DocuChat
Draft — not yet legally binding. This page is a working draft with placeholder content pending qualified legal / tax review. Do not rely on it until it is finalized and dated.

Privacy Policy

Draft status: Working draft, India DPDP Act 2023-aligned, pending legal review. Effective date: upon publication.

1. Who we are

DocuChat is operated by Trouvaillesys, a sole proprietorship based in Hyderabad, Telangana, India, contact docuchat@trouvaillesys.com. We act as the data fiduciary for personal data described here.

2. Scope

This policy covers the DocuChat authenticated app, this marketing site, support, billing, and chatbot/document processing.

3. Personal data we process

  • Account: name, email, phone (if collected), organization, role.
  • Authentication & security: authentication identifiers, login metadata, IP/device/browser information, audit logs.
  • Billing: Razorpay order/payment IDs, amounts and status, invoice or receipt details, billing address, and a GSTIN if you provide one for a business invoice.
  • Product content: uploaded documents, chatbot configurations, prompts/messages, analytics and usage logs.
  • Support & communications: tickets, emails, consent records.
  • Cookies / local storage: as described in the Cookie Policy.

4. Purposes and legal basis

We process personal data to: create and authenticate accounts; deliver the SaaS (document indexing, chatbot answers, analytics); handle billing, invoices, tax, fraud prevention, and reconciliation; provide security, abuse prevention, audit logging, and CAPTCHA; deliver support and service communications; and, only with separate consent, send marketing. [Counsel to map each purpose to DPDP consent or legitimate-use basis.]

5. Notice and consent

We provide notice at or before collection and obtain affirmative consent where required. Non-essential cookies and marketing require separate, optional consent. You may withdraw consent at any time; we will explain any consequences. Consent records are maintained first-party by DocuChat, with a version and timestamp, so we can honor and, if our policy changes, refresh your choice.

6. Your rights as a data principal

Subject to law, you may request access to a summary of processing, correction or updating of your data, and erasure/deletion (subject to retention and legal obligations). You may raise grievances with our Grievance Officer and escalate to the Data Protection Board where legally available.

7. Grievance Officer

You can reach our Grievance Officer via the Grievance Officer page.

8. Retention and deletion

  • Active accounts: data is retained while you use the service.
  • Deactivated accounts: a 30-day retention window applies before hard deletion.
  • You can reactivate within the 30 days by buying credits, with data intact.
  • Billing, tax, and invoice records are retained for the period required by Indian law (up to 8 years) [CA to confirm exact period].
  • Sign-in and security logs are retained for a limited period for investigations (in the region of 90 days) [founder to confirm].
  • Backups and logs are rotated on a rolling basis [founder to confirm exact timing].

9. Processors and sub-processors

  • AWS (hosting/infrastructure) in the eu-central-1 / EU region.
  • AWS Cognito/Amplify, S3, Lambda, DynamoDB/MongoDB, and Bedrock as applicable.
  • Razorpay for payment processing.
  • Email: Amazon SES (verification, receipts, and service emails).
  • Analytics: Google Analytics (via Google Tag Manager), loaded only with your consent and only where a container is configured; off by default.
  • LLM providers: OpenAI, Google (Gemini), and Anthropic Claude via AWS Bedrock, used to generate chatbot answers. [Founder/counsel to confirm each provider's data-handling region before launch.]

10. Cross-border transfers

Product data for India-based users is hosted and processed in AWS eu-central-1 / EU. Some processors or support access may occur in other regions. [Counsel to describe DPDP cross-border restriction monitoring.]

11. Children's data

DocuChat is not intended for users under 18 unless a counsel-approved verified parental-consent flow applies. We do not knowingly perform targeted advertising or behavioral monitoring of children. To report or remove a child's data, contact us.

12. Security safeguards

We use encryption in transit and at rest, access controls and least privilege, audit logging, backups, incident response, and vulnerability management. [Counsel to confirm breach-notification process.]

13. Updates to this policy

We will post updates here and notify users where appropriate.

14. Contact

Privacy questions: docuchat@trouvaillesys.com. Full business details are on our Contact & Imprint page.

Last updated: Effective upon publication