Privacy Policy

1. Who we are

DocAddin (the “Service”) is an AI assistant for Microsoft Word, Excel, and PowerPoint, distributed as an Office Add-in and accessed via docaddin.com.

Data Controller (GDPR) / Business (CCPA):

• D. Danila Pryadko, operating as a Spanish autónomo (sole proprietor)
• NIF / NIE: Z1106449Q
• Domicilio fiscal: C. de Alicante, 4, 28045 Madrid, España
• Email: support@docaddin.com

The Service is provided from Spain. Spanish law applies (see Terms §13 for governing law of disputes; EU consumers retain the courts of their place of residence).

2. What we collect

• Account data: email address you provide at sign-up; hashed password.
• User Content: text prompts, document fragments, spreadsheet ranges, and slide content you submit to the AI through our add-in. Stored only briefly (see Retention §6).
• Technical data: IP address, browser / Office host version, locale, basic usage events (which features triggered, latency, error counts). Used for product analytics and abuse detection.
• Payment data: processed by our payment provider (Lemon Squeezy). We receive only transaction status, plan, and the last 4 digits of the card — never full card numbers or CVV.
• Communication: any email you send to support@docaddin.com and our reply.

3. How we use it & lawful basis (GDPR Art. 6)

• To deliver the Service (generate AI responses for your Office documents) — contractual necessity.
• To manage your account & subscription — contractual necessity.
• To improve the product through aggregated, anonymised analytics — legitimate interest; you can opt out via cookie banner.
• To detect abuse / security incidents — legitimate interest.
• To send transactional emails (verification, password reset, receipts) — contractual necessity.
• To send marketing emails — only with your explicit consent; one-click unsubscribe.

4. AI processing and sub-processors

DocAddin is a thin SaaS layer on top of third-party large language models. We do not train our own LLMs. To generate a response, your Prompt and the relevant Document Context are transmitted securely (TLS) to one of:

• Google LLC / Google Cloud Vertex AI — Gemini family models.
• OpenAI, L.L.C. — GPT family models.
• Anthropic, PBC — Claude family models.

Under each provider’s enterprise / API terms, your prompts and outputs are not used to train their publicly available models.

Additional sub-processors:

• Resend, Inc. (transactional email delivery via Amazon SES, EU-West-1 region).
• Lemon Squeezy (payments, merchant of record for VAT / sales tax).
• Hawk.so (error monitoring; we strip user content from stack traces).
• PostHog (product analytics, EU region).

5. International transfers (GDPR Chapter V)

Several of the sub-processors listed above are based in the United States. Where an EU/UK-to-US transfer occurs, we rely on the EU–US Data Privacy Framework (where the recipient is certified) or on the European Commission’s Standard Contractual Clauses (SCCs). We have completed transfer impact assessments for each provider.

6. Retention

• Account data: kept for as long as your account exists, plus 30 days after deletion request to handle billing reversals.
• User Content sent to LLMs: stored ephemerally (current session + up to 30 days for chat history). Deleted on request or on account closure.
• Logs: 90 days, then aggregated.
• Backups: rotating 14-day window.

7. Your rights under GDPR

If you are in the EU, UK, or EEA, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict processing.
• Port your data in a machine-readable format (JSON export).
• Object to processing based on legitimate interest.
• Not be subject to a decision based solely on automated processing with legal effect.
• Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
• Lodge a complaint with your local supervisory authority. A list is available at the European Data Protection Board.

To exercise any of these rights, email support@docaddin.com. We respond within 30 days.

8. Your rights under CCPA / CPRA (California residents)

• Right to know what personal information we collect, use, and disclose.
• Right to delete personal information we hold.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell your personal information. We only share it with the sub-processors named above for the strict purpose of providing the Service.
• Right to non-discrimination for exercising these rights.

To submit a request, email support@docaddin.com. We may verify your identity using your registered email.

9. Cookies and tracking

We set a small number of cookies for: session authentication, language preference, and (with your explicit consent) anonymous product analytics. You can decline analytics in the cookie banner; the Service still works fully. We do not use cross-site advertising trackers.

10. Children’s privacy

The Service is not directed to anyone under the age of 16. We do not knowingly collect personal information from children. If you believe a child has registered, contact us and we will delete the account.

11. Security

All traffic is encrypted in transit (TLS 1.2+). Passwords are hashed with bcrypt. Access to production systems is restricted to authorised operators using SSH keys and 2FA. We will notify affected users without undue delay (and within 72 hours where required by GDPR Art. 33) of any breach involving their data.

12. Changes to this policy

We may update this policy. Material changes will be announced by email and on the website at least 14 days before they take effect. The “Last Updated” date at the top reflects the most recent version.

13. DocAddin Chrome Extension — data we access

When you install the DocAddin Chrome extension and grant access via Google sign-in, the extension requests three sensitive Google Workspace scopes. We access this data only while you are using the extension, and only in response to a prompt you submit:

We do not:

• Access files or sheets you have not opened with the extension.
• Train AI models on your content.
• Sell or share your document content with anyone other than the AI provider you selected (Google Vertex AI / OpenAI / Anthropic).
• Read your Drive contents in the background.

You can revoke access at any time at myaccount.google.com/permissions. After revocation the extension can no longer read or modify your Docs and Sheets.

14. Contact

Privacy enquiries: support@docaddin.com.