1. Information we collect
We collect only what's necessary to run DocChat for you.
Account information
When you sign up, we store your name, email address, profile picture (if you sign in with Google), and a hashed copy of your password. We never see or store your password in plain text.
Documents you upload
Files you upload are stored encrypted at rest. We process them to generate embeddings, summaries, and chat responses. We do not use your documents to train any AI model, ours or third-party.
Usage data
We log the standard stuff: IP address, browser type, pages visited, and timestamps. We use this to keep the service running and to spot abuse — not to build advertising profiles.
Payment information
Payments are processed by CCAvenue. We never see your card numbers. We store an order ID and the amount you paid so we can show you your billing history.
2. How we use your information
- To provide the chat, summarization, and citation features you signed up for
- To send transactional emails (receipts, password resets, important account notices)
- To respond when you contact support
- To detect abuse and keep the service secure
- To comply with legal obligations
We do not sell your personal information. We do not share your documents with anyone except the AI providers strictly required to answer your questions (see Section 4).
3. How long we keep it
Documents are kept until you delete them or close your account. Chat history is kept for the lifetime of your account so you can revisit past conversations. Account information is deleted within 30 days of you closing your account, except where law requires a longer retention (e.g., invoices kept for 7 years for tax purposes).
4. Third-party processors
We use the following sub-processors. Each is bound by a data processing agreement that prohibits using your data for any purpose other than serving you:
- Neon — managed PostgreSQL hosting
- AWS — file storage (S3) and compute (EC2)
- OpenRouter / OpenAI / Google Gemini — large language model inference
- CCAvenue — payment processing
- Resend — transactional email delivery
- Google — OAuth sign-in (only if you choose Google sign-in)
5. Your rights
Under GDPR, CCPA, and the India DPDP Act, you have the right to access, correct, export, or delete your personal data. You can do all of this directly from your account settings, or by emailing privacy@docchat.app. We'll respond within 30 days.
6. Children
DocChat is not directed to children under 13 (or 16 in the EU). If we learn we've collected information from a child, we'll delete it.
7. International transfers
Our servers are primarily in Asia-Pacific (Singapore). If you access DocChat from elsewhere, your data will be transferred to and processed in that region under standard contractual clauses.
8. Changes to this policy
If we change this policy in a material way, we'll email registered users at least 30 days before the change takes effect. Continued use after the effective date counts as acceptance.