Privacy Policy

1. Introduction

Welcome to DocsOrb UG (haftungsbeschränkt) (“DocsOrb”, “we”, “us” or “our”). We build software that helps businesses use AI safely, and protecting personal data is central to that mission. This policy explains what personal data we collect, why we collect it, how we use it, and the rights available to you.

This policy applies to our website, our platform, and related services (together, the “Services”). By using the Services, you confirm that you have read this policy.

2. Who we are

The data controller responsible for your personal data is:

DocsOrb UG (haftungsbeschränkt)
Haymannstraße 3
85764 Oberschleißheim
Germany
Email: sk@docsorb.com

3. Two different roles: controller and processor

Because our platform helps customer organisations manage their own AI usage, DocsOrb acts in two different capacities depending on the situation.

• As a data controller: for data about you if you visit our website, become a prospective customer, or hold a DocsOrb user account. This includes your name, login details, email address and billing information.
• As a data processor: for personal data that our customers submit to the DocsOrb platform while using our Services, such as records of their own AI tool usage. In this case, our customer is the controller, and we only process that data on their documented instructions, under a Data Processing Agreement.

If you are an employee or user of one of our customers and have a question about how your data is handled within the DocsOrb platform, please contact that organisation directly. This policy sets out our practices as a controller, and gives a general overview of our practices as a processor.

4. Personal data we collect

Information you provide directly

• Name
• Work email address
• Phone number
• Company name and job title
• Account login credentials
• Billing and payment details, processed by our payment provider
• Messages you send us, including support requests

Information collected automatically

• IP address
• Browser and device type
• Operating system
• Language and time zone settings
• Cookies and similar technologies
• Usage data, such as pages visited and features used
• Log files

Information from third parties

• Identity and authentication providers, for example single sign on
• Payment processors
• Analytics providers
• Publicly available business contact information, where legally permitted

5. Legal bases for processing

As a company established in Germany, the GDPR applies to our processing of personal data. We rely on the following legal bases:

• Consent: for example, for marketing emails or non essential cookies.
• Performance of a contract: to provide the Services you have signed up for.
• Legal obligation: to comply with requirements such as tax and accounting rules.
• Legitimate interests: such as keeping our Services secure and improving our product, provided these interests do not override your rights.

6. How we use personal data

• Provide, operate and maintain the Services
• Create and manage accounts
• Process payments and invoices
• Respond to support requests and enquiries
• Improve and develop our product
• Send service related communications, such as security notices
• Send marketing communications, where you have agreed to receive them
• Detect and prevent fraud, abuse and security incidents
• Meet our legal and regulatory obligations

7. Cookies and tracking technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, understand how our website and platform are used, and measure the performance of our marketing. Where the law requires it, we ask for your consent before placing non essential cookies. You can manage your preferences through our cookie banner or your browser settings at any time.

8. Marketing communications

With your consent, or where otherwise permitted by law, we may send you newsletters and product updates. You can opt out at any time by:

• Using the unsubscribe link in any marketing email
• Updating your preferences in your account settings
• Contacting us directly using the details in Section 16

9. Sharing personal data

We share personal data with service providers who help us run our business, each bound by appropriate confidentiality and data protection terms. These include:

• Supabase for authentication, database, and storage
• Resend for transactional email such as invites and reminders
• Crisp for live chat and customer support messaging
• Google Analytics for website analytics and performance measurement
• DataFast for website analytics and attribution
• AI providers used through our AI infrastructure when users request AI-assisted features
• Cloud hosting providers
• Payment processors
• Professional advisers, such as accountants or lawyers
• Government authorities, where required by law

We use Crisp.chat to provide live chat on our website. If you use the chat widget, Crisp may process data needed to operate the chat, such as cookies or similar session identifiers, IP address, device/browser information, pages visited during the chat session, and the content of your messages. Crisp states that chatbox cookies are used to restore chat sessions and messages, not for tracking purposes, and that its core user data is stored in Europe. You can read Crisp's privacy policy at crisp.chat/en/privacy .

We use Google Analytics (via Google Tag Manager) to understand how our website is used. Where required, this is only activated after you consent through our cookie banner. Google may process usage data such as pages visited, device/browser information, and approximate location derived from IP address.

We use DataFast (JustShipIt Pte. Ltd.) for website analytics and attribution. Where required, this is only activated after you consent through our cookie banner. DataFast may process usage data such as pages visited, referrer, device and browser information, approximate location, IP address, and unique identifiers stored in cookies (datafast_visitor_id, datafast_session_id). DataFast acts as our processor and may transfer data outside the EEA, including to the United States. You can read DataFast's privacy policy at datafa.st/privacy-policy .

A current list of our subprocessors is available on request. We do not sell personal data, and we do not share personal data for third party advertising purposes.

10. International data transfers

DocsOrb is based in Germany, within the European Economic Area. Where personal data is transferred outside the EEA, the United Kingdom or Switzerland, for example to a service provider based elsewhere, we put appropriate safeguards in place. These may include:

• European Commission Standard Contractual Clauses
• The UK International Data Transfer Addendum
• An applicable adequacy decision
• Other lawful transfer mechanisms recognised under the GDPR

11. Data retention

We keep personal data only for as long as it is needed for the purpose it was collected, including to provide the Services, meet legal and tax obligations, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of data. Account data is generally deleted or anonymised within three (3) months of account closure, unless we are required by law to keep it for longer.

12. Your rights under the GDPR

If the GDPR applies to you, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Restrict how we process your data
• Object to processing based on legitimate interests
• Withdraw consent at any time, without affecting processing carried out before withdrawal
• Receive your data in a portable format
• Not be subject to a decision based solely on automated processing that has a significant effect on you
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us using the details in Section 16. We will respond within the timeframes required by law.

13. Data security

We take appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, secure hosting, authentication requirements, regular monitoring and staff confidentiality obligations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Children's privacy

Our Services are business tools and are not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us so we can remove it.

15. Third party websites

Our website and Services may link to third party websites. We are not responsible for the privacy practices of those sites, and we encourage you to review their policies before providing any personal data.

16. Contact us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

DocsOrb UG (haftungsbeschränkt)
Haymannstraße 3
85764 Oberschleißheim
Germany
Email: sk@docsorb.com

17. Supervisory authority

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar rights, you may lodge a complaint with your local data protection authority. As we are established in Germany, our lead supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), though you may also contact the authority in your own country of residence. We encourage you to contact us first so we can attempt to resolve your concerns promptly.

18. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the “Last updated” date at the top of this page, and where required by law, provide additional notice or obtain your consent.

Questions about this policy? Contact us at sk@docsorb.com.