> Information about data processing, external AI providers, security measures and open questions about locations and retention. Source: [https://docxpert.io/en/privacy](https://docxpert.io/en/privacy) # Privacy Policy Last updated: Privacy information Review the processing details and assess your applicable requirements Encryption Transport and storage protection; not a guarantee against all risks Provider information Request current locations and subprocessors for your deployment Full Transparency Access to your data at any time ## 1\. Data Controller The data controller for data processing on this website is: docxpert.io Linn 15 5225 Bözberg Switzerland Email: contact \[@\] docxpert.io ## 2\. Collection and Processing of Personal Data ### 2.1 Types of Data Processed We process the following categories of personal data: - Account data (name, email address, company name) - Contact data (email address, phone number) - Usage data (access times, visited pages, IP address) - Content data (uploaded documents, text input) - Contract data (pricing plan, payment information) - Technical data (browser, device type, operating system) ### 2.2 Purposes of Data Processing Your data is processed for the following purposes: - Provision and operation of the Platform - Creation and management of user accounts - Execution of contracts and billing - Customer service and support - Improvement and further development of the Platform - Ensuring IT security - Fulfillment of legal retention obligations ## 3\. Legal Basis for Processing The processing of your personal data is based on the following legal grounds: - Contract fulfillment (Art. 6 para. 1 lit. b GDPR): Processing to fulfill the usage contract - Consent (Art. 6 para. 1 lit. a GDPR): When you have expressly given us your consent - Legitimate interests (Art. 6 para. 1 lit. f GDPR): Ensuring IT security, improving our service - Legal obligation (Art. 6 para. 1 lit. c GDPR): Fulfillment of legal retention and reporting obligations ## 4\. Disclosure of Data to Third Parties ### 4.1 Hosting and Infrastructure Infrastructure and data locations depend on the deployed services. A single Swiss or EU location, certification or universal residency guarantee cannot be established from this public description; request current hosting and subprocessor details before procurement. ### 4.2 AI Services (OpenAI) AI chat/completions use OpenAI models through a Replit AI Integrations proxy; embeddings for semantic search use a separate direct OpenAI API connection when configured. Document chunks and vectors are indexed in Qdrant for retrieval. The following data may be processed: - Document content or selected excerpts for analysis and embedding; retrieved excerpts may be sent as context for chat - User prompts and selected context for chat and assistance These are distinct processing paths. This page does not establish the proxy's or providers' processing region, subprocessor list, training exclusion, zero retention or certification. Obtain current provider agreements, settings and retention schedules for your use case. ### 4.3 Payment Service Providers For payment processing, we work with certified payment service providers that are PCI-DSS compliant. We do not store credit card data on our servers. ### 4.4 Blockchain Services (optional) When using the optional blockchain audit function, hash values of audit events are transmitted to the Minima.global blockchain. No personal data is written to the blockchain. ## 5\. Data Security We employ technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons: - SSL/TLS encryption for all data transmissions - Encrypted data storage (Encryption at Rest) - Regular security updates and penetration tests - Access control and authentication (multi-factor authentication) - Tenant separation at database and storage level - Regular backups with geographic redundancy - Logging and monitoring of security-relevant events ## 6\. Storage Duration We only store personal data for as long as necessary for the respective purposes or as long as legal retention periods exist: - User data: For the duration of the contractual relationship plus 30 days after contract termination - Contract data: 10 years in accordance with commercial and tax retention requirements - Audit logs: 7 years to fulfill compliance requirements - Marketing data: Until revocation of consent ## 7\. Your Rights as a Data Subject You have the following rights regarding your personal data: - Right of access (Art. 15 GDPR): You can request information about your data stored with us - Right to rectification (Art. 16 GDPR): You can request the correction of incorrect data - Right to erasure (Art. 17 GDPR): You can request the deletion of your data - Right to restriction of processing (Art. 18 GDPR): You can request the restriction of processing - Right to data portability (Art. 20 GDPR): You can receive your data in a structured format - Right to object (Art. 21 GDPR): You can object to the processing of your data - Right to withdraw consent (Art. 7 para. 3 GDPR): You can revoke given consents at any time To exercise your rights, please contact: contact \[@\] docxpert.io You also have the right to lodge a complaint with a data protection supervisory authority. ## 8\. Cookies and Tracking The platform uses technically necessary cookies. Optional Google Analytics measurement requires your consent: - Session cookies for authentication - Cookies for language selection - Cookies for security features (CSRF protection) We optionally use Google Analytics 4 to measure public pages and selected app usage. Without consent, the Google tag is not loaded. Google processes pseudonymous technical identifiers and may process data outside Switzerland and the EEA, including in the USA. We do not transmit names, email addresses, document contents or internal user, tenant and document IDs; page paths are sanitized and query parameters and referrer URLs are not transmitted. Your choice is stored locally for up to 180 days and can be changed through Privacy settings at any time. Withdrawal stops further measurement but does not automatically delete previously collected data. Internal operational analytics remain separate. ## 9\. International Data Transfers External AI processing may involve international transfers. Locations and applicable transfer safeguards must be confirmed against current provider and contractual documentation; no single region or universal transfer mechanism is guaranteed here. Potential safeguards to assess include: - Adequacy decision of the EU Commission (EU-US Data Privacy Framework) - Standard contractual clauses according to Art. 46 GDPR - Additional technical and organizational measures ## 10\. Changes to this Privacy Policy We reserve the right to adapt this privacy policy as necessary to adjust it to changed legal situations or changes to our services. The version available at the time of your visit applies. ## Privacy Contact If you have questions about data protection, please contact us at: docxpert.io Data Protection Linn 15 5225 Bözberg Switzerland Email: contact \[@\] docxpert.io