Privacy Policy

The data controller is Duckling Media ApS (CVR 43764810), Overgaden oven Vandet 98, DK-1415 Copenhagen, Denmark. You can reach us about anything in this policy at contact@duckling.co.

We only collect what we need to give you Duckling:

• Your account. Your name, email address, phone number (used to send you a verification code when you log in), and a securely stored (hashed) password.
• Your profile. Anything you choose to add about yourself, such as a short bio.
• Your membership and payments. If you become a paid member, your subscription tier and billing status. Card payments are handled by our payment provider; we never see or store your full card number.
• The stories you make. The documentary stories you create and publish, including the photos, video, text, and audio in them.
• Basic technical data. Limited logs such as device and browser type and IP address, which we use to keep the service secure and working.
• Messages to us. What you write when you contact us or sign up for our newsletter.

We use your data for clear purposes, each with a lawful basis under the GDPR:

• To run your membership and the platform, including your account, your stories, and the community. (Legal basis: performing our contract with you.)
• To process payments and keep proper accounts, including invoices and tax records. (Legal basis: performing our contract, and our legal obligations under Danish bookkeeping and tax law.)
• To keep Duckling safe and working, such as preventing abuse and fixing problems. (Legal basis: our legitimate interest in a secure, reliable service.)
• To send you our newsletter, if you have asked for it. (Legal basis: your consent, which you can withdraw at any time.)

We think this matters as much as what we do, so we will say it plainly:

• We do not sell your personal data, ever.
• We do not profile you or rank your feed by tracking your behaviour.
• We do not run behavioural or targeted advertising.
• We do not use your data to make automated decisions about you.

We keep your circle of data small. We use a few trusted providers to run Duckling, and they may only process your data on our instructions, under a data processing agreement. As things stand, these include:

• Stripe for payments and billing.
• Google Cloud for hosting Duckling and storing your stories.
• Twilio for sending a verification code to your phone when you log in.
• GitHub for hosting the source code the site and app are built from.
• Netlify for building and serving the website.
• SendGrid for sending the emails you get from us, such as confirmations, reminders and the newsletter.
• Airtable for keeping sign-ups to community sessions, Seed Grant applications, and the questions and answers on the Community page.
• Proton Mail for the inbox that receives what you write to us.

We share data with public authorities only where the law requires it. We do not otherwise pass your data to anyone else.

Most of your data is stored within Europe. A few of the providers above are based outside the EU and may handle some data elsewhere, for example when processing a payment, sending an email or a verification text, or keeping session sign-ups and Seed Grant applications. Where that happens, we rely on the safeguards the GDPR requires, such as the European Commission’s Standard Contractual Clauses, so your data keeps its protection wherever it travels.

We keep your data only as long as we need it:

• Account and profile data, for as long as you are a member. When you delete your account, we delete this data immediately.
• Payment and accounting records, for as long as Danish bookkeeping law requires (currently five years from the end of the relevant financial year).
• Your stories, until you unpublish or delete them, subject to the note on shared copies in our Legal Terms.
• Newsletter data, until you unsubscribe.

When a period ends, we delete or anonymise the data.

The GDPR gives you strong rights over your data, and we will always help you use them. You can ask us to:

• See the data we hold about you.
• Correct anything that is wrong.
• Delete your data, the right to be forgotten.
• Limit or object to how we use it.
• Give you a copy of your data in a portable format.
• Withdraw your consent at any time, where we relied on it.

To exercise any of these, just write to contact@duckling.co. We will respond within the time the law allows, normally one month.

If you feel we have handled your data wrongly, you can complain to the Danish Data Protection Agency, Datatilsynet (Carl Jacobsens Vej 35, 2500 Valby; datatilsynet.dk). We would appreciate the chance to put it right first, but it is your call.

We use only the cookies we need to keep you logged in and the service running. We do not use cookies to track you across the web or for advertising, and we do not use any web analytics tools.

You need to be at least 13 to use Duckling. We do not knowingly collect data from anyone younger. If you believe a child has given us their data, write to us and we will remove it.

Documentary storytelling involves real people. If you publish a story, you are responsible for having the rights and consents needed for anyone identifiable in it, as set out in our Legal Terms. If you appear in a story and want to raise a concern, contact us and we will help.

We may update this policy as Duckling evolves. If a change meaningfully affects you, we will let you know in good time rather than quietly editing the page.

Duckling Media ApS · Overgaden oven Vandet 98, DK-1415 Copenhagen, Denmark · contact@duckling.co

Free your story.