Privacy Policy

This Privacy Policy explains how Docidrive (“we”, “us”) collects, uses and protects personal data when you use Docidrive (the “Service”). We are the data controller for the personal data described here. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data we collect

• Account data — your email address and authentication details when you sign up.
• Waitlist data — your email address and the plan/page you expressed interest in.
• Business & document data — the information you enter to create documents (your business details, your clients’ names and contact details, line items, amounts). You control this content.
• Usage data — how you interact with the Service, collected via privacy-friendly analytics and, where enabled, Google Analytics.
• Technical data — IP address, browser type and device information, collected automatically for security and performance.

2. How and why we use it (lawful bases)

• To provide the Service (contract): creating your account, generating and storing your documents, processing payments.
• To contact you about the waitlist or your account (consent / contract): confirming your signup and letting you know when plans open.
• To improve and secure the Service (legitimate interests): analytics, preventing abuse, maintaining reliability.
• To meet legal obligations (legal obligation): tax, accounting and record-keeping where applicable.

3. About your clients’ data

When you add details about your own clients to create documents, you act as the data controller for that information and we process it on your behalf as a processor. You are responsible for having a lawful basis to provide it to us and for informing your clients as required.

4. Who we share data with

We use trusted third-party providers to run the Service. They process data only on our instructions:

• Supabase — database, authentication and file storage (hosted in the EU/London region).
• Vercel — application hosting and delivery.
• Resend — sending transactional and waitlist emails.
• Anthropic — AI-assisted drafting (only the text you submit for drafting is processed).
• Stripe — payment processing, once paid plans are live.
• Google Analytics — usage analytics, where enabled.

We do not sell your personal data. We never display third-party advertising in the Service.

5. International transfers

We aim to keep data within the UK/EEA. Where a provider processes data outside the UK/EEA, we rely on appropriate safeguards such as UK-approved standard contractual clauses.

6. How long we keep it

We keep account and document data for as long as your account is active and as needed to provide the Service, then for any period required by law (for example, tax records). Waitlist emails are kept until you unsubscribe or ask us to delete them. You can request deletion at any time (see below).

7. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”);
• restrict or object to processing;
• data portability;
• withdraw consent at any time where we rely on it.

To exercise any right, email privacy@docidrive.com. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and database-level tenant isolation so one customer’s data is not accessible to another. No system is completely secure, and we cannot guarantee absolute security.

9. Cookies

We use essential cookies to run the Service and, where enabled, analytics cookies to understand usage. See our Cookie Policy for details.

10. Changes

We may update this policy from time to time. The “last updated” date at the top shows when. Material changes will be notified through the Service or by email.

11. Contact

Data protection queries: privacy@docidrive.com.

This policy is a general template and not legal advice. Before processing personal data at scale you should register with the ICO (ico.org.uk) and have your policy reviewed by a qualified professional.