This Privacy Policy describes how docEvault LLC ("docEvault," "we," "us," or "our"), a California limited liability company, collects, uses, discloses, and protects information about you when you use our document collection platform. By using the Service, you agree to the practices described here.
1. Information We Collect
1.1 Information You Provide
- Account registration: name, email address, organization name, and password
- Profile information: job title, phone number, and other optional details
- Documents and files you upload or that contacts upload to your account
- Messages sent through the Service's messaging features
- Payment information: billing address processed through Stripe (we do not store full card numbers)
- Support requests and communications with us
1.2 Information Collected Automatically
- Log data: IP address, browser type, operating system, pages viewed, and timestamps
- Device information: hardware model, OS version, and unique device identifiers
- Usage data: features used, actions taken, and portal access history
- Cookies: session, preference, and analytics cookies
1.3 Information from Third Parties
- Cloud storage providers (Google Drive, Dropbox, Microsoft 365, Box, Zoho WorkDrive): encrypted access tokens when you connect these accounts, used solely to write approved documents into a dedicated app folder in that account (see Section 1.4)
- Zapier: workflow automation data when you configure integrations
- Stripe: transaction confirmations and billing status
1.4 Cloud Storage Integration Details
When you connect a cloud storage provider such as Dropbox, we request access limited to a single dedicated app folder within your account (for example, Dropbox's "App Folder" permission) — never your full Dropbox account or files outside that folder. We use this connection only to write documents you've approved into that folder; we do not read, browse, or import files from your cloud storage account back into docEvault.
Access and refresh tokens for connected cloud storage accounts are encrypted at rest. When you disconnect an integration from Settings → Integrations, we immediately delete the stored tokens for that connection.
We do not use data obtained through cloud storage integrations to train artificial intelligence or machine learning models, and we do not share it with any party except as needed to operate the integration itself (i.e., transmitting your documents to the provider, such as Dropbox, that you connected). docEvault is not affiliated with, sponsored by, or endorsed by Dropbox or any other cloud storage provider we integrate with.
2. How We Use Your Information
- Provide, maintain, and improve the Service
- Process transactions and send related notices
- Send document request notifications and email reminders to your contacts on your behalf
- Send SMS reminders to your contacts on your behalf (Professional and Enterprise plans only)
- Respond to your support requests
- Monitor usage patterns to improve the Service
- Detect and prevent fraud and illegal activities
- Comply with legal obligations
3. SMS Consent and Phone Number Data
No mobile information will be shared with third party/affiliates for marketing or promotional purposes.
If you provide a contact's phone number, the Service emails that contact a secure link to a consent form. On that form, the contact reviews and may correct the phone number on file, and separately checks a box to opt in to receive SMS text reminders from you regarding their document request — consent is given by the contact directly, not attested on their behalf. We store this confirmation, along with the date and time it was provided, as part of the contact record in your account. Phone numbers and consent records are stored securely and encrypted at rest, the same as all other data in the Service (see Section 6).
SMS reminders are disabled for any contact until this confirmation is recorded. If a phone number is added without confirmed consent, we retain the phone number for your reference, but will not transmit any SMS messages to it until consent is confirmed.
Message frequency varies depending on your reminder schedule and the number of outstanding document requests. Message and data rates may apply. Contacts may reply STOP at any time to opt out of future messages, or HELP for assistance; we honor opt-out requests immediately and will not deliver further SMS to that number on your behalf.
We use Twilio strictly as our SMS delivery service provider: Twilio processes a contact's phone number and consent record solely to transmit the reminder messages you authorize, and does not use that data for its own purposes. This service-provider relationship is the only circumstance in which we provide mobile phone numbers or consent records to another company; see Section 4.1 below for the other service providers we use in the same limited capacity.
Text messaging originator opt-in data and consent — meaning the fact that a contact consented to receive SMS reminders, and the record of that consent — is not shared with any third parties. The only exception is the service-provider relationship with Twilio described above, which exists solely to deliver the messages you authorize; Twilio is not a third-party recipient of this data in any other sense.
Other than as described above, we do not share, sell, or otherwise provide your mobile phone number or messaging consent information to any third parties or affiliates for marketing or promotional purposes.
All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.
4. How We Share Your Information
4.1 Service Providers
We share information with vendors who perform services on our behalf, strictly to operate the Service: Cloudflare R2 (file storage), Stripe (payments), SendGrid (email), Twilio (SMS), and Railway (hosting). These vendors are not third parties or affiliates for marketing purposes — they do not use your information for their own marketing or promotional purposes.
4.2 Your Contacts
When you send a document request, we share your organization name and request details with the recipients of those requests.
4.3 Legal Requirements
We may disclose your information as required by applicable law or valid legal process.
4.4 No Sharing, Sale, or Marketing Use of Personal Information
Except for the service providers described in Section 4.1 (who process information only to help us operate the Service) and disclosures required by law (Section 4.3), we do not sell, rent, trade, or share your personal information — including mobile phone numbers and messaging consent records — with any third party or affiliate for marketing or promotional purposes.
5. Data Retention
We retain your information for as long as your account is active. You may request deletion at any time by emailing support@docevault.com. We respond within 30 days. Uploaded documents are deleted upon account termination or upon your explicit request.
If you disconnect a cloud storage integration (such as Dropbox) from Settings → Integrations, we delete the associated access tokens immediately — see Section 1.4 for details on how we handle cloud storage data.
6. Security
- Encryption of all data in transit via TLS/HTTPS
- Encryption of stored documents via Cloudflare R2 server-side encryption
- Single-session enforcement per seat to prevent unauthorized credential sharing
- Access controls, authentication requirements, and portal access logging
No security system is impenetrable. In the event of a breach, we will notify affected users as required by law.
7. Your Rights and Choices
You may update your information in Settings or by emailing support@docevault.com. You may opt out of promotional emails via the unsubscribe link. You cannot opt out of transactional communications (security alerts, document notifications).
8. GDPR - European Union Users
If you are located in the EEA, UK, or Switzerland, you have the following rights under GDPR:
- Right of access: obtain a copy of your personal data
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object to processing
- Right to withdraw consent at any time
Our legal basis for processing is: (a) performance of a contract; (b) legitimate interests; and (c) legal obligations. For international transfers from the EU, we rely on Standard Contractual Clauses (SCCs). Contact us at support@docevault.com with "GDPR Request" in the subject line. You may also lodge a complaint with your local data protection authority.
9. PIPEDA - Canadian Users
If you are located in Canada, your information is protected under PIPEDA. You have the right to know why we collect your information, to access it, to request corrections, and to withdraw consent. To exercise these rights or raise a concern, email support@docevault.com with "PIPEDA Request" in the subject line. You may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
10. California Privacy Rights (CCPA)
California residents have the right to know what personal information we collect, to request deletion, and to non-discrimination for exercising these rights. We do not sell personal information. To submit a CCPA request, email support@docevault.com with "CCPA Request" in the subject line. We respond within 45 days.
11. Children's Privacy
The Service is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe we have done so inadvertently, contact us immediately at support@docevault.com.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Service before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.
13. Contact Us
docEvault LLC · A California Limited Liability Company · support@docevault.com · https://www.docevault.com