This policy explains what personal data DocFlo collects, how we use it, and your rights under the GDPR, UK GDPR, and CCPA. We collect the minimum data required to operate the service.
DocFlo (“we”, “our”, “us”) operates docflo.app and provides browser-based PDF processing tools. For GDPR purposes, DocFlo is the data controller. We do not currently have a formal DPO — all privacy enquiries are handled directly by our team.
We acknowledge requests within 72 hours and respond fully within 30 calendar days.
ACCOUNT DATA — REGISTERED USERS ONLY
USAGE DATA — ALL USERS
IPs are truncated to /24 (IPv4) or /48 (IPv6) before storage — individual devices cannot be identified.
WE DO NOT COLLECT
Every processing activity requires a lawful basis under the GDPR. The table below sets out our basis for each activity.
Where we rely on legitimate interests, we have conducted a Legitimate Interests Assessment (LIA). You may request a copy at privacy@docflo.app.
We do not use your data for:
Advertising, behavioural profiling, selling to third parties, training ML models, or any purpose not listed above. We do not send marketing emails.
Files are uploaded over HTTPS/TLS 1.3.
Files are held in memory or a temporary server path only for the duration of the operation (typically seconds).
Files are deleted from our servers immediately after the processed output is returned to you.
We do not write files to any persistent database or long-term object storage.
We do not read, index, scan, or analyse file contents beyond executing the requested operation.
Your files are never shared with third parties, used for ML training, or disclosed to any other user.
We share personal data only with the following sub-processors, each bound by DPAs and appropriate safeguards. We use no advertising networks, analytics platforms, or data brokers.
Our primary infrastructure is in the EU. Some sub-processors (Stripe, Vercel, Google) are US-based. For transfers outside the EU/EEA we rely on:
EU Standard Contractual Clauses (SCCs)
Incorporated into DPAs with US-based sub-processors, providing enforceable data protection obligations under EU law.
EU-US Data Privacy Framework (DPF)
Where sub-processors are DPF-certified (Stripe, Google, Vercel), this provides an EU Commission adequacy decision.
UK IDTAs / UK SCC Addendum
For transfers affecting UK residents, we rely on IDTAs or the UK addendum to SCCs.
We use strictly necessary cookies only — no advertising, analytics, or tracking cookies. For the full cookie reference table, browser management instructions, and legal basis under the ePrivacy Directive, see our Cookie Policy →
Retention periods expire automatically via scheduled cleanup jobs. If you request account deletion before a natural expiry, we delete all data immediately except where legally required to retain it.
GDPR RIGHTS — EU / EEA / UK RESIDENTS
Request a copy of all personal data we hold about you.
Correct inaccurate data or complete incomplete data without undue delay.
"Right to be Forgotten" — request deletion where data is no longer necessary, consent is withdrawn, or you object and we have no overriding grounds.
Receive your personal data in a structured, machine-readable format (JSON or CSV).
Limit processing while you contest accuracy or await objection resolution.
Object to processing based on legitimate interests. We will stop unless we demonstrate compelling overriding grounds.
Lodge a complaint with your national DPA (EU: edpb.europa.eu · UK: ico.org.uk). We prefer the chance to address concerns first.
HOW TO EXERCISE YOUR RIGHTS
Email privacy@docflo.app with your account email. We acknowledge within 72 hours, respond fully within 30 days (up to 90 for complex requests). We verify identity before fulfilling requests to prevent unauthorised disclosure.
DocFlo does not use automated decision-making or profiling (as defined in GDPR Art. 22) that produces legal or similarly significant effects on individuals. Rate-limit enforcement uses simple counters — no profiling of characteristics or behaviour.
DocFlo is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, email privacy@docflo.app and we will delete it promptly. We apply 16 as our default threshold across all jurisdictions; where a Member State permits a lower age (minimum 13), a parent or guardian should contact us before a child uses the service.
ENCRYPTION IN TRANSIT
HTTPS with TLS 1.2 minimum (TLS 1.3 preferred). HTTP redirected to HTTPS.
ENCRYPTION AT REST
Database encrypted at rest by Supabase using AES-256.
PASSWORD STORAGE
bcrypt with cost factor 12. Plaintext passwords never logged or stored.
CSRF PROTECTION
All authenticated mutations require a valid CSRF token (NextAuth).
SECRETS MANAGEMENT
API keys and credentials stored as environment variables, never hard-coded.
ACCESS CONTROL
DB access restricted to least-privilege service accounts. No public internet DB access.
DEPENDENCY MONITORING
Automated vulnerability scanning with prompt updates.
FILE ISOLATION
Uploaded files processed in isolated temporary paths, never accessible to other users.
Found a vulnerability? Report it responsibly to security@docflo.app.
In the event of a personal data breach likely to result in risk to your rights and freedoms:
Notified within 72 hours of becoming aware — GDPR Art. 33.
Notified without undue delay where breach likely results in high risk — GDPR Art. 34.
Nature of breach, data categories affected, likely consequences, and remediation measures taken.
Request disclosure of the categories and specific pieces of personal information we've collected in the past 12 months.
Request deletion of your personal information, subject to certain exceptions.
Request correction of inaccurate personal information.
We do NOT sell or share your personal information for cross-context behavioural advertising. This right is not applicable to DocFlo.
We will not discriminate against you for exercising your CCPA rights.
To exercise CCPA rights, email privacy@docflo.app with subject line “CCPA Request”.
We may update this policy periodically. For material changes we will update the “Last updated” date, post a notice on the site for 30 days, and — where required by law — notify registered users by email before changes take effect. Your continued use of DocFlo after the effective date constitutes acceptance. Previous versions are available on request from privacy@docflo.app.