Privacy Policy

Effective date: 8 October 2026 · Version: 1.2

This Privacy Policy explains how AI Fabric Limited, trading as DocAI Fabric ("AI Fabric", "we", "us"), collects, uses and shares personal data when you visit our websites, create an account, use the DocAI Fabric platform (the "Service"), contact us, or otherwise interact with us.

We are a company incorporated in Cyprus (registration number HE 495826) with our registered office at Leonidou 6, Flat/Office 102, Latsia, 2236, Nicosia, Cyprus. Our privacy contact is privacy@docaifabric.com.

This Policy is written for business users. The Service is offered to organisations, not to consumers.

1. Two roles: controller and processor

We handle personal data in two different roles, and different rules apply to each.

Account Data: we are the controller. When you sign up, log in, subscribe to updates, contact support, or use the platform, we collect data about you as a person. We decide why and how this data is used, so we are the controller and this Policy applies in full.

Customer Content: we are the processor. The documents you upload to the Service, and the data extracted from them, often contain personal data about other people (for example, the names, addresses and bank details on an invoice). Your organisation decides what to upload and why, so your organisation is the controller of that data and we process it only on its instructions. That processing is governed by our Data Processing Agreement, which forms part of our Terms of Service. Sections 2 to 5 of this Policy do not apply to Customer Content; sections 6 to 12 apply to both.

Embedded use. Some of our customers build DocAI Fabric into their own software and show our review screens inside their application. If you reach DocAI Fabric that way, that company is responsible for telling you how your data is handled; we process it on that company's instructions.

If you are an individual whose personal data appears in documents that one of our customers processed with the Service, please contact that customer. We will help them respond to your request, but we cannot act on it directly without their instruction.

2. Account Data we collect

Category	What	Where it comes from
Identity and contact	Full name, work email address, organisation name, role in the organisation	You, at sign-up or when an administrator invites you
Credentials	Password (stored only as a salted hash), session tokens, API keys you create, multi-factor secrets where enabled	You; generated by the Service
Account and configuration	Tenant and project names, roles and permissions, settings, the region you chose	You and your administrators
Usage and activity	Actions you take in the Service (the audit log), pages viewed, features used, timestamps, the IP address and browser used for each session	Generated by the Service
Technical	IP address, browser type and version, operating system, device identifiers, error reports	Your browser and device
Support and feedback	Messages you send to support, feedback and bug reports you submit through the in-app form, and any attachments you choose to include	You
AI assistant conversations	The questions you type to the in-app assistant, its answers, and the actions it took on your behalf	You; generated by the Service
Communications	Emails we send you (invitations, notifications, security alerts, changelog updates) and whether they were delivered	Generated by the Service
Billing (paid plans)	Billing contact, billing address, tax identifiers, invoices, payment status. Card details are held by our payment processor, not by us	You; our payment processor

We do not ask for, and you should not provide, special-category data about yourself (such as health, religion or political opinions).

3. Why we use Account Data and on what legal basis

Purpose	Legal basis (GDPR Article 6)
Creating and administering your account, authenticating you, providing the Service you asked for	Performance of a contract (Art. 6(1)(b))
Sending service messages: invitations, password resets, security alerts, notices about changes to the Service or the terms	Performance of a contract; legal obligation (Art. 6(1)(c)) for some notices
Keeping the audit log of who did what in your tenant	Performance of a contract; our legitimate interest (Art. 6(1)(f)) in security and accountability, which your organisation shares
Operating the AI assistant and improving its answers for your account	Performance of a contract
Securing the Service: detecting abuse, fraud, unauthorised access and outages	Legitimate interest in protecting the Service and its users
Support, troubleshooting and responding to your requests	Performance of a contract; legitimate interest
Understanding how the Service is used so we can improve it	Legitimate interest in improving our product. We use aggregated or pseudonymised data for this wherever possible
Billing, accounting, tax and other legal obligations	Legal obligation; performance of a contract
Sending product updates and the changelog to people who subscribed	Consent (Art. 6(1)(a)); you can unsubscribe at any time
Establishing, exercising or defending legal claims	Legitimate interest

We do not use Account Data or Customer Content to train machine-learning models that serve other customers. Learning features inside the Service (such as memory and examples) use your data only to improve results for your own organisation.

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

4. Cookies and similar technologies

The Service uses a session cookie to keep you signed in and a small number of strictly necessary cookies and local-storage entries to remember your preferences (for example, the language and the layout of a table). These are essential to the Service and do not require consent.

We do not use advertising cookies, and we do not use third-party analytics or tracking, either in the Service or on our website. Some pages of our website embed videos hosted by YouTube in its privacy-enhanced mode; YouTube loads, and may set its own cookies, only if you play a video.

5. How long we keep Account Data

Data	Retention
Account, identity and configuration data	For as long as your account exists. Your organisation can have its account deleted at any time by asking support@docaifabric.com; we then delete this data promptly, except as noted below
Accounts whose license ended	We may delete an account once its trial or paid license has ended and has not been renewed for a period published on the Data Handling page. While the license is in effect we do not delete the account, however little it is used. The account's administrators receive warning emails before deletion
Audit log (the record of actions in your organisation's account)	Up to 400 days by default, or until your organisation's account is deleted, whichever is earlier
Security and operational logs of the platform	Up to 400 days
AI assistant conversations	Kept while your account exists so you can return to them, subject to the retention period your organisation configures in the Service; deleted with the account
Support correspondence (email) and feedback	24 months after the request is closed
Billing and tax records (paid plans)	As required by Cyprus law, currently 6 years after the end of the financial year
Recovery copies	Deleted data may persist in the storage platform's soft-delete and versioning copies, kept for disaster recovery only, until they are overwritten in the ordinary course, for no longer than 90 days (the Recovery Window described on the Data Handling page)
Changelog subscription	Until you unsubscribe

Retention of Customer Content is set by your organisation in the Service: processed documents are deleted when the retention period set for each project expires (a default applies that your organisation can change or turn off), when a User deletes them, or when the account is deleted. The Data Processing Agreement governs the rest.

6. Who we share personal data with

We do not sell personal data, and we do not share it for advertising.

Sub-processors. We use a small number of service providers to run the Service. They act on our instructions under written contracts, and the current list, with the purpose and region of each, is published at Sub-processors. In summary: Microsoft Azure for hosting, storage and the AI models (Azure OpenAI, and Anthropic Claude through Azure AI Foundry); Resend for transactional email; Tally for the in-app feedback form. Customer data sent to the AI models is processed by Microsoft under our Azure agreement and is not sent to OpenAI or Anthropic directly.

Your organisation. Administrators of your tenant can see your name, email, role, and your activity in the audit log.

Professional advisers and authorities. Lawyers, accountants, auditors and insurers under confidentiality; and public authorities where the law requires it, after we have checked the request is valid. We will tell your organisation about such a request unless we are legally prevented from doing so.

Business transfers. If we sell or reorganise our business, personal data may be transferred to the acquirer under this Policy.

7. International transfers

We are established in Cyprus, in the European Union. The Service runs in the Region your organisation selects from those listed on the Data Handling page (currently the United States and Australia; the European Union when offered). Your Account Data and Customer Content are stored in that Region, and OCR runs there. The AI models process your content on Microsoft's Global deployments, so prompts and responses may be processed in any Azure region where the model is hosted, including outside that Region, unless your organisation's Order Form restricts the location. Our staff in the European Union access it for support and operations.

Some of our sub-processors are in, or have support staff in, countries outside the European Economic Area, including the United States and Australia. Where we transfer personal data outside the EEA we rely on:

• an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for providers certified under it), or
• the European Commission's Standard Contractual Clauses, with a transfer impact assessment and supplementary measures where needed.

You can ask privacy@docaifabric.com for a copy of the safeguards we use.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data in certain circumstances;
• restrict processing in certain circumstances;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• portability: receive the data you gave us in a structured, machine-readable format;
• withdraw consent where processing is based on consent, without affecting processing before withdrawal;
• complain to a supervisory authority. Ours is the Office of the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy). You may also complain to the authority in the country where you live or work.

To exercise a right, email privacy@docaifabric.com or use the account settings in the Service. We respond within one month, extendable by two months for complex requests. We may need to verify your identity first. If your request concerns Customer Content, we will refer it to your organisation as the controller.

Some rights are limited where we must keep data to meet a legal obligation or to establish, exercise or defend legal claims.

9. Additional information for residents of California and other US states

This section applies to personal data of residents of California and of other US states with comprehensive privacy laws.

• We do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months.
• The categories of personal information we collect, the sources, the purposes and the recipients are described in sections 2, 3 and 6 above. In CCPA terms, we collect identifiers, commercial information, internet or network activity, professional information, and (in support conversations) any information you choose to give us.
• You have the right to know what personal information we collect and how we use it, to access and to delete it, to correct inaccurate information, and not to be discriminated against for exercising these rights. Exercise them by emailing privacy@docaifabric.com. You may use an authorised agent; we will ask the agent for proof of authorisation and may verify your identity directly.
• With respect to Customer Content, we act as a "service provider" (CCPA) or "processor" (other state laws) to our customer, and our Data Processing Agreement contains the required terms.
• We do not knowingly collect personal information of anyone under 16.

10. Additional information for Australia

This section applies where the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to our handling of your personal information.

• The kinds of personal information we collect, and why, are described in sections 2 and 3. We collect it directly from you or from your organisation's administrators. If you do not provide it, we may not be able to give you access to the Service.
• We are likely to disclose personal information to overseas recipients: our email provider in the United States (email addresses and message text only) and, for support and engineering, our staff in the European Union. Customer Content of organisations that select the Australia Region is stored in Australia, and OCR runs there. AI model inference runs on Microsoft's Global deployments, so it may be processed in other countries, including the United States and countries in Europe and Asia, unless the organisation's Order Form restricts the location. Microsoft is the recipient; it is bound by the Microsoft Products and Services Data Protection Addendum.
• You may request access to, or correction of, the personal information we hold about you by emailing privacy@docaifabric.com. We will respond within 30 days. If we refuse, we will tell you why and how to complain.
• If you believe we have breached the APPs, complain to privacy@docaifabric.com first. We will acknowledge within 7 days and aim to resolve the complaint within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
• We comply with the Notifiable Data Breaches scheme. Where a data breach involving Customer Content occurs, we notify the customer organisation, which is responsible for any notification to individuals and to the OAIC.

11. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, tenant isolation, role-based access control, multi-factor authentication for our staff, logging and monitoring, and regular security testing. Details are on our Trust Center. No system is perfectly secure; if we learn of a breach affecting your personal data, we will notify you and any relevant authority as the law requires.

Keep your password and API keys confidential. Tell security@docaifabric.com immediately if you suspect unauthorised access to your account.

12. Children

The Service is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact privacy@docaifabric.com and we will delete it.

13. Changes to this Policy

We may update this Policy. The current version is always at docaifabric.com/docs/legal/privacy with its effective date and version, and previous versions are archived there. For material changes we will notify tenant administrators by email at least 30 days before the change takes effect.

14. Contact

AI Fabric Limited, trading as DocAI Fabric Leonidou 6, Flat/Office 102, Latsia, 2236, Nicosia, Cyprus Privacy: privacy@docaifabric.com · Legal: legal@docaifabric.com · Security: security@docaifabric.com

We have not appointed a Data Protection Officer: Article 37 of the GDPR does not require one of us, since we are not a public authority, do not monitor individuals on a large scale, and special categories of personal data are not a core activity. Privacy questions and requests go to privacy@docaifabric.com and are handled by the people responsible for data protection at AI Fabric.

Change history

Version	Effective	Changes
1.2	8 October 2026	Sections 7 and 10: stored content and OCR stay in the Region; AI model inference runs on Global deployments and may be processed outside the Region (previously: in the Region). Archived copy
1.1	3 October 2026	Section 5: an account is deleted for retention only after its license ended and was not renewed (previously: after a period without use); an account is deleted on request to support
1.0	21 September 2026	First version. Archived copy