Privacy
A short guide to how personal data is handled and which document governs what. The binding texts are the Privacy Policy and the Data Processing Agreement; this page only points at them.
Last updated: 2026-10-08.
Two roles
Your documents: we are the processor. The documents you upload, and the data extracted from them, contain personal data about other people (the names, addresses and bank details on an invoice, for example). Your organisation decides what to upload and why, so it is the controller, and we process that data only on its instructions, under our Data Processing Agreement.
Your account: we are the controller. For data about you as a user (name, work email, sign-in activity, support requests), we decide how it is used, and our Privacy Policy applies.
The documents
| Document | Governs | Where |
|---|---|---|
| Data Processing Agreement (DPA) | Everything we do with the personal data in your documents: instructions, security, sub-processors, breach notification, deletion, audits, international transfers, and the region-specific terms for the EU and UK (Standard Contractual Clauses), Australia (APP 8) and US state laws (CCPA service-provider terms) | Incorporated into the Terms of Service and the Master Services Agreement, so it applies automatically. Published at /docs/legal/dpa. Enterprise customers can countersign the same text |
| Privacy Policy | Account data: what we collect, why, how long we keep it, your rights | Published at /docs/legal/privacy |
| Sub-processors | Who else touches your data, where, and how we notify changes | This site |
| Data Handling | Where data is stored and processed per Region, retention, deletion, export | This site |
Where your data is
You choose a Region when you sign up (United States, Australia; European Union planned). Your documents, results, configuration and backups stay in that Region, and so does OCR. AI inference runs on Microsoft's Global model deployments by default, so prompts and responses may be processed in other countries; Enterprise customers can restrict the location on their Order Form, as explained on Data Handling. We are a company established in Cyprus, in the European Union, and our staff support every Region from the EU.
Frameworks we align to
- EU GDPR and Cyprus Law 125(I)/2018 (our home jurisdiction), including Article 28 processor terms and Chapter V transfer safeguards (EU-US Data Privacy Framework for certified providers, Standard Contractual Clauses).
- UK GDPR, with the UK International Data Transfer Addendum.
- Australian Privacy Act 1988 and the Australian Privacy Principles, including APP 8 for overseas disclosure and the Notifiable Data Breaches scheme.
- US state privacy laws, including the CCPA/CPRA, under which we act as a service provider.
Data subject requests
If personal data about you appears in documents that one of our customers processed, contact that customer: they are the controller and we act on their instructions. If your request concerns your own account with us, write to privacy@docaifabric.com; we respond within one month.
No training on your data
We do not use customer documents or extracted data to train or improve models that serve anyone else. Learning features in the product work inside your own account only.
Contact
privacy@docaifabric.com. We have not appointed a Data Protection Officer; this address reaches the people responsible for data protection.