Privacy Policy

DocuTract ("DocuTract", "we", "us") helps you turn a document template and a handful of scans into a finished, filled document. This Privacy Policy explains what personal data we process when you use DocuTract at docutract.online, why we process it, and the choices and rights you have. It is written to be read alongside our Terms of Service and our Data Processing Agreement.

Who is responsible for your data

For your account and billing data, DocuTract is the data controller. For the documents, scans and templates you upload, you are the controller and DocuTract acts as your processor — we handle that content only to provide the service and only on your instructions. The Data Processing Agreement governs that processor relationship in full.

What we process

• Account data — your e-mail address, the authentication identifiers from your sign-in provider, your display name and your interface language.
• Workspace content — the templates, scans and source files you upload, the fields you define, and the documents DocuTract generates for you.
• Billing data — your plan, your monthly document usage counters, and the payment and invoice metadata handled by our payment processor. We never store full card numbers.
• Technical data — log entries, IP address, device and browser information, and the events needed to operate, secure and debug the service.

How we use your data

We process your data to provide and maintain DocuTract: to authenticate you, to run extraction and document generation, to enforce plan quotas, to issue invoices, to provide support, to keep the service secure, and to comply with our legal obligations. Our legal bases are the performance of our contract with you, our legitimate interest in running and securing the service, and compliance with law.

Your documents stay private

Your uploaded documents and the documents we generate are yours. We do not sell them, we do not use them to train machine-learning models, and we do not share them with third parties except the sub-processors strictly needed to deliver the service (see below). Access by our staff is limited to what is necessary for support and operations, and is logged.

Sub-processors and hosting

DocuTract relies on a short list of vetted sub-processors — for hosting, document extraction, authentication and file storage, payments, and PDF rendering. You choose whether your workspace data is hosted in the EU or the US. The current list of sub-processors, the purpose of each, and the safeguards for any international transfer are maintained in the Data Processing Agreement.

Security

All data is encrypted in transit (TLS) and at rest. Access to production systems is restricted, authenticated and logged. Uploaded scans and generated outputs are stored in private buckets reachable only through short-lived, signed URLs scoped to your workspace.

How long we keep your data

We keep workspace content for as long as your account is active so the service can function. You can delete templates, scans and documents at any time. When you close your account we delete or irreversibly anonymise your workspace content within 30 days, except where we must retain limited records (for example, invoices) to meet legal and accounting obligations.

Your rights

Subject to applicable law, you may access, correct, export, restrict, object to the processing of, or delete your personal data. You may also withdraw consent where processing relies on it, and lodge a complaint with your supervisory authority. To exercise any of these rights, contact us at privacy@docutract.online; we respond within the timeframes the law requires.

International transfers

Where data is transferred outside your region, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with the technical measures described above.

Cookies

DocuTract uses only the cookies it needs to work: a session/authentication cookie and a plain-text locale cookie that remembers your interface language. We do not use advertising or cross-site tracking cookies.

Children

DocuTract is a tool for professional and business use and is not directed to children under 16. We do not knowingly collect data from children.

Changes to this policy

We may update this Privacy Policy as the service evolves. When we make a material change we revise the "last updated" date above and, where appropriate, notify you in the app.

Contact

Questions about this policy or your data? Write to privacy@docutract.online.