Privacy Policy
Privacy Policy
Website: docpipelineai.com ("the Service") Data controller: Shaozhong Tan, Guangzhou, China Effective date: November 2, 2026 · Contact: [email protected]
This policy explains what personal data we collect, why, how long we keep it, and your rights under the EU/UK General Data Protection Regulation (GDPR).
1. Data we collect
| Category | Examples | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|---|
| Account data | Email address | Login, service notices, receipts | Contract (Art. 6(1)(b)) | Until you delete your account |
| Upload documents | Resumes, bank statements, invoices | To perform the conversion/analysis you requested | Contract | Deleted immediately after processing — we do not retain document contents or generated files |
| Usage metadata | Timestamps, file size, processing route (never file contents) | Security, abuse prevention, service improvement | Legitimate interest (Art. 6(1)(f)) | 90 days |
| Payment data | Handled entirely by Paddle.com (Merchant of Record); we receive only subscription status and a customer reference | Billing, subscription management | Contract | As required by tax law (held by Paddle) |
| Anonymous usage analytics | Page views, referrer, coarse region (cookieless) | Understanding which tools are used | Legitimate interest | 6 months, aggregated |
| Emails you send us | Support requests | Responding to you | Contract / legitimate interest | 24 months |
We do not collect: identity documents, special-category data (health, biometrics, etc.) as an input requirement, advertising cookies (in the EU/UK), or data from children. The Service is not directed at persons under 16.
2. Third-party processors (sub-processors)
| Processor | Role | Location | Safeguard |
|---|---|---|---|
| Microsoft Azure | Document-processing AI services (paid fallback OCR), hosting | EU/US regions | Microsoft Data Protection Addendum; EU Standard Contractual Clauses where data leaves the EEA |
| Paddle.com Market Ltd | Merchant of Record: checkout, payments, tax, receipts | UK/EU | Paddle GDPR DPA; Paddle is the data controller for payment data it collects |
| Resend | Transactional email delivery (magic links, receipts notices) | US | Resend DPA; EU SCCs |
| Umami (self-hosted or cloud) | Cookieless analytics | EU (self-hosted) or EU-hosted cloud | No cookies, no personal profiles |
An up-to-date sub-processor list is maintained at this page. You may subscribe to sub-processor change notices by emailing [email protected].
3. International transfers
Where data is transferred outside the EEA/UK (e.g., Azure US regions, Resend US), transfers rely on EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) plus supplementary measures (encryption in transit and at rest, minimal data scope — metadata only wherever possible).
4. Your rights (GDPR Arts. 15–22)
You may request: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21). Because we delete documents immediately and store minimal data, most requests can be fulfilled from the account data and usage metadata only.
- How to exercise: email [email protected] from your account address. No fee.
- Our internal SLA: acknowledge within 72 hours; respond substantively within 30 days.
- Complaints: you may lodge a complaint with your local supervisory authority (in the EU) or the ICO (UK). The operator is established in China; EU/UK users may additionally use their local data-protection authority.
5. Security
TLS in transit; encryption at rest for databases; file uploads stored in ephemeral storage and deleted on completion; webhook signatures verified; least-privilege API keys; metadata-only logging.
6. Cookies
See our Cookie Notice. In the EU/UK, only strictly necessary cookies (login session) are set; analytics is cookieless; any optional analytics is consent-gated.
7. Changes
Material changes to this policy will be announced by email or on-site notice at least 14 days before taking effect.