Privacy Policy

1. Introduction

Welcome to DocsOrb UG (haftungsbeschränkt) (“DocsOrb”, “we”, “us” or “our”). We build software that helps businesses use AI safely, and protecting personal data is central to that mission. This policy explains what personal data we collect, why we collect it, how we use it, and the rights available to you.

This policy applies to our website, our platform, and related services (together, the “Services”). By using the Services, you confirm that you have read this policy.

Data the DocsOrb application collects and how it is used

DocsOrb is an AI governance application. It helps companies publish workplace policies, train employees, record acknowledgments, and enforce rules for how AI tools are used at work. This section states what personal data that application collects and what DocsOrb does with it.

Account, billing, and usage data

When you create a DocsOrb account, contact us, or use the website or application, DocsOrb collects your name, work email address, phone number if you provide one, company name, job title, account credentials, and the messages you send us. Billing and payment details are collected by our payment provider and used to charge for the subscription. DocsOrb also collects technical data needed to run the service: IP address, browser and device type, operating system, language, pages visited, features used, and log files.

DocsOrb uses this data to create and manage your account, sign you in, provide the workspace (policies, training, acknowledgments, and AI governance), process payments, answer support requests, send service messages, detect abuse, and meet legal obligations. DocsOrb shares it only with service providers that host, email, bill, or support the product, and only so they can do that work. DocsOrb does not sell personal data and does not share it for advertising.

Google account and Google Drive data

If you sign in with Google, DocsOrb receives the Google account information Google provides for sign-in: your name, email address, profile information, and Google account identifier. DocsOrb uses that information only to create and authenticate your DocsOrb account and to show who is signed in.

If your organisation connects Google Drive, an admin authorises DocsOrb with Google. DocsOrb then receives the Google account email of the person who makes that connection, and access to use Google Drive for two features only: linking files that person selects to a policy, and exporting policy PDFs into the connected Drive. The selected file stays in Google Drive. DocsOrb stores the connection so the integration keeps working, and removes it when the integration is disconnected or the account is closed, unless the law requires a longer retention period.

DocsOrb does not sell Google user data, does not use it for advertising, and does not use it to train general-purpose AI models. DocsOrb’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2. Who we are

The data controller responsible for your personal data is:

DocsOrb UG (haftungsbeschränkt)
Haymannstraße 3
85764 Oberschleißheim
Germany
Email: help@docsorb.com

3. Two different roles: controller and processor

Because our platform helps customer organisations manage their own AI usage, DocsOrb acts in two different capacities depending on the situation.

• As a data controller: for data about you if you visit our website, become a prospective customer, or hold a DocsOrb user account. This includes your name, login details, email address and billing information.
• As a data processor: for personal data that our customers submit to the DocsOrb platform while using our Services, such as records of their own AI tool usage. In this case, our customer is the controller, and we only process that data on their documented instructions, under a Data Processing Agreement.

If you are an employee or user of one of our customers and have a question about how your data is handled within the DocsOrb platform, please contact that organisation directly. This policy sets out our practices as a controller, and gives a general overview of our practices as a processor.

4. Personal data we collect

Information you provide directly

• Name
• Work email address
• Phone number
• Company name and job title
• Account login credentials
• Billing and payment details, processed by our payment provider
• Messages you send us, including support requests

Information collected automatically

• IP address
• Browser and device type
• Operating system
• Language and time zone settings
• Cookies and similar technologies
• Usage data, such as pages visited and features used
• Log files

Information from third parties

• Identity and authentication providers, for example single sign on
• Payment processors
• Analytics providers
• Publicly available business contact information, where legally permitted

5. Legal bases for processing

As a company established in Germany, the GDPR applies to our processing of personal data. We rely on the following legal bases:

• Consent: for example, for marketing emails or non essential cookies.
• Performance of a contract: to provide the Services you have signed up for.
• Legal obligation: to comply with requirements such as tax and accounting rules.
• Legitimate interests: such as keeping our Services secure and improving our product, provided these interests do not override your rights.

6. How we use personal data

• Provide, operate and maintain the Services
• Create and manage accounts
• Process payments and invoices
• Respond to support requests and enquiries
• Improve and develop our product
• Send service related communications, such as security notices
• Send marketing communications, where you have agreed to receive them
• Detect and prevent fraud, abuse and security incidents
• Meet our legal and regulatory obligations

7. Cookies and tracking technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, understand how our website and platform are used, and measure the performance of our marketing. Where the law requires it, we ask for your consent before placing non essential cookies. You can manage your preferences through our cookie banner or your browser settings at any time.

8. Marketing communications

With your consent, or where otherwise permitted by law, we may send you newsletters and product updates. You can opt out at any time by:

• Using the unsubscribe link in any marketing email
• Updating your preferences in your account settings
• Contacting us directly using the details in Section 16

9. Sharing personal data

We share personal data with service providers who help us run our business, each bound by appropriate confidentiality and data protection terms. These include:

• Supabase for authentication, database, and storage
• Resend for transactional email such as invites and reminders
• Crisp for live chat and customer support messaging
• Google Analytics for website analytics and performance measurement
• AI providers used through our AI infrastructure when users request AI-assisted features, currently Mistral and TypeSafe System One Jev
• Cloud hosting providers
• Payment processors
• Professional advisers, such as accountants or lawyers
• Government authorities, where required by law

We use Crisp.chat to provide live chat on our website. If you use the chat widget, Crisp may process data needed to operate the chat, such as cookies or similar session identifiers, IP address, device/browser information, pages visited during the chat session, and the content of your messages. Crisp states that chatbox cookies are used to restore chat sessions and messages, not for tracking purposes, and that its core user data is stored in Europe. You can read Crisp's privacy policy at crisp.chat/en/privacy .

We use Google Analytics (via Google Tag Manager) to understand how our website is used. Where required, this is only activated after you consent through our cookie banner. Google may process usage data such as pages visited, device/browser information, and approximate location derived from IP address.

A current list of our subprocessors is published on our Trust & Security page and is also available on request. We do not sell personal data, and we do not share personal data for third party advertising purposes.

10. International data transfers

DocsOrb is based in Germany, within the European Economic Area. Where personal data is transferred outside the EEA, the United Kingdom or Switzerland, for example to a service provider based elsewhere, we put appropriate safeguards in place. These may include:

• European Commission Standard Contractual Clauses
• The UK International Data Transfer Addendum
• An applicable adequacy decision
• Other lawful transfer mechanisms recognised under the GDPR

11. Data retention

We keep personal data only for as long as it is needed for the purpose it was collected, including to provide the Services, meet legal and tax obligations, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of data. Account data is generally deleted or anonymised within three (3) months of account closure, unless we are required by law to keep it for longer.

12. Your rights under the GDPR

If the GDPR applies to you, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Restrict how we process your data
• Object to processing based on legitimate interests
• Withdraw consent at any time, without affecting processing carried out before withdrawal
• Receive your data in a portable format
• Not be subject to a decision based solely on automated processing that has a significant effect on you
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us using the details in Section 16. We will respond within the timeframes required by law.

13. Data security

We take appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, secure hosting, authentication requirements, regular monitoring and staff confidentiality obligations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Children's privacy

Our Services are business tools and are not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us so we can remove it.

15. Third party websites

Our website and Services may link to third party websites. We are not responsible for the privacy practices of those sites, and we encourage you to review their policies before providing any personal data.

16. Contact us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

DocsOrb UG (haftungsbeschränkt)
Haymannstraße 3
85764 Oberschleißheim
Germany
Email: help@docsorb.com

17. Supervisory authority

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar rights, you may lodge a complaint with your local data protection authority. As we are established in Germany, our lead supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), though you may also contact the authority in your own country of residence. We encourage you to contact us first so we can attempt to resolve your concerns promptly.

18. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the “Last updated” date at the top of this page, and where required by law, provide additional notice or obtain your consent.

Questions about this policy? Contact us at help@docsorb.com.