Last updated 1 September 2026
Privacy notice
This notice explains how personal data is handled on the DocAIFlow marketing site and early-access list. It does not cover the separate DocAIFlow product; that service will need its own privacy information before beta accounts process customer documents or responses.
Controller and contact
The controller is Diego Revuelta, Spain. For privacy questions or to exercise your rights, email info@docaiflow.com. No data protection officer has been appointed because one is not currently required for this limited processing.
Early-access list
We collect your email address and, only if you choose to provide them, your name, company or role and a description of the document workflow you want to improve. We use this information to maintain the waitlist, select and invite beta participants, answer related requests and send updates directly connected to beta access. We do not use waitlist details for unrelated advertising or sell them.
The legal basis is your consent, given when you submit the early-access form after receiving the summary notice. Email is required so we can manage access; every other field is optional. You can withdraw consent at any time by contacting us. Withdrawal does not affect processing that was lawful before it.
Retention
Waitlist information is kept until 12 months after the beta ends and is then deleted, unless you have created a product account and a separate notice applies, the information is needed to handle a request or legal claim, or you ask us to delete it earlier. Suppression information may be retained only where necessary to respect a previous opt-out.
Hosting and recipients
Cloudflare provides site delivery, Pages Functions, D1 database hosting and Turnstile bot protection. Cloudflare acts as a service provider or processor for the relevant hosting functions under its applicable terms and data processing addendum. Access is limited to service providers needed to operate the site and to authorities where disclosure is legally required.
Cloudflare may process information internationally. Where European personal data is transferred outside the European Economic Area, the applicable Cloudflare data processing terms provide the transfer mechanisms and safeguards described there, including standard contractual clauses where relevant. See Cloudflare's Data Processing Addendum and Privacy Policy.
Turnstile security checks
The waitlist uses Cloudflare Turnstile to distinguish people from automated abuse. Turnstile processes browser and interaction signals needed for that security purpose; DocAIFlow does not send it the values entered in the waitlist fields. The legal basis for using this necessary protection is the controller's legitimate interest in preventing abuse and protecting the form. A failed security check can stop a submission, but it does not make a broader decision about you. See Cloudflare's Turnstile Privacy Addendum.
Optional analytics
If you choose “Allow analytics”, the site records aggregate daily counts for page views, waitlist starts and successful waitlist submissions. The stored record contains only the date, allowlisted event, allowlisted route and combined count. It contains no form values, visitor or session identifier, attribution data, referrer, stored IP address or user agent, and it is never joined to the waitlist.
The legal basis for sending these optional events is your consent. Your choice is stored locally in your browser and can be changed through “Analytics choices” in the footer. Declining does not affect the site or waitlist.
Your rights
Where the GDPR applies, you may request access, correction, deletion, restriction or portability of your personal data, object where processing relies on legitimate interests and withdraw consent at any time. Email info@docaiflow.com with enough information to identify your request. We may request proportionate verification before acting so that data is not disclosed or deleted for the wrong person.
You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.
Security and changes
We apply access controls, encrypted transport, bot protection and data-minimising application and logging rules. No internet service can guarantee absolute security. If this processing changes materially, this notice and its date will be updated before the new use begins; consent will be requested again where required.