Privacy Policy

This Privacy Policy describes how docEvault LLC ("docEvault," "we," "us," or "our"), a California limited liability company, collects, uses, discloses, and protects information about you when you use our document collection platform. By using the Service, you agree to the practices described here.

1. Information We Collect

1.1 Information You Provide

• Account registration: name, email address, organization name, and password (or, if you sign in with Google, the details described in Section 1.6)
• Profile information: job title, phone number, and other optional details
• Documents and files you upload or that contacts upload to your account
• Messages sent through the Service's messaging features
• Payment information: billing address processed through Stripe (we do not store full card numbers)
• Support requests and communications with us

1.2 Information Collected Automatically

• Log data: IP address, browser type, operating system, pages viewed, and timestamps
• Device information: hardware model, OS version, and unique device identifiers
• Usage data: features used, actions taken, and portal access history
• Cookies: session, preference, and analytics cookies

1.3 Information from Third Parties

• Cloud storage providers (Google Drive, Dropbox, Box): encrypted access tokens when you connect these accounts, used solely to write approved documents into a docEvault folder in that account (see Section 1.4 for the access each provider grants)
• Clio Manage: for each team member who connects their own Clio account, encrypted access tokens and that Clio user's name and email address (see Section 1.5)
• Zapier: workflow automation data when you configure integrations
• Stripe: transaction confirmations and billing status

1.4 Cloud Storage Integration Details

The access we request depends on what each provider offers:

• Dropbox: we request Dropbox's "App Folder" permission, which limits our access to a single dedicated app folder within your account — never your full Dropbox account or files outside that folder.
• Google Drive: we request only Google's drive.file permission, which lets docEvault see and change only the folders and files docEvault itself creates in your Drive — never the rest of your Drive. Section 1.6 describes the Google user data we receive and how we handle it.
• Box: Box does not offer an app-folder-only permission, so connecting Box grants Box's "Read and write all files and folders" permission over the Box account you connect. We use it only to create a docEvault folder (named /docEvault unless you choose another) and the client subfolders inside it, to upload documents you've approved into those folders and add new versions of files we placed there, and to read your Box account's email address and the location of files we placed so we can show you where they went. When your browser uploads a file to Box directly, it receives a short-lived token Box restricts to uploading into that one folder or file. Your Box administrator may need to approve docEvault before it can connect, and you can remove its access at any time from Box's own settings as well as from docEvault.

With any of these providers, we use the connection only to write documents you've approved into the docEvault folder; we do not browse your account, and we do not read or import the contents of any file back into docEvault.

Access and refresh tokens for connected cloud storage accounts are encrypted at rest. When you disconnect an integration from Settings → Integrations, we ask the provider to revoke our access and immediately delete the stored tokens for that connection.

We do not use data obtained through cloud storage integrations to train artificial intelligence or machine learning models, and we do not share it with any party except as needed to operate the integration itself (i.e., transmitting your documents to the provider, such as Google Drive, Dropbox or Box, that you connected). docEvault is not affiliated with, sponsored by, or endorsed by Google, Dropbox, Box, or any other cloud storage provider we integrate with.

1.5 Clio Integration Details

An admin turns Clio on for your organization, and each team member who wants to use it connects their own Clio account, because Clio records which of its users added each document. Connecting grants docEvault the permissions Clio shows on its consent screen: reading contacts and matters, and reading and adding documents and folders, limited to what that Clio user can already see. We use a team member's connection only when that person sends documents to Clio from docEvault: to search their clients and matters, list and create folders in the matter they choose, and upload the approved documents they selected (as new documents, new versions of documents we placed there before, or one combined PDF). We do not import anything from Clio into docEvault other than the names and numbers needed to show you where a document went, and we never send anything to Clio automatically.

Clio access tokens are encrypted at rest. When a team member disconnects Clio, or an admin removes them from the team, we ask Clio to revoke that person's access and delete the stored tokens. We do not use data obtained through Clio to train artificial intelligence or machine learning models. docEvault is not affiliated with, sponsored by, or endorsed by Clio.

1.6 Google User Data

docEvault uses Google's APIs in two places: Sign in with Google, and the Google Drive integration. This section describes the Google user data we access and what we do with it.

What we access.

• Sign in with Google: your name, your email address, and your Google account ID. We receive these only if you choose to sign in with Google.
• Google Drive: we access Drive only through Google's drive.file permission, and only after a member of your firm connects Drive in Settings → Integrations. That permission covers only the folders and files docEvault creates, so we cannot see or open anything else in your Drive. We also receive the email address of the connected Google account, and Google's IDs for the folders and files we create.

How we use it.

• We use your sign-in details only to sign you in to your docEvault account and identify you within it.
• We use the Drive connection only to create a docEvault folder and client subfolders in your Drive. We upload into them the documents your firm has approved in docEvault, or chosen to send there. We add a new version when a document we placed there is sent again. We record where each file went so we can show your firm. We never read the contents of files in your Drive, and we never import Drive files into docEvault.
• We do not use Google user data for advertising, including targeted, personalized, retargeted, or interest-based advertising. We do not sell it, and we do not transfer it to data brokers or information resellers. We do not use it to determine credit-worthiness or for lending.
• docEvault does not use Google Workspace APIs (including the Google Drive API), or any data obtained through them, to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

Who we share it with. We do not share, transfer, or disclose Google user data to anyone except as needed to provide the features described above, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you. Within docEvault, members of your firm can see which Google account Drive is connected to and where each document was placed. Your connection details are stored with our hosting provider (Railway), which processes them only on our behalf and does not use them for any other purpose.

How we protect it. Google access and refresh tokens are encrypted at rest (AES-256) before they are stored. All data travels over TLS/HTTPS. The tokens are used only by the docEvault service itself, to carry out the actions described above.

Retention and deletion. We keep each kind of Google user data only as long as we need it for the purpose above:

• Google Drive tokens and the connected account's email address are kept only while Drive is connected, because we need them to copy documents into it. When anyone in your firm disconnects Google Drive in Settings → Integrations, or your firm closes its docEvault account, we ask Google to revoke docEvault's access and delete the stored tokens immediately. You can also remove docEvault's access at any time at myaccount.google.com/connections.
• The record of where each document was placed in Drive is kept with that document so your firm can see where it went, and is deleted when the document is deleted.
• Sign-in details are kept while you are a member of a docEvault account, because we need them to sign you in. If your firm removes you from its team, your user record, including your Google account ID, is deleted. If your firm closes its account, we delete the Google account IDs of all its members immediately. Members' names and email addresses then remain only in that closed account's history, such as who approved each document, until you or your firm asks us to delete them.

Files we placed in your Drive belong to you and stay there unless you delete them. To ask us to delete any Google user data we hold, email support@docevault.com. We respond within 30 days.

Changes. If we change how docEvault accesses or uses Google user data, we will update this section and notify affected users before the change takes effect.

Limited Use. docEvault's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. How We Use Your Information

• Provide, maintain, and improve the Service
• Process transactions and send related notices
• Send document request notifications and email reminders to your contacts on your behalf
• Send SMS reminders to your contacts on your behalf (Professional and Enterprise plans only)
• Respond to your support requests
• Monitor usage patterns to improve the Service
• Detect and prevent fraud and illegal activities
• Comply with legal obligations

3. SMS Consent and Phone Number Data

No mobile information will be shared with third party/affiliates for marketing or promotional purposes.

If you provide a contact's phone number, the Service emails that contact a secure link to a consent form. On that form, the contact reviews and may correct the phone number on file, and separately checks a box to opt in to receive SMS text reminders from you regarding their document request — consent is given by the contact directly, not attested on their behalf. We store this confirmation, along with the date and time it was provided, as part of the contact record in your account. Phone numbers and consent records are stored securely and encrypted at rest, the same as all other data in the Service (see Section 6).

SMS reminders are disabled for any contact until this confirmation is recorded. If a phone number is added without confirmed consent, we retain the phone number for your reference, but will not transmit any SMS messages to it until consent is confirmed.

Message frequency varies depending on your reminder schedule and the number of outstanding document requests. Message and data rates may apply. Contacts may reply STOP at any time to opt out of future messages, or HELP for assistance; we honor opt-out requests immediately and will not deliver further SMS to that number on your behalf.

We use Twilio strictly as our SMS delivery service provider: Twilio processes a contact's phone number and consent record solely to transmit the reminder messages you authorize, and does not use that data for its own purposes. This service-provider relationship is the only circumstance in which we provide mobile phone numbers or consent records to another company; see Section 4.1 below for the other service providers we use in the same limited capacity.

Text messaging originator opt-in data and consent — meaning the fact that a contact consented to receive SMS reminders, and the record of that consent — is not shared with any third parties. The only exception is the service-provider relationship with Twilio described above, which exists solely to deliver the messages you authorize; Twilio is not a third-party recipient of this data in any other sense.

Other than as described above, we do not share, sell, or otherwise provide your mobile phone number or messaging consent information to any third parties or affiliates for marketing or promotional purposes.

All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

4. How We Share Your Information

4.1 Service Providers

We share information with vendors who perform services on our behalf, strictly to operate the Service: Cloudflare R2 (file storage), Stripe (payments), SendGrid (email), Twilio (SMS), and Railway (hosting). These vendors are not third parties or affiliates for marketing purposes — they do not use your information for their own marketing or promotional purposes.

4.2 Your Contacts

When you send a document request, we share your organization name and request details with the recipients of those requests.

4.3 Legal Requirements

We may disclose your information as required by applicable law or valid legal process.

4.4 No Sharing, Sale, or Marketing Use of Personal Information

Except for the service providers described in Section 4.1 (who process information only to help us operate the Service) and disclosures required by law (Section 4.3), we do not sell, rent, trade, or share your personal information — including mobile phone numbers and messaging consent records — with any third party or affiliate for marketing or promotional purposes.

5. Data Retention

We retain your information for as long as your account is active. You may request deletion at any time by emailing support@docevault.com. We respond within 30 days. Uploaded documents are deleted upon account termination or upon your explicit request.

If you disconnect a cloud storage integration (such as Google Drive, Dropbox or Box) from Settings → Integrations, we delete the associated access tokens immediately — see Section 1.4 for details on how we handle cloud storage data. The same applies when a team member disconnects their Clio account (see Section 1.5).

6. Security

• Encryption of all data in transit via TLS/HTTPS
• Encryption of stored documents via Cloudflare R2 server-side encryption
• Single-session enforcement per seat to prevent unauthorized credential sharing
• Access controls, authentication requirements, and portal access logging

No security system is impenetrable. In the event of a breach, we will notify affected users as required by law.

7. Your Rights and Choices

You may update your information in Settings or by emailing support@docevault.com. You may opt out of promotional emails via the unsubscribe link. You cannot opt out of transactional communications (security alerts, document notifications).

8. GDPR - European Union Users

If you are located in the EEA, UK, or Switzerland, you have the following rights under GDPR:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

Our legal basis for processing is: (a) performance of a contract; (b) legitimate interests; and (c) legal obligations. For international transfers from the EU, we rely on Standard Contractual Clauses (SCCs). Contact us at support@docevault.com with "GDPR Request" in the subject line. You may also lodge a complaint with your local data protection authority.

9. PIPEDA - Canadian Users

If you are located in Canada, your information is protected under PIPEDA. You have the right to know why we collect your information, to access it, to request corrections, and to withdraw consent. To exercise these rights or raise a concern, email support@docevault.com with "PIPEDA Request" in the subject line. You may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

10. California Privacy Rights (CCPA)

California residents have the right to know what personal information we collect, to request deletion, and to non-discrimination for exercising these rights. We do not sell personal information. To submit a CCPA request, email support@docevault.com with "CCPA Request" in the subject line. We respond within 45 days.

11. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe we have done so inadvertently, contact us immediately at support@docevault.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Service before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

13. Contact Us

docEvault LLC · A California Limited Liability Company · support@docevault.com · https://www.docevault.com