Privacy Policy

This policy explains how docraft (“we”, “us”) handles personal data when you use the docraft app at app.docraft.art and this website. If you have questions, write to support@docraft.art.

What we collect

Account information. Your email address, your name if you give one, your interface language, and whether your email is verified. If you sign in with Google, we receive your email address and name from Google; we do not receive your Google password. Sign-in is handled by our own identity service (Keycloak) at auth.docraft.art, which stores your password (as a hash) if you use email and password, and your two-factor settings if you turn them on.

Your content. What you write and upload to create and revise documents: your requests and chat messages, attachments (data files, drafts, PDFs, images, reference files, game and music files), the documents and their versions, checklists, annotations and replies, and the reference metadata you look up by DOI.

Spaces and collaboration. The spaces you belong to, your role in each, invitations you send or receive (including the invitee’s email address), and share links you create.

Billing. Your plan, subscription status, points balance and usage per turn. Payments are processed by Stripe; we receive a customer ID, the subscription state and invoice references, but never your full card number.

Technical data. Request logs and metrics needed to run and secure the service: time, the endpoint, response status, timing, a request ID, document and space IDs, and your IP address in transit. Logs do not contain document text, attachments or source content. This website (docraft.art) keeps access logs: the time, the page, the referring page, the browser identifier (User-Agent), the country or region inferred from the IP address, and the IP address, to count visits and where visitors come from, find errors and prevent abuse. We do not use analytics scripts or cookies to track you.

Free tools. The free converters on this website (such as SGF to PDF) send the file you choose to our server to be typeset and return the result to you. Neither the file nor the result is kept or used to train models. To prevent abuse, we count conversions per IP address; the counts are deleted within two hours.

Why we use it

• To provide the service: generate and typeset your documents, keep versions, let you collaborate and share.
• To bill you and enforce plan limits (points, document counts).
• To keep the service secure and reliable: rate limiting, abuse prevention, debugging and monitoring.
• To send service emails: invitations, billing notices and usage alerts. We do not send marketing email without your consent.

Where the GDPR applies, our legal bases are performance of our contract with you (providing the service), our legitimate interests (security, reliability, preventing abuse), compliance with legal obligations (tax and accounting records), and your consent where we ask for it.

AI processing

To work on your document, docraft sends your request, the relevant document content and attachments, your annotations and the chat to the model provider, Anthropic, through its commercial API. Under Anthropic’s commercial terms, inputs and outputs are not used to train its models by default, and they are deleted from Anthropic’s systems within 30 days, except where longer retention is needed to enforce its usage policy or required by law. We do not use your content to train models either. See AI Use for more.

Who processes data for us

We use the following service providers (processors) and share with them only what they need:

Provider	What for	Data
Amazon Web Services (region us-west-2, United States)	Hosting, database, file storage, email delivery (Amazon SES)	All data described above
Anthropic	AI model processing	Content of the document being worked on
Stripe	Payments, invoices, tax	Billing details, email
Google	Sign-in with Google (if you choose it)	Sign-in exchange
Grafana Labs (Grafana Cloud)	Monitoring: metrics, traces and logs	Technical data, no document content
Crossref, DataCite (via doi.org)	Looking up references when you paste DOIs	The DOIs you look up

We do not sell your personal data and do not share it for advertising.

Where data is stored

Your account and content are stored with Amazon Web Services in the us-west-2 region (Oregon, United States). If you are outside the United States, your data is transferred there. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

How long we keep it

• Documents stay until you delete them. Deleted documents stay in the trash for 30 days, then are deleted for good.
• Versions: on the free plan, older versions are kept for 30 days or the last 20, whichever is more; paid plans keep all versions.
• Deleted accounts: your personal space and its documents are deleted for good 30 days after you delete your account, and your sign-in account is removed from our identity service. Documents you wrote in team spaces remain with that space; your name on them is removed from your user record.
• Backups: database backups are kept for 7 days, and deleted files remain in versioned storage for 30 days before they are purged.
• Billing records are kept as long as tax and accounting law requires.
• Logs and monitoring data are kept for a limited period for security and debugging. Access logs of this website are deleted after 90 days.

Your rights and choices

• Export: in the app, Account settings → Export my data downloads a zip with the attachments, conversations and annotations of the documents in your personal space and your account details. Each document can be exported as a PDF.
• Delete: Account settings → Delete account deletes your account as described above. You can also delete individual documents at any time.
• Correct: you can change your name and language in the app.
• Depending on where you live, you may also have the right to access, restrict or object to processing, and to complain to your data protection authority. Write to support@docraft.art and we will respond within the time the law requires.

Cookies and local storage

The app uses only cookies that are strictly necessary: a session cookie that keeps you signed in, and short-lived cookies used during sign-in. We don’t use advertising or analytics cookies, so we don’t show a cookie banner. This website sets no cookies; it stores your language choice in your browser’s local storage when you switch languages.

Security

Data is encrypted in transit (HTTPS) and at rest. Access is limited by space and role, documents are compiled in isolated, network-less worker processes, and secrets are kept in a managed secrets store.

Children

docraft is not directed to children under 16, and we do not knowingly collect their personal data.

Changes

If we change this policy in a meaningful way, we will update the date above and, for material changes, notify account holders by email or in the app.

Contact

docraft · support@docraft.art