Privacy Policy

1. Introduction

Welcome to documentra ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered document builder and editing service (the "Service").

We are committed to protecting your privacy and ensuring the security of your personal information. Please read this Privacy Policy carefully to understand our practices regarding your data.

2. Information We Collect

We collect several types of information to provide, improve, and secure our Service:

2.1 Personal Information

• Account Information: Name, email address, and other details you provide when creating an account
• Payment Information: Billing details processed securely through Paddle, our payment provider for the $5/month Pro subscription
• Contact Information: Any additional contact details you provide for support or communications

2.2 Document Content & Local Storage

All of your documents are stored locally on your browser — they never touch or get stored on our servers.

• Local Storage: All documents, drafts, text, styling, images, and visual layouts you create remain entirely on your local device within your browser storage. We never collect, host, inspect, or store your documents on our servers.
• AI Interactions: When you explicitly choose to use an AI feature, only your selected text or prompt is transmitted securely to third-party AI providers (OpenAI / Google) to process your request in real time. We do not store or retain this document content.

2.3 Technical Information

• Usage Data: Pages visited, features used, time spent, and interaction patterns
• Device Information: Browser type, operating system, device type, and screen resolution
• Log Data: IP address, access times, and technical error information
• Cookies and Tracking: Cookies and similar technologies for functionality and analytics

3. How We Use Your Information

We use the collected information for various purposes:

• Service Provision: To provide, maintain, and improve our AI-powered document builder
• Account Management: To create and manage your account and subscription tier
• Payment Processing: To process $5/month Pro subscription payments through Paddle
• Communication: To send you important notices, updates, and support communications
• AI Functionality: To power our AI content generation features and improve their accuracy
• PDF Export: To process and generate PDF exports of your documents
• Security: To detect, prevent, and address technical issues and security threats
• Analytics: To understand usage patterns and improve our Service
• Legal Compliance: To comply with legal obligations and enforce our Terms and Conditions

4. Information Sharing and Disclosure

We may share your information in the following circumstances:

4.1 Service Providers

We engage trusted third-party companies to perform services on our behalf, including:

• Paddle: Payment processing as our Merchant of Record
• Cloud Services: Hosting and infrastructure providers
• Analytics Services: Tools that help us understand usage patterns
• Email Services: For sending communications and notifications

4.2 Legal Requirements

We may disclose your information when required by law or to protect our rights:

• To comply with legal obligations, court orders, or government requests
• To protect and defend our rights, property, or safety
• To prevent fraud or enforce our Terms and Conditions
• In connection with a business transfer, merger, or acquisition

4.3 User Consent

We may share your information with your consent for specific purposes, such as integrating with third-party services you choose to connect with our platform.

5. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption: Data is encrypted in transit and at rest using industry-standard encryption
• Access Controls: Strict access controls limit who can access your data
• Secure Infrastructure: We use secure cloud infrastructure with regular security updates
• Payment Security: Payment information is processed securely through Paddle
• Regular Audits: We conduct regular security assessments and audits

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your information for different periods depending on the purpose:

• Account Information: Retained while your account is active and for a reasonable period after account closure
• Document Content: Zero server retention. All of your documents are stored locally on your browser and never touch or reside on our servers. You have complete control to keep, clear, or export them at any time.
• Payment Records: Retained as required for legal and accounting purposes
• Analytics Data: Retained in anonymized or aggregated form for analytical purposes

You can request deletion of your account and associated data at any time, subject to legal and operational requirements.

7. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request transfer of your data to another service
• Objection: Object to certain processing activities
• Restriction: Request restriction of processing activities
• Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, please contact us using the information provided below.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for basic functionality and security
• Performance Cookies: Help us understand how our Service is used
• Functionality Cookies: Remember your preferences and settings
• Targeting Cookies: Used for personalized content and advertising (with consent)

You can control cookie settings through your browser preferences. Note that disabling certain cookies may affect the functionality of our Service.

9. Third-Party Services

Our Service may integrate with third-party services or contain links to third-party websites. These third parties have their own privacy policies and practices:

• Paddle: Processes payments and handles related data. Review their privacy policy at paddle.com/privacy
• AI Services: We may use third-party AI services to power certain features
• Analytics Providers: Services like Google Analytics or similar tools

We are not responsible for the privacy practices of third-party services. We encourage you to review their privacy policies.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable data protection laws.

When we transfer your information internationally, we use standard contractual clauses or other legally recognized mechanisms to ensure adequate protection.

11. Children's Privacy

Our Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under 13, we will take steps to delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Updating the "Last updated" date
• Sending you an email notification for significant changes

Your continued use of our Service after such changes constitutes your acceptance of the updated Privacy Policy.

13. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us:

We will respond to your privacy-related inquiries within a reasonable timeframe, typically within 30 days.

14. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal information on the following legal bases:

• Contractual Necessity: To provide our Service under our agreement with you
• Legal Obligation: To comply with legal requirements
• Legitimate Interests: For purposes such as security, fraud prevention, and service improvement
• Consent: When you provide consent for specific processing activities

15. Data Subject Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of your personal data
• Object to processing of your personal data
• Request restriction of processing
• Request data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

To exercise these rights, please contact us using the information provided below. We will respond to your request within 30 days.

16. Payment Data and Paddle

Payment processing is handled by Paddle, our Merchant of Record:

• Payment Information: Payment details are processed securely by Paddle and are not stored on our servers
• Data Sharing: We share only necessary information with Paddle for payment processing
• Paddle's Privacy Policy: Paddle has its own privacy policy governing payment data handling
• PCI Compliance: Paddle maintains PCI DSS compliance for payment processing
• Transaction Data: We store transaction records for accounting and legal purposes

For questions about Paddle's data practices, please review their privacy policy at paddle.com/privacy.

17. AI and Content Processing

Our AI features process your content for document generation:

• Content Processing: When you invoke AI features, only your designated prompt/text is processed by AI services to generate or enhance content
• AI Service Providers: We use third-party AI services (e.g., OpenAI, Google) that process requests via secure API
• Zero Server Storage: Your documents remain stored locally on your browser and never touch or get stored on our servers
• Training Data: We do not use your content or documents to train AI models
• Content Ownership: You retain full, exclusive ownership of all content and documents you create

AI-generated content is provided for your use, and you are responsible for ensuring it complies with applicable laws.

18. Data Breach Notification

In the event of a data security breach:

• Timely Notification: We will notify affected users within 72 hours of becoming aware of a breach
• Breach Details: We will provide information about what happened, what data was affected, and what steps to take
• Regulatory Notification: We will notify relevant regulatory authorities as required by law
• Remediation: We will take immediate steps to address the breach and prevent future incidents
• Support: We will provide support and guidance to affected users

19. Cross-Border Data Transfers

We ensure compliance with international data transfer requirements:

• Legal Mechanisms: We use standard contractual clauses and other legally recognized mechanisms
• Adequacy Decisions: We rely on EU adequacy decisions where applicable
• Data Protection: We ensure adequate protection for international data transfers
• Transparency: We inform users about international data processing

20. California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA:

• Right to Know: Request information about the categories of personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise your CCPA rights, please contact us using the information provided below.