, a one-way salted hash of your email used solely to prevent repeat free-trial claims.

3. How we use it, and our legal bases

• To provide the Service — accounts, running assessments, managing credits: performance of a contract (GDPR Art. 6(1)(b)).
• To run the Dock reviews you request — performance of a contract (Art. 6(1)(b)). Where the public page you submit contains personal data about other people, we process it only transiently to produce your review, based on our legitimate interests in providing the service you asked for (Art. 6(1)(f)).
• To protect the Service against abuse, fraud, and denial-of-service, and to prevent free-trial recycling: our legitimate interests (Art. 6(1)(f); Recital 47).
• To process your purchases and add credits to your account: performance of a contract (Art. 6(1)(b)). To keep order records for accounting and tax purposes: legal obligation (Art. 6(1)(c)).
• Where we ask for consent, the basis is your consent (Art. 6(1)(a)), which you may withdraw at any time.

4. Automated AI processing and web search

Assessments are produced with the help of an AI model (Claude, provided by Anthropic) together with automated web search. The information you enter is sent to these processors to generate the result. We do not use your data to train AI models. Assessment outputs are indicators for triage only and are not legal advice or a legal determination (see the Terms of Use).

Dock. To review a website, Dock fetches the single public page you submit, identifying itself with its own user agent; it does not sign in, submit forms, or go beyond that page, and it refuses private or internal network addresses. The technical facts and the page-text sample are sent to Anthropic to generate the review and the policy draft, under Anthropic’s commercial terms, which do not permit their use for model training. Dock outputs are automated drafts, not legal advice.

5. Who we share data with

We use a small set of service providers who process data on our behalf under appropriate agreements:

• Anthropic — AI processing of assessment inputs and Dock review content.
• Cloudflare — DNS, content delivery and network protection for our esquseo.com sites; processes IP addresses and request data in transit.
• Netlify — hosting and data storage.
• Resend — sending sign-in and service emails.

Paddle (Paddle.com Market Limited and its affiliates) is our online reseller and Merchant of Record for all purchases of credits, wherever you are located. As the seller of record, Paddle processes your payment, billing and tax data as an independent controller under its own Privacy Notice, and may contact you directly about your order.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

6. International transfers

Some processors operate outside Armenia and the EEA (for example, in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards such as adequacy mechanisms or standard contractual clauses.

7. How long we keep it

We keep your account data (email and credit balance) until you delete your account. We do not retain a history of assessments. Dock results — the submitted address, the technical facts and the generated review and policy draft — are kept on your account for 24 hours so you can view and download them, then deleted automatically; they are deleted at once if you delete your account. To enforce usage limits, Dock keeps short-lived hourly counters keyed to one-way hashes of your account email and IP address, deleted within a few hours. Order records are kept as needed for accounting, tax, and dispute purposes. The salted free-trial hash is retained for as long as we operate the free trial, solely to prevent abuse; it cannot be reversed into your email or linked back to you.

8. Your rights (GDPR)

You have the right to access, rectify, erase, restrict, and object to processing of your personal data, to data portability, and to withdraw consent. You can delete your account and its data at any time from within the Service. To exercise other rights, contact [email protected]. You may also lodge a complaint with your local data protection authority.

9. California privacy rights (CCPA/CPRA)

In the past 12 months we collect these categories of personal information: identifiers (email), commercial information (credits and orders), internet or network activity (IP address, cookies), and the website addresses you submit to Dock. We collect them to provide and secure the Service. California residents have the right to know, access, correct, and delete personal information, and to opt out of its "sale" or "sharing" — we do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would trigger a right to limit. We will not discriminate against you for exercising your rights. To make a request, contact [email protected].

10. Cookies

The Service uses cookies for two purposes only: keeping the Service running securely, and remembering an appearance choice you make yourself. We use no analytics, advertising, or third-party tracking cookies, and cookies are never used to build a profile of you across other sites.

• esq_session — strictly necessary. Keeps you signed in. Cleared on sign-out or when it expires.
• esq_cookie_notice — strictly necessary. Records that you've seen the cookie notice, so it isn't shown again for a week.
• esq_theme — preference, optional. Set only if you actively choose an appearance theme from the theme picker on the Service; remembers that choice across app.esquseo.com, explorer.esquseo.com, dock.esquseo.com, and store.esquseo.com so you don't have to pick it again on each. Selecting "Default" deletes it. Kept for up to 30 days.

If you type a website address into Dock before signing in, Dock keeps that address in your browser’s local storage so it can be restored after you follow the sign-in link; it is removed as soon as it has been used. This is strictly necessary to complete the review you asked for.

We also use short-lived, non-cookie markers on our servers to detect denial-of-service and credential-stuffing patterns; these are not stored in your browser and do not identify you personally.

Because the strictly necessary cookies are essential to the Service you requested, and the preference cookie is set only at your own explicit action, no consent banner gate is required under applicable ePrivacy guidance; the notice shown on your first visit is for transparency. You can block or delete cookies through your browser settings, though the Service may not function correctly without the strictly necessary ones.

11. Children

The Service is intended for organizations and professional users and is not directed to children. We do not knowingly collect personal data from children.

12. Security

We use measures such as encrypted transport (HTTPS), signed session tokens, and data minimisation to protect your data. No method of transmission or storage is perfectly secure.

13. Changes

We may update this policy; the effective date above shows the current version. Material changes will be notified through the Service.

8 October 2026: All purchases of credits, including from Armenia, are now processed by Paddle as Merchant of Record. Removed Evocabank / ArCa as a recipient and the IP-country check previously used for payments in Armenian dram (sections 2, 3 and 5), and clarified that Paddle acts as an independent controller (section 5).

29 September 2026: Added Esquseo Dock at dock.esquseo.com: the data it processes (section 2), legal bases (section 3), how reviews are generated (section 4), 24-hour retention of Dock results and usage-limit counters (section 7), and the local-storage item it uses during sign-in (section 10). Added Cloudflare to our service providers (section 5).

22 July 2026: Added the optional esq_theme appearance-preference cookie, set only when you choose a theme from the theme picker, shared across app.esquseo.com, explorer.esquseo.com, and store.esquseo.com. Itemized the Cookies section (10) to name each cookie individually.

14. Contact

DUB SERVICES LLC, 0009, 18/1 Zarobyan Str., Yerevan, Armenia — [email protected].