Last updated: 5 October 2026
1. Who we are
DoubleU Ltd (“DoubleU”, “we”, “us”) develops and operates web applications, BaseLayer services, AI-assisted tools, hosted services, APIs, automation systems and related digital products.
For personal data that DoubleU collects for its own business purposes, DoubleU is the data controller. You can contact us at hello@doubleu.ie.
2. When DoubleU acts for a client
Some DoubleU systems operate in the background of websites or services belonging to our clients. In those cases the client will often determine why personal data is processed and will act as the data controller, while DoubleU processes the data on the client’s instructions as a processor.
If your query relates to a service operated by one of our clients, you should normally contact that organisation first. We will assist our client with data protection requests where required.
3. Information we may process
Depending on the service you use, we may process:
- contact details such as your name, email address, telephone number and organisation;
- account details, login information, access permissions and authentication records;
- communications, support requests and information you choose to send us;
- business content, documents, images, prompts or other information uploaded to a DoubleU service;
- technical information such as IP address, browser or device information, timestamps, application logs and security events;
- billing, subscription and transaction records. Payment card data may be handled directly by a payment provider rather than stored by DoubleU;
- usage information needed to operate, secure, troubleshoot and improve our services.
4. Why we use personal data
| Purpose | Typical lawful basis |
|---|---|
| Provide accounts, software, hosting, support and contracted services | Performance of a contract, or steps requested before entering a contract |
| Operate, secure, monitor and troubleshoot our systems | Legitimate interests in operating secure and reliable services; legal obligations where applicable |
| Respond to enquiries and manage business relationships | Legitimate interests, contract or pre-contract steps |
| Billing, accounting, tax and legal record keeping | Contract and legal obligations |
| Optional analytics or other non-essential tracking | Consent where required |
| Improve products using aggregated or appropriately minimised service information | Legitimate interests, subject to data protection safeguards |
Where we rely on legitimate interests, we consider the necessity of the processing and the rights and interests of the people affected.
5. Artificial intelligence
Some DoubleU services include AI-assisted features. When you use such a feature, information needed to perform the requested task may be sent to an AI service provider or other subprocessor used by DoubleU.
We aim to minimise the information sent to external providers and use appropriate contractual and technical safeguards. The particular provider or model may change as services evolve. Where AI processing is carried out on behalf of a DoubleU client, the client’s instructions and data processing terms also apply.
AI output can be inaccurate or incomplete. Important decisions should not be made solely from AI-generated output without appropriate human review.
6. Who we share information with
We may share personal data with suppliers and subprocessors where necessary to provide our services, including providers of:
- hosting, infrastructure, storage and backups;
- email and communications;
- artificial intelligence and data processing services;
- payment processing and billing;
- analytics, monitoring and security services;
- professional legal, accounting or technical services.
We may also disclose information where required by law, to protect our legal rights, or in connection with a legitimate corporate restructuring or sale. We do not sell personal data as a product.
7. International transfers
Some service providers may process information outside Ireland or the European Economic Area. Where a transfer requires safeguards under data protection law, we use an appropriate lawful transfer mechanism, such as an adequacy decision or approved contractual safeguards.
8. How long we keep information
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide an active service, maintain security and backups, resolve disputes, and meet accounting, tax or other legal obligations.
Retention periods vary by data type and service. When DoubleU acts as a processor, retention and deletion are also governed by the relevant client agreement and instructions.
9. Security
We use technical and organisational measures appropriate to the service and the risks involved. These may include authentication, access controls, encrypted communications, restricted administrative access, logging, patching, backups and security monitoring.
No internet-connected service can be guaranteed to be completely secure. If you believe a DoubleU service has a security issue, contact hello@doubleu.ie.
10. Cookies and similar technologies
DoubleU sites may use strictly necessary cookies or similar storage required for security, login sessions, preferences or core functionality. These do not normally require consent where they are strictly necessary to provide a service you requested.
Where a DoubleU site uses analytics, advertising or other non-essential tracking that requires consent, it should not be activated until you have made the relevant choice. The site should provide a way to accept, reject and change those preferences.
Site-specific cookie information: each DoubleU site must maintain an accurate cookie inventory showing the cookies or storage technologies actually used, their purpose, provider and duration. This section must not be treated as a substitute for that site-specific inventory.
11. Your data protection rights
Depending on the circumstances, you may have rights to:
- access your personal data;
- correct inaccurate or incomplete data;
- request deletion;
- restrict processing;
- object to certain processing;
- receive certain data in a portable format;
- withdraw consent where processing is based on consent, without affecting earlier lawful processing;
- receive information about certain automated decision-making where applicable.
To exercise a right in relation to data for which DoubleU is controller, contact hello@doubleu.ie. We may need to verify your identity before responding.
12. Complaints
You may raise a privacy concern with us at hello@doubleu.ie. You also have the right to complain to the Irish Data Protection Commission. Information is available at dataprotection.ie.
13. Changes to this notice
We may update this notice when our services, suppliers or legal obligations change. The current version will be published on the relevant DoubleU site with its latest update date.
Site-specific information — DoubleU services
This supplementary information describes the services checked on 5 October 2026. It supplements, and does not replace, the notice above.
Additional DoubleU administration services: this notice also applies to the DoubleU-operated BaseLayer administration service at saas.fi-x.ie, and DoubleU Pilot at doubleu.ie/pilot/. This supplement does not extend the notice to independently operated customer websites or other services merely hosted on these domains.
DoubleU and Go-Pilot public pages
The Go-Pilot enquiry form is not connected to a form-processing service. Please use its email enquiry link to contact us. Go-Pilot loads images from Unsplash, whose servers receive technical request information such as your IP address and browser information. See Unsplash’s privacy policy. The DoubleU landing page also requests a Google Fonts stylesheet before navigating to Go-Pilot; this involves a request to Google’s servers. See Google’s privacy policy.
No analytics or advertising trackers, cookies or browser-storage entries were observed in clean visits to these public landing pages. This observation does not describe signed-in services.
Cookies and browser storage
| Service / provider | Name | Purpose and category | Duration / evidence |
|---|---|---|---|
| DoubleU hosting administration | hp_session | Necessary signed-in authentication and security | 8 hours; verified in deployed configuration, set on sign-in |
| DoubleU Webmail | roundcube_sessid | Necessary webmail session/security | Browser session; observed on login page |
| DoubleU Webmail | roundcube_sessauth | Necessary signed-in authentication | Browser session; defined in application, not observed in anonymous audit |
| DoubleU Code | htmx-current-path-for-history | Session storage for page navigation/history, not analytics | Tab session; observed on public page |
| DoubleU BaseLayer administration / Pilot | bl_access_token | Necessary signed-in authentication | 15 minutes; defined by authentication service, not observed in anonymous audit |
| DoubleU BaseLayer administration / Pilot | bl_refresh_token | Necessary session renewal | 30 days; defined by authentication service, not observed in anonymous audit |
| DoubleU Pilot | doubleu_pilot_active_client, doubleu_pilot_role, doubleu_pilot_preferred_role, doubleu_pilot_knowledge_filter, doubleu_pilot_knowledge_selection, doubleu_pilot_schedule_view, doubleu_pilot_analytics_range | Local storage for selected workspace and interface preferences; the analytics range is a report-view preference, not a tracking identifier | Persistent until cleared or changed; source-confirmed, authenticated preference behaviour not browser-tested |
| DoubleU Pilot | bl_61696dac6bf7 | Necessary application session/security | Browser session; observed on the Pilot login and verified in the service |
| DoubleU BaseLayer administration | bl_csrf_token | Necessary request-security protection | Browser session; defined by the service, not observed in the anonymous landing audit |
The inventory above distinguishes observed browser behaviour from authentication storage defined by the service. Additional signed-in settings and storage require a service-specific update as they are verified. No optional analytics consent banner is added to public pages where no such tracking was observed.