The Privacy Policy of Duo Security can be found at :

https://duo.com/legal/privacy

Some main points have been extracted below for reference :

• Duo Security does not sell, rent, or trade and, except as described in this Privacy Policy, does not share any Personal Information with third parties for their promotional purposes.
• If you have an Organization account, we may also share Personal Information and/or Device-Specific Information with your Organization and/or your Organization’s third party vendors (with your employer’s consent) in order to operate and maintain the Services.
• Duo Security does not market or advertise to Organization Users.
• We will retain your information for as long as your account is active or as needed to provide you the Services, unless we are required by law to dispose of it earlier or to keep it longer. We will also retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
• Please be aware that Duo Security may host and process your data and information (including Personal Information), in the United States and other countries through the Duo Security group of companies and third parties that we use to operate and manage the Website and Services, including Amazon Web Services (“AWS”). You may view the AWS privacy policy at http://aws.amazon.com/privacy.