Privacy policy

This policy explains what personal data DocRally processes and why. We act as a controller for account data of our customers and as a processor for the data our customers collect from their own clients.

Data we process

• Account data: name, email address, hashed password, organization name, team membership.
• Billing data: plan, billing status and the customer ID from our payment provider. We never receive full card numbers.
• Customer Data: client names and emails, request contents, uploaded files and answers.
• Technical data: IP address and browser type for security, rate limiting and error logs.

Why we process it

• To provide the Service (contract).
• To secure the Service and prevent abuse (legitimate interest).
• To bill you and meet tax obligations (legal obligation).
• To send service emails such as reminders, password resets and billing notices. We do not sell personal data.

Sub-processors

We use carefully selected providers to run the Service:

• Hosting and database (application servers and PostgreSQL).
• Object storage for uploaded files (encrypted at rest).
• Transactional email delivery.
• Payment processing and tax handling (merchant of record).
• AI document analysis (only when a file is checked; the provider does not train on API data).

An up-to-date list with provider names and locations is available on request.

International transfers

Data may be processed outside your country. Where required (for example under the GDPR) we rely on appropriate safeguards such as Standard Contractual Clauses.

Retention

Customer Data is kept while your account is active and deleted within 30 days after account closure. Customers can delete requests, files and clients at any time.

Your rights

You may request access, correction, deletion or export of your personal data, and object to certain processing. If you are a client of one of our customers, please contact that firm first; we will assist them. Contact: support@docrally.com.

Data processing agreement

Business customers can request our Data Processing Agreement (DPA) by email.