Privacy Policy

Last updated: March 21, 2026

            🔒 Short version: We collect only what's necessary to run the service. We never sell your data. Documents uploaded by your clients are only visible to you.
        

1. Information We Collect

We collect the following types of information:

Account Information: Name, email address, and hashed password when you create an account.
Client Information: Names and email addresses of clients you add to the platform.
Documents: Files uploaded by your clients through magic links, including but not limited to bank statements, receipts, invoices, and tax forms.
Usage Data: Information about how you use the Service, including IP addresses, browser type, and access times.
Payment Information: Payment details are processed by Stripe and are not stored on our servers. We only store your Stripe customer ID.

2. How We Use Your Information

We use your information to:

Provide and maintain the Service
Send document request emails and reminders on your behalf
Notify you when clients upload documents
Process payments through Stripe
Improve and develop the Service
Communicate important service updates

3. How We Protect Your Data

We implement reasonable security measures to protect your data, including:

Encrypted connections (HTTPS/TLS) for all data in transit
Secure password hashing (bcrypt with salt rounds)
Authentication tokens (JWT) with expiration
Access controls — each bookkeeper can only access their own data

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data. We recommend downloading and backing up your documents regularly.

4. Data Sharing

We do not sell your data. We share information only with the following trusted third-party providers:

Stripe — Payment processing. stripe.com/privacy

Supabase — Database and file storage. supabase.com/privacy

Resend — Email delivery. resend.com/privacy

Railway — Application hosting. railway.app/legal/privacy

5. Your Clients' Data

When you use Doculy, your clients provide documents through magic links. This data is stored securely and is only accessible by you (the bookkeeper). We process this data on your behalf as a data processor. You are responsible for ensuring your clients have consented to share their documents through the Service.

6. Data Retention

We retain your data for as long as your account is active. Upon account termination, data is retained for 30 days to allow for download, after which it may be permanently deleted. You can request deletion of your data at any time by contacting us.

7. Your Rights

You have the right to:

Access the data we hold about you
Correct inaccurate data
Delete your account and associated data
Export your data
Opt out of non-essential communications

To exercise these rights, contact us at privacy@doculy.com

8. Cookies

Doculy uses only essential session cookies required for authentication. We do not use tracking or advertising cookies.

9. Children's Privacy

Doculy is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email. Continued use of the Service after changes constitutes acceptance of the new policy.

11. Contact

For privacy-related questions or requests, contact us at: privacy@doculy.com