Privacy Policy

What we store

• Your account: email address and name, used to sign you in, send notifications and show who did what.
• Your documents, templates, versions and business memory (company, client, pricing and similar details you enter or generate).
• Client portal data about your clients: their name and email, their comments, approvals, pricing selections, calculator answers and payments.
• E-signature records: the signer's name, email, typed signature, IP address, browser details and a fingerprint (SHA-256 hash) of the signed content. These are kept as evidence of who signed and from where.
• Activity and security logs, including the IP address and browser of the person who made a request, delivery records for the emails we send for you, and in-app notifications.
• Billing: your plan and Stripe customer and subscription ids. Card details are entered on Stripe's own pages and never reach our servers.

How we use it

Only to run the service you signed up for: generating and storing documents, sharing them with your clients, collecting signatures and payments, sending the notifications you set up, keeping the service secure, and billing.

We do not sell your data and we do not use it for advertising.

AI processing

When you generate, rewrite or ask questions about documents, the relevant text (your prompt, the document, and matching business memory) is sent to our AI providers, OpenAI and Anthropic, to produce the result. Don't put information into a prompt that you aren't allowed to share with them.

Who processes it for us

• Supabase: database, file storage and sign-in.
• Vercel: hosting.
• OpenAI and Anthropic: AI generation.
• Stripe: subscriptions and client payments.
• Resend: email delivery.
• Sentry: error reports, and, inside the signed-in app only, session replays (about 1 in 10 sessions, plus any session where an error happens) with all text, form inputs and images masked. Recording stops as soon as you leave the signed-in app; public pages, sign-in and anything your clients open (portals, intake forms, shared documents) are never recorded. Links to portals, intake forms and shared documents are stripped of their access codes before any error report is sent.
• Slack: when you send feedback from the app, the message and your email address go to our team's Slack.
• Cloudflare Turnstile: bot protection on the sign-in page.

How long we keep it

• Most data is kept for as long as your account exists and is deleted when you delete the account. That includes the signature, approval and payment records for documents you sent on your own, so download a copy first if you need to keep them.
• Work you did in a team is not deleted with your account. Your team portals (with their clients' signatures and payments), documents (including documents you shared with the team), intake requests, contracts, companies and business memory pass to the team owner. A document of yours that sits in a teammate's portal passes to that portal's owner.
• Some shared records are kept after you delete your account, with your name removed: approval requests and their decisions, approval workflows, documents shared with a team, and marketplace purchases.
• Documents in the trash are deleted for good after 30 days. A document that carries a client signature (or decline), approval or payment can't be deleted while your account exists; it keeps that record.
• Integration event logs and webhook delivery records are deleted after 90 days.
• Operational records are deleted after a set time: read notifications, sent email records (except bounces and complaints) and rate-limit logs after 90 days; download, template-usage, API-usage and automation and agent run records after 180 days; client portal views and activity after a year. Signature and audit evidence is not deleted this way.
• One-time signing verification codes (stored only as a hash, with the signer's email address) are deleted 30 days after they expire.
• Email addresses that bounced or marked our email as spam are kept on a suppression list (the address, the reason and when it happened) so they are not emailed again. Ask us if you want an address taken off it.
• When you delete your account, your own activity and security logs are deleted. Entries in a team's activity log stay with the team, no longer linked to you and with your IP address and browser details removed. A record that the account was deleted is kept, holding a keyed one-way hash of your email address rather than the address.
• Rate-limit counters store a salted, one-way hash rather than your IP address.
• Stripe keeps its own customer and payment records under its own privacy policy (for example to meet tax and fraud-prevention rules). Deleting your account cancels your Doc-OS subscription but does not delete those records.
• Our hosting provider keeps database backups for a limited period, after which they are overwritten, so deleted data can remain in a backup until then. Backups are used only to recover from a failure.

Your choices

• Download a copy of your data from your account settings: your documents and settings, plus your client portals and your clients' activity in them (comments, approvals, signatures and the signing audit trail), and a list of your stored files (uploads, PDF edits, logos and signature certificates) with download links that work for an hour.
• Delete your account, and the data that belongs to it, from your account settings.
• Your clients can ask you to correct or remove what you hold about them. You can remove documents from a portal (which also removes the client's comments on them) or close the portal; a document they signed, approved or paid for is archived (hidden from them) instead, so the record of that transaction is kept.

Contact

Questions about privacy, or a request to access, correct or delete your data: email support@corysentities.com. If you're a client of a Doc-OS user (you signed, approved or paid for something through their portal), you can also contact that business directly, since they control that information. Signed-in users can also use the Feedback button in the app.