Privacy Policy

Who is responsible

The controller for the data described here is Palina Shalak, NIP 7011157683, REGON 525975130, registered at [to be completed before publication], under the laws of Poland. Questions about this policy or about your data go to privacy@doc-engine.app.

What we hold

Two kinds of data, and it is worth keeping them apart. The first is your account: an email address, a name if you give one, and a hashed password. The second is your paperwork.

Your paperwork means the documents you upload, the field values extracted from them, the profiles you merge those values into, and the documents generated from the result. For this product that routinely includes identity documents and the national identification numbers on them.

Why we hold it

To provide the service you signed up for: reading your documents, keeping the values in a profile, and filling forms from them. We also count how many documents an organisation has processed, in order to apply the limits of its plan.

We never train a model on your documents or on the values in them, and we never pass them to anybody for that purpose.

What the model provider is allowed to do with them depends on your plan, and it is the honest difference between the two. On the free plan your documents are read by Google through the unpaid tier of its Gemini API, whose terms let Google use submitted content to improve its own products and allow its reviewers to see it. On a paid plan they go through the paid tier, where Google states it does not use them to improve its products and keeps them only briefly to detect abuse.

If that difference matters for the documents you are filing — and for identity documents it reasonably might — a paid plan is what buys it. We would rather write that down than let it be discovered.

If you write to us without an account

Three forms on the public site reach us before anybody has signed up, and what they collect is not covered by the two kinds above.

• An enquiry asks your name, your email, optionally your company, and your message.
• A checklist or a calculator result asks your email, and carries whatever you typed into the calculator so the answer can be about your numbers.
• A demo booking asks your name, email and company, roughly how many cases you handle, which packets you file most, and the time you picked.
• All three arrive as email — to us, and for the last two back to you as well. None of them writes your name or your address into the database: what is stored is a count of how many enquiries of each kind arrived, which is how we tell whether a page works.
• The mail stays in a mailbox until somebody deletes it. Ask at the address in Your rights and it goes.

Who else processes it

Providing the service means passing some data to the services below. Which of them are active depends on how this instance is deployed.

• Neon — the PostgreSQL database holding profiles, extracted field values and document metadata.
• Vercel Blob — object storage for uploaded documents and generated output, when the deployment sets STORAGE_DRIVER=blob.
• Resend — email. For an account: address confirmation, password reset and the "you already have an account" notice. From the public site: an enquiry, a checklist or calculator result, or a demo booking, delivered both to us and back to you.
• The configured model provider (Anthropic, Google or OpenAI) — receives document content in order to extract fields from it, and, from the browser extension, the address and field labels of a page you ask to have read, or a picture and structure of a region you select. A deployment may reach it through the Vercel AI Gateway, which then routes the same content on.
• PostHog — product analytics, and only when you have consented. Field values and document content are never sent to it.

The browser extension

The extension is a second way into the same account, and what it sends is narrower than what the app does. Worth stating separately, because it runs on pages we do not own.

• It keeps in your browser: the device token that connects it, the mappings of the forms your account has, and which profile fields hold a value. Never the values themselves.
• Recognising a page happens entirely in your browser and sends nothing: the extension reads the field labels of pages you visit locally, in order to tell a form it knows from one it does not. A page it does not know is sent to be read only when you ask for it.
• Asking for a page to be read sends its address, its title and the labels of its fields — never its markup, because a page behind a login can have filled your details into the boxes already.
• Selecting an area sends a screenshot of that area and its structure. The screenshot is taken with the contents of every field made invisible, the structure is rebuilt from a fixed list of tags and attributes rather than copied, and both are shown to you before anything is sent.
• Profile values reach the page you are filling and nowhere else. They are requested when you press Fill or ask to fill a single field, held in memory, and dropped when the tab closes.
• Fill history is off unless you turn it on. With it on, what was written into a form is saved to your account so you can see what you sent and when — which for these forms means your name, your address and your identification numbers. Off, none of that is sent or stored, and filling works exactly the same.

How long it is kept

Until you delete it. There is no automatic retention window and nothing expires on its own: a document, a profile or a generated file stays until somebody removes it, and deletion is immediate and permanent when they do — the stored file is dropped along with the record.

Deleting a profile offers to delete the documents that only that profile holds. A document shared with another profile survives, because it is still in use.

Your rights

Access, correction and erasure are all in the product rather than behind a request.

Access: Settings → Your data → Download my data gives a JSON copy of every profile, the values merged into them, and what is recorded about each uploaded and generated document. A single profile can be exported on its own from the profile itself.

Correction: every extracted value is editable, and the product marks a value unverified until you confirm it.

Erasure: every document, profile and bundle can be deleted, and deletion is immediate. The person who created the workspace can delete the whole organisation, which takes the profiles, sources, templates, bundles, generated documents and the account with it.

What is not self-service is anything you sent before there was an account — an enquiry, a demo booking. Write to privacy@doc-engine.app and it will be answered.

What is kept on your device

Three things, and only the last one is a choice.

• A session cookie, so that signing in lasts longer than one page. Without it there is no way to stay signed in.
• A cookie remembering which language you chose, so the site opens in it next time.
• If you agreed to analytics: an identifier, in local storage rather than a cookie. Refuse and none is created — not created and left unused, but never created. Your answer itself is remembered, so that nobody is asked twice.

Analytics and consent

Product analytics are off until you agree to them, and the banner that asks is the only thing that turns them on. What is recorded is which screens are reached and how far a task gets. What is never recorded is the content of a document, the value of a field, or a recording of your screen.