Try free Sign in Contact sales

Privacy

This describes what docstoc's software actually does with your data today. It hasn't been reviewed by a lawyer — treat it as an accurate technical description, not a legal guarantee.

What we collect

Free use without an account stores nothing on our servers about your invoices — drafts are generated in the request and not retained. If you sign in, we store your email address to manage your account and billing status.

If you request the free templates PDF pack, we store the email you submit so we can send the download link and related product tips. You can unsubscribe from those emails anytime via the link in the message. Individual template pages on the site stay available without an email.

Invoice content

Client names, amounts, and due dates you submit to generate a draft are sent to our AI provider (Cloudflare Workers AI) for that request only. We don't keep a history of your invoices or draft emails on our side.

Google Workspace connectors (optional)

If you connect Google on Connectors, we store encrypted OAuth tokens and your connected Google account email so the integration keeps working until you disconnect. We use Google APIs only for user-initiated actions: import a PDF you select from Drive, read an inbox snippet for reply context, save a draft to Gmail (never send), import/export Sheets you choose, add a calendar reminder, or import contact names and emails. We do not sell Google user data, use it for advertising, or sync your mailbox or Drive in the background. Disconnect anytime on Connectors — we delete stored tokens for that provider.

How we protect sensitive data

All traffic uses HTTPS (TLS). OAuth tokens for Google and other connectors are encrypted at rest (AES-GCM with a server secret) before storage in our database. We do not store full Gmail message bodies — only metadata and short snippets when you explicitly request reply context. Invoice PDFs from Drive are processed in memory to extract fields; we do not keep the PDF file on our servers after import. Access to production data is limited to operational necessity; we do not log OAuth tokens or connector secrets in application logs.

AI and Google user data

docstoc uses Cloudflare Workers AI (Meta Llama 3.1 8B instruct, hosted on Cloudflare's infrastructure) to draft invoice follow-up text. We do not use OpenAI, Anthropic, Google Gemini, or other third-party chat APIs for Google connector data. When you use Smart reply from Gmail, a short inbox snippet you request may be sent to Workers AI for that single request to classify the reply and draft a response — it is not stored in our database and is not used to train models. Parsed invoice fields from Drive PDFs are extracted locally without AI; only fields you submit for drafting may reach Workers AI. Cloudflare's AI terms prohibit using customer content to train generalized models; we configure Workers AI accordingly.

Google API Services User Data Policy

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models. We do not transfer Google user data to third-party AI services for model training.

Cookies & traffic analytics

A small number of strictly necessary cookies keep you signed in and remember your cookie choice — these don't need consent under ePrivacy rules and can't be declined without breaking sign-in. With your separate consent (the banner on first visit), we also use first-party page analytics and Microsoft Clarity (heatmaps and session recordings) to understand how people use docstoc. Decline, and we skip both — you can change your mind anytime by clearing the docstoc_cookie_consent value in your browser. Our host (Cloudflare) may still log standard request metadata (IP, user agent) for security and abuse prevention regardless of consent, as that's an unavoidable part of serving the request. We don't use advertising trackers or share data with ad networks.

Data controller

docstoc is a product of RELACON GmbH, Vienna, Austria — the data controller for personal data described on this page. Contact details are under "Contact" below.

Legal basis for processing

Account data (email, plan, billing status) is processed to perform the contract with you (GDPR Art. 6(1)(b)) — we can't provide an account or paid plan without it. Analytics and Clarity run only on your consent (Art. 6(1)(a)) and stop the moment you decline or withdraw it. Security-relevant request logs kept by Cloudflare rest on our legitimate interest in keeping the service running and abuse-free (Art. 6(1)(f)).

How long we keep it

Account records persist for as long as your account exists, plus a limited period afterward to satisfy billing and tax record-keeping obligations, then are deleted. Invoice details you paste to generate a draft are never written to our database in the first place — they exist only for the duration of that one request. Template-pack email addresses are kept until you unsubscribe.

Subprocessors

The services above that touch your data, and why:

International data transfers

Some subprocessors above process data outside the EU/EEA (notably the US). Where that happens, we rely on the provider's Standard Contractual Clauses or equivalent safeguards — see each provider's own privacy documentation (Cloudflare, Resend, Stripe, Microsoft) for the specifics of their transfer mechanism.

Your rights (GDPR)

If you're in the EU/EEA/UK, you can ask us to access, correct, delete, or export (portability) the personal data we hold on you, and you can object to or restrict processing, or withdraw consent for analytics at any time — none of this affects the lawfulness of processing before the withdrawal. Email founder@docstoc.io and we'll respond within a reasonable time. You also have the right to lodge a complaint with your local data protection authority — in Austria, the Datenschutzbehörde (DSB).

Product news & update emails

If you opt in under Account settings, we send occasional emails about new features and product news. This is separate from — and off by default unlike — transactional email (sign-in links, receipts, digests you've enabled): it runs on your consent (GDPR Art. 6(1)(a)), and every email includes an unsubscribe link that turns it off immediately, no sign-in required.

Children

docstoc is a business tool and isn't directed at, or knowingly used by, children under 16.

Changes to this policy

If what we collect or why changes materially, we'll update this page and, for signed-in accounts, note it in-app.

Contact

Questions about your data, or want to exercise any of the rights above? Reach out at founder@docstoc.io.