Privacy and Cookie Policy

In this Privacy Policy you will find information about how Dune Analytics AS ("Dune") processes your personal data when you use our website and our Dune Products. At the end of this policy, you will find our Cookie Policy, providing information about Dune's use of cookies.

References to "we" and "us" in the following refers to the company Dune Analytics AS.

Dune is the controller of the processing activities described in this policy.

This Privacy Policy assists you as a user of the Dune Product to understand which Personal Data we collect, why we collect Personal Data, how we use Personal Data and the data privacy rights you have as a user of the Dune Product.

Dune collects personal data for the purposes of providing the Dune Product, website analysis and improvement, direct marketing, and product updates.

Personal Data is defined as any information relating to an identified or identifiable natural person.

Any processing of Personal Data by Dune is conducted in accordance with applicable data privacy legislation. We process your data for the following purposes:

We will collect and process the following Personal Data when you use the Dune Product:

• Name
• Username
• E-mail address
• IP-address
• Web browser
• Navigation information on dune.com or other domains where the Dune Product is accessible

Personal Data collected for offering the Dune Product are used in the following ways:

• To administrate and provide you with the Dune Product.
• To contact you for software updates or changes to this Privacy Policy or other agreements relevant for your use of the Dune Product.

Users should note that the social nature of the Dune Product means that anything you create with the free service will be publicly viewable. See Terms of Service for more information.

Legal basis: To fulfill an agreement with you, see article 6(1)(b) of the General Data Protection Regulation.

We will collect and process the following Personal Data for website and product analysis and improvement:

• Name
• E-mail address
• IP-address
• Web browser
• Navigation information on dune.com or other domains where the Dune Product is accessible

Personal Data collected for website analysis and improvement are used in the following ways:

• To analyze trends and usage patterns on the website
• To improve the website by adapting its configuration and design to behavioral patterns

We gather the data through the use of "cookies". Cookies are small files which are stored on your computer by your web browser.

Legal basis: We consider that we have a legitimate interest under article 6(1)(f) of the General Data Protection Regulation. Our legitimate interest consists of being able to provide and improve our services.

We may process your Personal Data and usage logs when you submit a request for troubleshooting or support for your use of the Dune Product. Such Personal Data and usage logs are not used for any other purposes than to provide you with the requested support or troubleshooting.

We will collect and process the following Personal Data for troubleshooting and support:

• Name
• E-mail address
• IP-address
• Web browser
• Navigation information on dune.com or other domains where the Dune Product is accessible

Legal basis: To fulfill an agreement with you, see article 6(1)(b) of the General Data Protection Regulation.

Dune Analytics AS will use your name and contact information in order to keep you updated on any product launches, software updates or similar marketing related communications related to the Dune Product. You may opt out of marketing communications by using the unsubscribe link included in such communications. We collect and use the following information for marketing purposes:

• Name
• E-mail address
• Navigation information on dune.com or other domains where the Dune Product is accessible

Legal basis: We consider that we have a legitimate interest under article 6(1)(f) of the General Data Protection Regulation. Our legitimate interest consists of our business interest in reaching out to users and send relevant information.

For the purpose of recruitment, we will process your personal data. By applying to a position on our "Careers"-site we will process the data you submit. We will process the following data, depending on what information you submit:

• Name
• E-mail
• Location
• Social media profile
• Resume
• Introduction and why you are applying for the position

The Personal Data will be used to consider whether you are a potential candidate for our positions.

Legal basis: To fulfill an agreement with you, see article 6(1)(b) of the General Data Protection Regulation.

Dune offers AI-powered features, including LLM-based chatbot services ("Dune AI"), that process your inputs to generate responses. When you use these features, your inputs may be shared with third-party artificial intelligence service providers for the purpose of generating outputs. Dune may change such service providers from time to time.

Inputs submitted to Dune AI are processed for the purpose of providing the service. You should not include sensitive personal data in your inputs. For more information on Dune AI, see the Terms of Service.

Legal basis: To fulfill an agreement with you, see article 6(1)(b) of the General Data Protection Regulation.

We retain Personal Data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required to comply with legal or regulatory obligations, resolve disputes, maintain security logs, or enforce our agreements. Account data is deleted or anonymized following a deletion request, subject to any legally required retention. Support records, billing records, security logs, and backups may be retained for limited additional periods in accordance with Dune’s internal retention and data management policies.

Dune Analytics will not share the Personal Data of its users with any third parties, except when we have legal grounds for sharing the data or it is required under any statutory obligations of which Dune Analytics AS is subject to.

We share your data with our processors (sub-processors), with the sole purpose of providing and operating the service. Key sub-processors include:

• Stripe — payment processing. Located in the US.
• Zendesk — customer support. Located in the US.
• Amazon Web Services — cloud infrastructure hosting. Located in the EU and US.
• Amplitude — product analytics. Located in the US.
• Third-party AI service providers — powering Dune AI features, as described in section 2.6.

For all sub-processors located outside the EEA, we rely on appropriate transfer mechanisms, including EU Standard Contractual Clauses, to ensure that transfers are made in accordance with applicable data protection legislation.

Dune implements appropriate technical and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, multi-factor authentication for access to systems containing Personal Data, role-based access controls, and regular security testing. For more information, see our Trust Center.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Dune will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours. Where the breach is likely to result in a high risk to your rights and freedoms, Dune will also notify affected individuals without undue delay.

When providing us with your Personal Data, you may request access to your Personal Data, as well as information on how we process your Personal Data. You may also request rectification, erasure and restriction of the processing, as well as to have your Personal Data exported in a structured, commonly used and machine-readable format (data portability).

Requests pursuant to the above rights may submitted to: [email protected]

You may also file a complaint to your applicable data protection authority if you are of the opinion that Dune Analytics has failed to comply with your rights as a data subject.

Dune is situated in Norway within the European Economic Area (EEA). Some of our sub-processors are located outside the EEA, including in the United States. For all transfers of Personal Data outside the EEA, we ensure that appropriate safeguards are in place, including EU Standard Contractual Clauses, in accordance with Chapter V of the GDPR.

Dune Analytics reserves the right to adjust or change this Privacy Policy. We will notify you of such changes before they are implemented. You agree to such modifications or changes by continuing to use the Dune Product after such information has been made available to you.

Cookies are text files containing small amounts of information which are downloaded to your computer or mobile device when you visit Dune's website and allow us to recognize your device.

According to applicable legal regulations for electronic communications, cookies may be stored or accessed on your equipment only based on your consent, except for cookies that are strictly necessary in order to provide the services on Dune's website. Dune uses both cookies that are strictly necessary to provide our services (Necessary Cookies) as well as cookies that provide us analytics about the performance of our website, enable webflow and Search Engine Optimization and support marketing (Non-necessary Cookies).

You can decide whether to accept Non-necessary Cookies through our cookie banner or cookie settings tool and may change or withdraw your choice at any time. You may also restrict cookies through your web browser settings. If you do not agree with Necessary Cookies being used, you should leave the website and stop using our services.

• Security (attack prevention) — These cookies allow us to provide cloud cybersecurity and DDoS (attack) mitigation. These include Cloudflare cookies and CSRF.
• Authenticated session liveness (for authenticated users) — These cookies allow us to authenticate our users and keep them logged into their accounts. These include auth-refresh and auth-user.
• Stripe — These cookies are used to support payment processing functionality. They help detect fraud and ensure secure transactions.

• Cloudflare — Provides cloud cybersecurity and DDoS mitigation services. Cloudflare uses programming code to collect information about your interaction with our websites. The cookie contains information related to the calculation of Cloudflare's proprietary bot score and, when anomaly detection is enabled on bot management, a session identifier. The information in the cookie (other than time-related information) is encrypted and can only be decrypted by Cloudflare. This code is only active while you are on our websites and expires after 30 minutes of continuous inactivity by the end user.
• Amplitude — Provides analytics to enhance the experience of our visitors to our website and to better understand how the website is used. The storage period for Amplitude Cookies is 1 year.
• Google Analytics — Used to measure and evaluate how users interact with website content across browsing sessions.
• HubSpot Tracker — Helps us track visitors to Dune's website. Every time a visitor lands on our website, HubSpot will check for an existing tracking cookie. If one does not exist, a cookie will be associated with that visitor and will log every page that person visits moving forward.
• Google Search Console — Helps us monitor, maintain, and troubleshoot our website's presence in Google Search results.
• PostHog — Provides product analytics to understand how users interact with website features. Note: this may be injected by a third-party integration rather than set directly by Dune.
• Google Ads (Conversion Linker) — Used to measure the effectiveness of advertising campaigns by tracking conversions from Google Ads. The _gcl_au cookie links ad clicks to on-site actions.