Worldwide Privacy Standards (GDPR • CCPA • LGPD)

Privacy Policy & Global Legal Consent

At DocFlexa Inc. ("DocFlexa", "we", "us", or "our"), we respect your fundamental right to privacy. This Privacy Policy details how we collect, process, store, and safeguard personal data across all jurisdictions worldwide, and outlines your legal consent when using our services.

OUR ZERO-TRAINING COMMITMENT: DocFlexa never sells your data, never rents your contact information, and NEVER uses your private documents, receipts, contracts, or attachments to train artificial intelligence or machine learning models.

1Scope & Data Controller

This Privacy Policy applies to all individuals and organizations accessing or using the DocFlexa web application, mobile experiences, APIs, and associated cloud services. DocFlexa Inc. acts as the Data Controller under the General Data Protection Regulation (EU/UK GDPR) and applicable international data protection statutes.

2Information We Collect & Process

We collect information in three categories:

A. Account & Identity Data (Provided Directly by You)

Full name, display name, email address, hashed passwords, organization metadata, business phone number, and optional tax identification details for verified business entities.

B. Document Metadata & Form Schemas

Template structures, custom field definitions, validation rules, item titles, category tags, purchase dates, warranty expiration timestamps, and scheduled reminder preferences.

C. Connected Storage & OAuth Access Tokens

Encrypted OAuth tokens required to communicate with third-party storage providers (Google Drive, Microsoft OneDrive, Dropbox, AWS S3, Azure Blob) solely to upload, fetch, or sync your document attachments.

3How We Use Information & Legal Bases (GDPR Article 6)

We process personal data strictly under lawful legal bases:

Contractual Necessity: To provide the DocFlexa platform, execute document indexing, render forms, authenticate users, and manage subscriptions.
Legitimate Interests: To prevent fraud, detect malicious honeypot bots, safeguard system security, and provide sub-second search indexing.
Legal Consent: To send automated reminder emails before warranty expirations and process cloud storage synchronization via OAuth tokens.
Legal Compliance: To satisfy tax, invoicing, and regulatory recordkeeping obligations worldwide.

4Google API & Third-Party Storage Disclosure

GOOGLE USER DATA & DRIVE SCOPES POLICY COMPLIANCE:

DocFlexa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We only request Drive access scopes required to create and retrieve DocFlexa document files authorized by you.
We do not transfer your Google data to third parties, data brokers, or advertising networks.
Humans do not read your private Google Drive files unless specifically authorized by you for customer support debugging.

5Global Data Subject Rights (EU/UK GDPR, CCPA/CPRA, LGPD)

Regardless of your country of residence, DocFlexa grants all users comprehensive global data rights:

Right to Access & Portability

Export all your templates and document records as JSON schemas or zipped backups at any time via Account Settings.

Right to Erasure (Right to be Forgotten)

Delete your account in Settings. We immediately remove your name, email, company and tax details, billing identifiers, and Paperwork Vault details, and sign you out everywhere. Your account record is permanently deleted 30 days later. Security audit logs are kept for up to 90 days, then deleted. Files in your own connected storage are never touched.

Right to Rectification

Update, correct, or amend profile, organization, and billing metadata instantly.

No Sale / Sharing of Personal Information

DocFlexa does NOT sell or share personal information under the California Consumer Privacy Act (CCPA/CPRA).

To exercise any statutory data right or submit a formal inquiry, email our Data Protection Officer at dpo@docflexa.com.

6Security Architecture & Encryption Standards

We implement enterprise-grade technical and organizational safeguards:

In-Transit Encryption: Traffic between your browser and DocFlexa is encrypted with Transport Layer Security (TLS).
Encryption of Secrets: Cloud storage OAuth tokens and storage credentials are encrypted with AES-256 using ASP.NET Core Data Protection before they are saved. Other database records, including your form answers and Paperwork Vault details, are not separately encrypted by DocFlexa; they are protected by access controls and our hosting provider's infrastructure safeguards.
Tenant Isolation: Strict multi-tenant row-level access controls prevent unauthorized cross-organization data leakage.
Automated Threat Prevention: Continuous automated rate limiting, bot honeypots, and SQL injection sanitization.

7Cookies, Storage & Tracking Technologies

Strictly necessary (always on)

docs9_access_token / docs9_refresh_token: Keep you signed in. Removed when you sign out.
docs9_logged_in / docflexa_logged_in: Tell the app that you are signed in. They hold no personal data.

Stored in your browser only

Preferences: theme, sidebar layout, workspace type, and whether you have dismissed tours, banners, and checklists.
Unsent form drafts: answers you have not submitted yet are kept on your device so a lost connection does not lose your work. Drafts are deleted after 7 days or when you submit.
docflexa_gemini_api_key: Optional Google Gemini API key you may enter for the template designer. Kept in session storage only, so it is cleared when you close the tab. When you generate a template, the key is passed through our server to Google for that request only. We do not store or log it.

Analytics (only if you allow it)

If you choose “Allow”, we use Google Analytics, which sets _ga cookies, to understand which pages are used. Google receives the page address (with search terms and private link codes removed), a random account ID that does not include your name or email, and your account type and plan. Until you allow it, Google Analytics is not loaded at all. If you decline later, we stop collection and delete these cookies.

We do not use advertising cookies, ad pixels, or cross-site advertising tracking.

8Children's Privacy Protection

DocFlexa is not intended for use by children under the age of 16 (or under the minimum digital consent age in your jurisdiction). We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact privacy@docflexa.com for immediate deletion.

9Data Protection Officer (DPO) & Contact Details

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact our Data Protection Officer:

DocFlexa Inc. — Data Protection Office

Email: privacy@docflexa.com

DPO Direct: dpo@docflexa.com

Security Response: security@docflexa.com

10Paperwork Vault & AI Document Reading

The Paperwork Vault helps you track the dates and terms in your own documents. This is what happens to your information:

Reading a document. When you scan or upload paperwork, the image or its text is sent to Google's Gemini service to suggest details such as end dates and notice periods. DocFlexa processes it in memory and does not keep the scan or log its contents. Google handles the content under its own API terms.
What we store. Only the details you review (dates, durations, amounts, names), a short quote showing where each suggestion came from, and a history of your corrections. Your original file stays in your own connected cloud storage, not with us.
You decide. Suggestions are never used for reminders until you confirm or correct them. Suggestions can be wrong, so always check them against your document.
Emails. Reminders and a monthly summary are sent to your account email. You can turn reminder emails off in Settings.
Deleting. Deleting a document removes its details and reminders but never touches the file in your storage. Deleting your account erases all of your vault details immediately.
Drafting a process with AI. When you ask AI to draft a reusable process (a custom life event), the description you type is sent to Google's Gemini service. DocFlexa processes it in memory and does not keep or log it. Only the process you review and save is stored: its steps, deadlines and role names, never the names or contact details of real people. Please do not put names or account numbers in the description.
Not supported. Medical and health records are not supported. Please do not add them.

Create Your DocFlexa Account →