Privacy Policy

The short version

• Your documents are used only to answer your questions and run the features you choose. We do not sell them, show ads, or use them to train AI models.
• Your documents, questions and account data are stored on our own server in Mumbai, India.
• To answer a question, the relevant passages and your question are sent to an AI model through OpenRouter, with every request asking the model host to keep no copy and not use the data.
• You can download your data and delete your account yourself, at any time, from Settings.

Who we are

Docamend ("Docamend", "we", "us") runs the website docamend.com, a service that answers questions about documents you upload and shows the exact passage each answer comes from. Docamend is operated from India and is currently in public beta. For anything about this policy or your data, write to [email protected] or use the contact page.

What we collect

• Account details from Google. When you sign in with Google we receive your email address, your first name and your Google account ID. We never see or store your Google password.
• Your documents and what is made from them. The files you upload, the text extracted from them, the search index built from that text, and the results of the features you use: answers to your questions, document summaries, suggested questions, and claim checks and audits. If a PDF is scanned, its pages are read in your own browser before upload and only the recognised text is sent with the file.
• Your questions and answers, including the passages quoted, and any "Helpful" or "Not helpful" feedback you give on an answer.
• Credits and usage. Your credit balance, a record of each action that used or refunded credits, free-credit claims, and any request you send for more free access (including the message and use case you write).
• Sign-in sessions. For each device you sign in on: a short description such as "Chrome on Windows" (taken from your browser, never your IP address), when the session started, when it was last used and when it expires.
• Settings you choose, such as your workspace layout.
• Messages you send us. Contact-form messages are emailed to our support inbox together with the name and email address you enter. They are not stored in the Docamend database.
• Technical data. Your IP address is used briefly to limit how many requests can be made, and is seen by Cloudflare, which carries all traffic to the site. Our server logs record technical events (for example which page or feature was used and whether it worked) and can include short excerpts of document text or of a question when something needs troubleshooting.

We do not collect payment card details. When paid credits launch, payments will be handled by our payment provider, and we will receive only the payment status and a reference number.

How we use it

• To provide the features you use, and to show where each answer comes from.
• To keep your account signed in and secure on your devices.
• To count credits, apply free-credit and fair-use limits, and prevent abuse.
• To reply to your messages, and to send emails about your account.
• To find and fix problems, and to improve answer quality from feedback you give.
• To meet legal obligations.

We do not sell your data, use it for advertising, or use your documents or questions to train AI models.

Who processes your documents

These services take part in running Docamend:

• Oracle Cloud (Mumbai, India). Hosts our server. Your files, the database with extracted text, the search index, your questions and answers, and our backups are all stored on it.
• Cloudflare. Carries all traffic between your browser and our server, protects the site from attacks, and provides HTTPS. It sees the pages you request, your IP address and browser details, and the content passing through.
• AI models through OpenRouter. Passages from your document and your question are sent to OpenRouter, which passes each request to a host for the chosen model (for example Microsoft Azure or another provider that serves it). OpenRouter also turns document text into the search index. Every request asks for zero data retention and no data collection, so it is only sent to hosts that offer that. These hosts may process data outside India.
• Public web search (only when you use web fact-checking, claim verification or claim audits). The statements being checked, which may be taken from your document, are sent as search queries to public search engines. The searches come from our server, so your own IP address is not sent to them. Search results can be kept on our server for a while so repeat checks are faster.
• Google. Handles sign-in only and does not receive your documents.
• GoDaddy email. Our support mailbox, which receives contact-form messages and sends account emails.
• Optional services. If error reporting is enabled, technical error reports are sent to Sentry. When it is enabled, Cloudflare Turnstile protects the contact form. When paid credits launch, our payment provider (Razorpay) will process payments.

We may change these providers as the service grows, and will update this list when we do.

Cookies and browser storage

Docamend uses one cookie of its own, docamend_refresh, which keeps you signed in for up to 30 days. It cannot be read by page scripts and is used for nothing else. Your browser's local storage keeps small convenience settings on your device: theme, highlight colour, panel sizes, your recently opened documents, notifications, whether you have seen the tutorial, and an unsent contact-form draft. Google's sign-in button may set Google's own cookies, and Cloudflare may set strictly necessary security cookies. We do not use advertising cookies or third-party analytics trackers.

How long we keep it

• Documents, their extracted content, and your questions and answers: until you delete them, or delete your account.
• Account data, credit records and settings: until you delete your account.
• Sign-in sessions: removed automatically 30 days after they end.
• Database backups: kept for about 14 days (the three most recent are always kept). Backups of uploaded files: the three most recent daily copies.
• Server logs: rotated automatically by size, so they are usually overwritten within days.
• Contact messages: kept in our support mailbox for as long as needed to handle your request.

Deleting removes data from Docamend straight away, but copies can remain for a limited time in the backups above, and in file storage while a deletion that failed is retried. AI hosts and search engines follow their own retention terms.

Your rights

You can, at any time:

• Delete any document in the app. This removes the document, its extracted content, and your questions and answers about it.
• Download your data and delete your account yourself from Settings. Deleting your account removes your documents, questions, answers, feedback, credits, sessions and account details from our live systems.
• Ask us what data we hold about you, or ask us to correct it. Your name and email come from your Google account.
• Withdraw your consent by deleting your account. This stops all further processing.
• Nominate someone to exercise these rights on your behalf if you are unable to.

These rights reflect India's Digital Personal Data Protection Act, 2023. If you are in another country, you may have similar rights under local law, and we will honour them in the same way.

Security

Connections to docamend.com use HTTPS. Our server's disks are encrypted by our hosting provider, access to the server is limited to key-based logins, and secrets are kept out of our code. No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

Children

Docamend is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

When we change this policy we update the date at the top. If a change affects how your documents are used or shared, we will tell you in the app or by email before it takes effect.

Contact and grievances

Questions, requests or complaints about your data: [email protected] (Grievance Officer) or the contact page. We aim to reply within 7 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.