DOCUSSENTIALS PRIVACY POLICY

1. Scope

This Privacy Policy applies to information processed in connection with the Service, including account registration, document upload and analysis, saved project intelligence, billing, support, and related product operations. The Service is offered to users in the United States. Section 12 addresses access from outside the United States.

2. Information We Collect

Account information. Your email address and authentication information, managed through our authentication provider, Supabase; your name or display name if you provide one; profile and plan information associated with your account; and the status of any account deletion request you make.

Your documents and extracted text. When you upload a PDF, DOCX, or TXT file, the application extracts the text of the document to perform the analysis you request. The original uploaded file is not retained by the application after processing, and the raw extracted text is not stored as a saved field in our database. We do retain document metadata, such as the original filename, file type, file size, timestamps, and the project the document belongs to. Section 3 explains this distinction in more detail, and it matters, so please read it.

Saved project intelligence. Analyses and generated project intelligence outputs you save are stored in your workspace. Saved records can include structured analysis results, summary text, analysis type and status, AI model metadata, timestamps, and the relationship to the associated project or document. Certain in-session outputs (such as executive brief content generated for viewing in the moment) are designed for in-session display and are not saved as analysis history.

Usage information. Records of product activity, such as the number of analyses and generations you run, used to enforce plan allowances, operate the Service, and understand product usage. This is first-party operational data collected by our own application; as described in Section 6, we do not use third-party analytics tools.

Billing information. Paid subscriptions are processed by Stripe. We receive and keep subscription state and billing references (which plan you have, its status and billing period, and identifiers Stripe uses to manage your subscription). We do not receive or store your full payment card details; card processing is handled by Stripe.

Technical and infrastructure information. Standard technical request information (such as IP addresses, browser and device information, and request logs) may be processed by the infrastructure providers that host and secure the Service in the ordinary course of operating it, and may appear in provider-managed logs, diagnostics, and backups.

Support communications. If you contact support, we collect the messages and information you send.

3. Your Documents: What We Keep and What We Do Not

This distinction is central to how the Service works, so we state it plainly.

What we do not keep: your original uploaded files. The application processes your uploaded file to extract its text, performs the analysis you request, and does not retain the original file afterward. The application does not maintain a stored library of your uploaded documents. If you need the original document, keep your own copy; the Service is not a document storage or backup service.

What we do keep: the intelligence generated from your files. The analyses, summaries, and project intelligence outputs you save are retained in your workspace so you can return to them. They remain in your account until they are deleted through a deletion request or through account deletion, as described in Section 8. Note that deleting a project does not itself delete the saved analyses and metadata generated from it; those records remain in your account as unassigned records until separately deleted, as described in Section 9.

A note on temporary processing. “Not retained” refers to intentional application storage. During processing, your file and its extracted text necessarily pass through your browser, our application’s request handling, and the infrastructure of the service providers that operate the Service, and may exist transiently in provider-managed logs, temporary storage, or backups maintained by those providers. We do not use those transient copies for any purpose other than operating the Service.

4. How We Use Information

We use the information described above to: provide, operate, maintain, secure, and improve the Service; create and authenticate accounts and provide account recovery; process your documents and generate the analyses and outputs you request; store the project intelligence you save; manage subscriptions, billing, plan access, and usage allowances; respond to support, billing, privacy, and security inquiries; detect, investigate, and prevent fraud, abuse, security incidents, and misuse of the Service; comply with legal obligations; and establish, exercise, or defend legal claims.

We do not use your information for third-party advertising, and we do not use your uploaded content or saved project intelligence to train artificial intelligence models for purposes unrelated to providing the Service to you.

5. AI Processing Disclosure

The Service uses OpenAI as its AI service provider. When you request an analysis or generation, the application sends the text extracted from your document, together with related instructions and structured context needed to perform the request, to OpenAI for processing. Original uploaded files themselves are not sent; the extracted text is. Certain requests may also include relevant saved project intelligence from your workspace where the feature you are using calls for it.

We use OpenAI as a service provider to process your content solely to provide the Service. We do not grant OpenAI, and do not intend to grant any provider, a license to use your content for purposes unrelated to providing the Service to you. Under OpenAI’s terms for API business customers, content submitted through the OpenAI API is not used to train or improve OpenAI’s models by default, and we do not opt in to any OpenAI data-sharing or model-training program. If our AI service provider or its training-use posture changes, we will update this Policy as described in Section 14.

6. How We Share Information; Our Service Providers

We share information with service providers that perform functions on our behalf, only as reasonably necessary for those functions. Our current service providers are:

We may also disclose information: when required by law, subpoena, or other legal process; to protect the rights, safety, and security of Docussentials, our users, or others; in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case this Privacy Policy will continue to apply to your information until you are notified otherwise; or at your direction or with your consent.

We do not sell your personal information, and we have not sold it. We do not share your personal information for cross-context behavioral or targeted advertising. We do not use third-party analytics or advertising tools in the Service. The usage information described in Section 2 is first-party operational data collected by our own application, not third-party analytics.

7. Customer Content and Ownership

You retain ownership of the content you upload to the Service. You grant VHI Holdings LLC only the limited rights reasonably necessary to host, process, transmit to the authorized service providers listed above, analyze, secure, support, and operate the Service, as described in the Terms of Service. We do not take a broad license to reuse your content for unrelated purposes or for unrelated model training. You are responsible for ensuring you have the rights and authority necessary to upload and process the content you provide.

8. Retention

We retain information for as long as reasonably necessary to operate the Service, honor your choices, and meet our legal obligations. Specifically:

Original uploaded files and extracted text are not retained by the application after processing, as described in Section 3, apart from transient processing in provider infrastructure.

Saved analyses, generated project intelligence, projects, and document metadata are retained in your account until deleted through a deletion request or account deletion.

Account, subscription, and usage records are retained while your account is active and thereafter as needed for the purposes described below.

After account deletion, we delete or de-identify information that is no longer reasonably necessary, and we may retain limited information where reasonably necessary for billing and tax records, security, fraud prevention, dispute resolution, enforcement of our agreements, compliance with legal obligations, and residual copies in backups maintained by our service providers until those backups expire in the ordinary course.

9. Project Deletion and Account Deletion

9.1 Project deletion. Deleting a project deletes the project record and removes the project association from related saved analyses and document metadata. Those related records are not automatically deleted when the project is deleted; they remain in your account as unassigned records. If you want specific saved analyses or records deleted, you may request that through support as described below.

9.2 Account deletion. Account deletion is handled through a support-managed process rather than an instant automated purge. To request deletion of your account, contact support@docussentials.com from the email address associated with your account. We may take reasonable steps to verify your identity before acting on the request. We will complete support-managed deletion within forty-five (45) days following your verified request, and we will confirm to you when it is complete. As described in Section 8, limited categories of information may be retained after deletion for billing, tax, security, fraud prevention, dispute, legal, and backup purposes.

10. Security

We use administrative, technical, and organizational measures designed to protect information, appropriate to the nature of the Service, including reliance on established infrastructure providers for authentication, hosting, and payment processing. No security measure or method of transmission is completely secure, and we cannot guarantee absolute security.

11. Your Privacy Rights

All users. Regardless of where you live, you may request access to, correction of, or deletion of your personal information by contacting support@docussentials.com from the email address associated with your account. We will respond to a request within forty-five (45) days of receiving it; if a request is complex or we receive a high volume of requests, we may extend that period by an additional forty-five (45) days, and we will tell you if we need the extension. We may take reasonable steps to verify your identity before acting on a request. We will not discriminate against you for exercising a privacy request.

State privacy laws. A number of U.S. states have comprehensive consumer privacy laws, including the Florida Digital Bill of Rights (Fla. Stat. Section 501.701 and following), the California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code Section 1798.100 and following), the Virginia Consumer Data Protection Act (Va. Code Section 59.1-575 and following), the Colorado Privacy Act (Colo. Rev. Stat. Section 6-1-1301 and following), the Connecticut Data Privacy Act (Conn. Gen. Stat. Section 42-515 and following), and the Utah Consumer Privacy Act (Utah Code Section 13-61-101 and following), among others. These laws generally apply to businesses that exceed thresholds based on revenue or on the volume of personal data processed, and depending on our size and processing volume they may or may not apply to Docussentials at a given time. Where an applicable law grants you rights, we will honor them, and as a matter of practice we extend the core rights of access, correction, and deletion to all users as described above.

Rights these laws typically provide. Depending on the applicable law, residents of these states may have the right to know or access the personal information a business processes about them, to correct inaccurate personal information, to delete personal information, to obtain a portable copy, to opt out of the sale of personal information, of sharing or processing for targeted advertising, and of certain profiling, and to not receive discriminatory treatment for exercising these rights. As stated in Section 6, we do not sell personal information and do not process personal information for targeted advertising, so there is no sale or sharing to opt out of. For the same reason, browser-based opt-out preference signals, such as the Global Privacy Control, do not change any processing we perform, because there is no sale, sharing, or targeted-advertising processing for such a signal to stop.

How to exercise rights; appeals. Submit requests to support@docussentials.com. If we decline a request, we will explain why, and where applicable law provides an appeal right, you may appeal by replying to our decision, and we will respond to your appeal within sixty (60) days or any shorter period the applicable law requires. Authorized agent requests, where permitted by law, must include proof of authorization.

12. Children

The Service is intended for adults and requires users to be at least 18 years of age. It is not directed to children, and we do not knowingly collect personal information from children under 13 in a manner covered by the Children’s Online Privacy Protection Act (15 U.S.C. Section 6501 and following). If you believe a child has provided personal information to the Service, contact support@docussentials.com and we will delete it.

13. United States Processing; International Users

The Service is operated from the United States and is offered to users in the United States. Information is processed and stored in the United States and in other locations where our service providers operate. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those of your jurisdiction. The Service is not represented as localized or compliant for jurisdictions outside the United States.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to the address on your account, by notice within the Service, or by other reasonable means, and the updated policy will state a new effective date. Your continued use of the Service after the updated policy takes effect constitutes acceptance of it.

15. Contact Us