Your documents, your data, your control.

[REPLACE: Your legal entity or full name], registered at [REPLACE: address, city, country], is the data controller for personal data processed through DocClarity. Contact: privacy@docclarity.app.

• In transit: all traffic between your browser, our backend, and our sub-processors is encrypted with TLS 1.2+ (HTTPS).
• At rest: our database (Supabase / Postgres) and managed storage volumes are encrypted at rest with AES-256 by the cloud provider.
• Access control: every table is protected by row-level security — even with database access, one user cannot read another user's rows. Card data is never seen by us; it stays inside Paddle.
• Secrets: API keys and service credentials are stored in an encrypted secret store, never in source code or shipped to the browser.

Your document text and chat messages are sent to a large language model through the Lovable AI Gateway, which routes to providers such as Google (Gemini) and OpenAI. We rely on the gateway's data-processing terms, under which customer prompts and outputs are not used to train public foundation models. Providers typically retain prompts for a short abuse-detection window (usually up to 30 days) and then delete them.

Avoid pasting documents containing data you absolutely cannot share with a US-based AI processor. If you require an EU-only AI processor or zero-retention contract, contact us at privacy@docclarity.app.

• Performance of a contract — to provide the analysis you requested, manage your account, and handle your subscription.
• Legitimate interests — to keep the Service secure, prevent abuse, debug errors, and improve the product (without profiling you).
• Legal obligation — to keep invoices and respond to lawful requests.
• Consent — for any non-essential cookies and for optional marketing emails (you can withdraw at any time).

When you analyze a document, the file is uploaded over HTTPS to our backend, parsed in memory, and sent to our AI provider to produce the summary, red flags, and deadlines. The raw file is not persisted to disk.

• Guests (not signed in): nothing is stored on our servers. The analysis lives only in your browser (local storage) and disappears when you clear it.
• Signed-in users: we store the analysis result (summary, flags, deadlines, chat history) so you can return to it from any device. The original document itself is never written to disk.
• Stored data lives in our EU-hosted Postgres database with row-level security — only you can read your own rows.

• Lovable Cloud (Supabase) — database, auth, hosting (EU region).
• Lovable AI Gateway — routes prompts to the underlying LLM provider to generate the analysis and chat answers.
• Paddle — payment processing for Pro subscriptions. Card details are entered directly in Paddle's checkout; we never see them.

We keep this short. DocClarity uses two kinds of browser storage:

• Strictly necessary — your auth session, your selected currency, and your cookie-consent choice. Without these the app cannot function.
• Guest analysis cache — when you use the app without signing in, your analysis is stored in your browser's local storage so you can come back to it. It never leaves your device.

We do not use advertising cookies, third-party trackers, or analytics that profile you. You can clear all of it at any time from your browser settings.

• Access & portability — your saved analyses are visible from the sidebar; export by copy/paste, or request a JSON dump from privacy@docclarity.app.
• Rectification — edit your profile from the account menu, or email us for anything you cannot change yourself.
• Erasure ("right to be forgotten") — see the next section. One click and everything is gone from our servers.
• Objection / restriction — write to us and we will stop processing while we work things out.
• Lodge a complaint — you can contact your local data protection authority if you believe we mishandled your data.