Last updated 3 September 2026
Product privacy notice
This notice covers the DocAIFlow service — the application you sign in to, the PDFs you upload, the forms you publish and the responses you collect. The marketing site and the early-access list are covered separately by the site privacy notice.
It describes the service as it actually behaves during the private beta. Where something is not built yet, this notice says so rather than describing an intention.
Two different roles, and why the difference matters
DocAIFlow handles two kinds of personal data, and our responsibility is not the same for both.
For your account, we are the controller. Your email address, your name, your organisation and your billing relationship exist because you chose to use the service, and we decide how they are handled. This notice is the one that applies to you.
For the answers people submit to your forms, we are the processor and you are the controller. You decide what to ask, who to send the link to and what to do with the answers. We store and return them on your instructions. If you publish a form that asks for health, financial or employment information, the lawful basis for that is yours, not ours — and so is the obligation to tell the people filling it in why you are asking. The notice we show them describes what the service stores; it cannot describe your purpose, because we do not know it.
If a respondent asks us for a copy of their answers or to erase them, we will refer them to you and, where we can, help you act on it. We have no way to authenticate a respondent: a form link is anonymous by design, so there is nothing to prove that a request concerns their submission rather than somebody else's.
Controller and contact
The controller for account data is Diego Revuelta, Loredo, Cantabria, Spain. For privacy questions or to exercise your rights, email info@docaiflow.com. No data protection officer has been appointed, because the scale and nature of this processing does not currently require one.
What the service holds
| Data | Whose | Why | How long |
|---|---|---|---|
| Email address, name, password (stored only as a bcrypt hash) | Account holder | Performance of the contract — there is no account without it | Until you delete the account, which erases it immediately |
| Organisation name, membership and role; invitations you send | Account holder and the colleagues you invite | Contract — deciding who may reach which forms | Until removed, or until the organisation is deleted |
| The PDFs you upload, and the filename you gave them | Yours, and anyone named inside the document | Contract — the document is the form | Until the last form using it is deleted, at which point the stored file is removed too |
| Form and field definitions | Account holder | Contract | Until you delete the form |
| Answer values submitted to your forms | Respondent | Your basis as controller; we act on your instructions | Until you delete the response or the form. There is no automatic retention limit yet — see the limitations below |
| Respondent IP address and browser user agent | Respondent | Your basis as controller | Not recorded unless you switch it on for a form. It is off by default, and the public form tells the respondent when it is on |
| API keys (stored as a hash), webhook endpoint addresses, delivery logs | Account holder | Contract — your integrations | Until revoked or deleted. Delivery logs deliberately contain no response data |
| Stripe customer and subscription identifiers | Account holder | Contract — billing | Until the organisation is deleted. No card details ever reach DocAIFlow |
| Error reports: exception message, stack, request identifier, route | Account holder — never a respondent | Legitimate interest in keeping the service working | Held by our error-tracking provider on its own retention |
What we deliberately do not do
- We do not log the contents of requests. Answer values arrive keyed by field identifiers you chose, so no fixed list of field names could reliably redact them. Instead, request bodies never reach the log at all.
- Error reports exclude the public form entirely. Pages a respondent sees are excluded from error tracking, so a person filling in one of your forms is never the subject of an error report. Session recording is not used anywhere.
- What is sent to error tracking is an allowlist, not everything-minus-a-filter: the message, the stack, a request identifier, the matched route, the status and which process it came from.
- We do not profile, advertise, or sell anything to anyone. There is no advertising technology in the product and no third-party analytics.
- We do not train anything on your documents or responses. The service performs no AI analysis today.
Cookies and browser storage
The application sets one cookie, and it is strictly necessary, so it does not require consent.
| Name | Purpose | Attributes | Lifetime |
|---|---|---|---|
refresh_token | Keeps you signed in without holding a long-lived credential where a script could read it | HttpOnly, Secure, SameSite=Lax, scoped to /api/auth | 7 days, rotated on use, revoked on sign-out |
There are no analytics, advertising or tracking cookies in the product.
Two things are kept in your browser's own storage rather than on our servers. Signing out or clearing site data removes them.
- Your name and email, so a page reload can draw the interface without waiting for the network. It is a display hint and grants no access: every request is authorised separately.
- Draft answers on a public form, saved on the respondent's own device so a half-finished form survives a refresh. They stay on that device and are cleared when the form is submitted.
Who else processes this data
These are our subprocessors. Each acts on our instructions under its own data processing terms.
| Provider | What it does | Where |
|---|---|---|
| Railway | Runs the application, the database and the job queue | [region to be confirmed] |
| Cloudflare | DNS and TLS; private object storage (R2) for uploaded PDFs | International |
| Sentry | Error reporting, when enabled — see the allowlist above | International |
| Stripe | Payments and card handling. Not used during the free private beta | International |
Where European personal data is transferred outside the European Economic Area, the relevant provider's data processing terms supply the transfer mechanism and safeguards, including standard contractual clauses where applicable. We will give you the current list on request and will update this notice before adding a subprocessor that handles your documents or responses.
Security
- Passwords are stored as bcrypt hashes and are never recoverable.
- Uploaded PDFs are not publicly reachable. Each read is served through a signed link that expires, and a form can only point at a document your own organisation uploaded.
- Sign-in sessions use a short-lived token held in memory plus a rotating cookie that can be revoked server-side; signing out ends the session on the server, not just in the browser.
- Data is separated by organisation, and a request for another organisation's form is answered as if it did not exist.
- Webhook secrets are encrypted at rest; API keys are stored as hashes and revoking one takes effect on the next request.
- Backups are taken and restoring from them has been rehearsed against a test dataset.
No internet service can promise absolute security. If a breach affects your personal data and is likely to present a risk, we will notify the competent supervisory authority and, where required, you.
Deleting your account, and what that means
Deletion is immediate and irreversible. There is no grace period and nothing is archived. Deleting your account removes your account record, every organisation in which you are the only member, the forms in those organisations, every response and answer collected through them, and the uploaded PDFs behind them. We chose immediate erasure over a promised delay because a delay we could not reliably execute would be a claim rather than a control.
Export your data first if you want to keep it. The service produces a complete export of an organisation — every form, field, response and answer — as a single file, and it is available before you delete anything. We cannot produce one afterwards.
If you are the last owner of an organisation that still has other members, deletion is refused rather than taking a team's data with a personal account. Remove or transfer first.
Backups are retained for a limited period and are overwritten in the normal course. Data already removed from the live service may persist in a backup until it rotates out.
Your rights
Where the GDPR applies you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent where processing relies on it. Email info@docaiflow.com. We may ask for proportionate verification first, so that data is not disclosed or destroyed for the wrong person.
For account data we act as controller and answer you directly. For responses collected through a customer's form we act as processor, so we will pass the request to that customer and support them in answering it.
You may also complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.
Limitations we are telling you about on purpose
This is a private beta, and stating what is missing is more useful than implying completeness.
- There is no automatic retention limit for responses. Nothing deletes old submissions on a schedule; they remain until you delete the response or the form. Retention controls are planned and not built.
- A respondent cannot reach or erase their own answers directly. A form link is anonymous by design, so we cannot authenticate such a request. It has to go through the form's owner.
- Respondent IP addresses collected before September 2026, when collection became optional and off by default, are still stored on those older responses.
- There is no email delivery in the service. Invitations are links the inviter sends themselves, and we cannot notify you by email about account or security events.
- Some documents uploaded before deletion tooling existed may remain in storage without a form pointing at them. We are working to identify and remove them.
Changes
If this processing changes materially, we will update this notice and its date before the new use begins, and will ask for consent again where consent is the basis. Because this is a beta, expect this notice to change as the service does.