Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) can be reached through the in-app support chat.

2. Overview

Doxy is a service that lets you upload documents, organize them into projects, and query them in natural language (“chat with your documents”). To provide these features, we process personal data solely on the basis of statutory provisions (GDPR, German Federal Data Protection Act). Below we inform you about the nature, scope, and purpose of the processing.

3. Legal bases

We process personal data to perform a contract or provide the service (Art. 6 (1) (b) GDPR), on the basis of our legitimate interest in a secure and functional operation (Art. 6 (1) (f) GDPR), to comply with legal obligations (Art. 6 (1) (c) GDPR), and, where required, on the basis of your consent (Art. 6 (1) (a) GDPR).

4. Hosting

Our application is operated by the following providers acting as data processors (Art. 28 GDPR). When the pages are accessed, technically necessary data (e.g. IP address, timestamp, requested resource, browser type) is processed in server log files.

• Vercel Inc. (frontend hosting), 340 S Lemon Ave #4133, Walnut, CA 91789, USA.
• Fly.io, Inc. (backend hosting, Frankfurt region), 2261 Market Street #4990, San Francisco, CA 94114, USA.

5. Account and authentication

An account is required to use Doxy. In this context we process your email address and your (encrypted) password. Authentication, database, and file storage are provided by Supabase (Supabase, Inc., 970 Toa Payoh North #07-04, Singapore; data centers in the EU) as a data processor. The legal basis is Art. 6 (1) (b) GDPR.

6. Uploaded documents, content, and AI processing

Files you upload or web content you link, as well as the text excerpts derived from them, are stored in our database and file storage (Supabase, see above). To provide the search and chat features, the content of your documents and your questions are transmitted to OpenAI (OpenAI, L.L.C., 1960 Bryant Street, San Francisco, CA 94110, USA) in order to compute text embeddings and generate answers. According to the OpenAI API terms, data submitted via the API is not used to train the models. The legal basis is Art. 6 (1) (b) GDPR.

Please do not upload documents that you are not authorized to process, and avoid uploading special categories of personal data (Art. 9 GDPR) where possible.

7. Chat history

Your conversations (questions and generated answers) are stored and linked to your account so that you can access your history. You can delete content at any time.

8. Payment processing

For paid subscriptions we use Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Payment data is processed directly by Stripe; we do not receive full payment card details. The legal basis is Art. 6 (1) (b) GDPR. Further information: stripe.com/privacy.

9. Support chat and newsletter

We use the chat widget from Brevo (Sendinblue GmbH / Brevo, Köpenicker Str. 126, 10179 Berlin, Germany / Brevo SAS, France) to handle support requests. When you use the chat, the information you enter and technical connection data are processed. The legal basis is our legitimate interest in efficient customer support (Art. 6 (1) (f) GDPR).

If you subscribe to our newsletter, we also use Brevo to send it. When you enter your email address, we send you a confirmation email and only add you to the mailing list once you click the confirmation link (double opt-in). We store your email address, the confirmation, and the dispatch and open statistics for the newsletter. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw your consent and unsubscribe at any time via the link in every newsletter email, with effect for the future.

If you use the withdrawal function to withdraw from a contract, we process the name, email address, and contract details you submit and send you an acknowledgment of receipt by email (via Brevo). The legal basis is the performance of the contract and our legal obligation to provide this function (Art. 6 (1) (b) and (c) GDPR).

10. Cookies and session

We use technically necessary cookies to keep you signed in (authentication session cookies). These are required for operation; the legal basis is § 25 (2) TDDDG and Art. 6 (1) (f) GDPR.

For analytics we use PostHog (EU region) to understand how Doxy is used and improve it. PostHog cookies are only set after you give your consent via the cookie banner; the legal basis is § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You can decline without any restriction on using Doxy, and you may withdraw your consent at any time with effect for the future.

We also use Google Analytics (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) for reach measurement. Google Analytics is loaded with Google Consent Mode: analytics cookies and the transmission of analytics data are only enabled after you give your consent via the cookie banner. The legal basis is § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You may withdraw your consent at any time with effect for the future.

11. Transfers to third countries

Some of the services used (in particular Vercel, Fly.io, OpenAI, Google) may process personal data in the USA. Where a provider is certified under the EU-US Data Privacy Framework, the transfer takes place on the basis of an adequacy decision (Art. 45 GDPR); otherwise we base the transfer on EU standard contractual clauses (Art. 46 (2) (c) GDPR).

12. Retention period

We store personal data only for as long as necessary for the stated purposes or as required by statutory retention periods. Account, document, and chat data are deleted when you delete your account.

13. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object (Art. 21 GDPR). You may withdraw any consent granted at any time with effect for the future. To exercise these rights, contact us through the in-app support chat.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

14. Changes

We will update this privacy policy as changes to our processing require. The version published here at the time applies.