Privacy policy

1. What we collect

• Account details: name, email address, and sign-in records, handled by our sign-in provider Clerk. We never see or store your password.
• Your documents: the files you upload, the text read from them, and the dates, names and numbers found in them, including personal data they contain (for example passport details).
• Workspace data: workspace names, members and roles, folders, labels, reminders, share links and who opened them.
• Usage records: an activity log of uploads, downloads, shares and member changes, AI actions used, and API requests, with timestamps and IP addresses kept for security.
• Billing details: plan, invoices and payment status. Card and bank details are held by Razorpay or Paddle, never by us.
• Marketing measurement: only if you accept it in the cookie banner, our advertising partners' tags record that their ad led to a visit or sign-up.

2. Why, and on what legal basis

• To provide the service you asked for: storing, reading, reminding, sharing (performance of a contract).
• To keep the service secure and prevent abuse: activity logs, rate limits, fraud checks (legitimate interest, and legal obligation).
• To bill you and keep accounts, including tax records (legal obligation).
• To send you emails about your account, reminders you set, and important changes (contract). Marketing emails only with your consent, with an unsubscribe link in each.
• To measure advertising (consent, given in the cookie banner and withdrawable there).

For people in India, the Digital Personal Data Protection Act 2023 applies; the notice at sign-up is the consent under that Act, and you may withdraw it by deleting your account.

3. Who else processes your data, and where

The full list, with locations, is on the security page and is part of this policy. In short: files in Mumbai with a copy in Singapore, database and servers in Singapore, sign-in and AI reading in the United States, email in the United States, payments in India (Razorpay) or the United Kingdom (Paddle). Each provider works under a written data processing agreement. For transfers out of the European Union and the United Kingdom, those agreements include the standard contractual clauses approved for that purpose.

AI providers receive the text of a document only to read it and return what they found. They do not keep it or use it to train models.

We do not sell personal data and we do not share it with anyone else, except where the law requires it or to protect someone's safety.

4. How long we keep it

• Documents: as long as your account exists, unless you delete them. Deleted documents sit in the bin for the period your plan sets (30 to 90 days, or a retention policy you choose) and are then permanently erased from storage and backups within a further 35 days.
• Account and workspace data: until you delete the account, then erased within 30 days.
• Activity logs: 12 months, then deleted.
• Invoices and tax records: 8 years, as Indian law requires, without the documents themselves.

5. Your rights

From Settings you can, at any time and without asking us: see everything we hold about you, download it (data export), correct your details, and delete your account and all its data. If you own a workspace with other members you are asked to hand it over or remove them first, so their data is not deleted by your choice.

You can also ask us to restrict or object to processing, and, in the EU and UK, complain to your data protection authority. Requests go to nj@excelleta.tech and are answered within 30 days.

Grievance Officer (India, DPDP Act 2023): Nishant Jairath, Director, Excelleta Tech Private Limited, Flat No. 706E, 7th Floor, Sector 19B Dwarka Front, Near MCD Toll, Dwarka, New Delhi 110075. Email nj@excelleta.tech. Grievances are acknowledged within 48 hours and resolved within 30 days.

Business customers: the documents you upload may contain other people's personal data. For those, you are the data fiduciary (controller) and Excelleta is your processor under the data processing agreement, which is part of the terms for Business and Team plans.

EU and UK representatives: named here once appointed; until then, write to the Grievance Officer above.

6. Security

Encryption in transit and at rest, private storage with expiring download links, two-factor sign-in, role-based access, an activity log, backups in two regions and a monthly restore drill. Details are on the security page. If a breach affects your data we tell you and the relevant authority within 72 hours of confirming it.

7. Cookies

DockyDoc sets one essential cookie to keep you signed in and one to remember your cookie choice. Advertising measurement tags (Meta, LinkedIn, Google) load only after you press “Accept all” in the banner, and you can change that choice by clearing your browser's site data. We do not use analytics cookies beyond those.

8. Children

DockyDoc is for people aged 18 and over. Documents about children (for example a child's passport) may be stored by the adult responsible for them.

9. Changes

We tell you by email and in the app at least 14 days before a material change to this policy. The date at the top is the version in force.