This Privacy Policy describes how Docvik AI Tech Solutions Pvt Ltd ("Docvik", "we", "our") collects, uses, stores, and protects personal information when you visit our websites, sign up for an account, or use the Docvik platform (the "Service").
We have written this policy in plain English. Where local law requires specific terminology — including the Digital Personal Data Protection Act, 2023 ("DPDPA") — those terms are used inline.
1. Who we are
Docvik AI Tech Solutions Pvt Ltd is the Data Fiduciary for personal data we process about visitors to our website and account holders on our platform. Our registered office is in Hyderabad, India.
For customer document content uploaded to the Service, Docvik acts as a Data Processor on behalf of the customer (the Data Fiduciary). The customer determines what content is uploaded and how long it is retained.
2. Information we collect
Information you provide to us
- Account information — name, work email address, workspace name, and password (hashed) when you sign up.
- Profile information — role, time zone, and preferences you choose to add.
- Billing information — when invoiced subscriptions begin, the billing contact name, address, and tax identification number (GSTIN where applicable).
- Communications — content of emails or messages you send us, including demo requests and support tickets.
Customer content
- Documents you upload or forward — invoices, test certificates, guarantee certificates, and similar business documents processed by the Service, including any personal information they contain.
- Extracted fields and reviewer edits — structured data we extract from documents and any corrections your reviewers make.
Information collected automatically
- Usage data — pages viewed, features used, error logs, IP address, browser, and device. Used to operate, secure, and improve the Service.
- Cookies — strictly necessary cookies for authentication and security. We do not use third-party advertising or cross-site tracking cookies.
3. How we use information
- To provide, maintain, and improve the Service.
- To extract structured data from customer documents using AI models and computer vision (e.g., Amazon Textract, Amazon Bedrock).
- To authenticate users and prevent fraud or abuse.
- To respond to demo requests, support enquiries, and account-related communications.
- To comply with legal obligations, including tax and accounting regulations applicable to us in India.
We do not use customer content to train general-purpose AI models. Documents are processed only to deliver the extraction and workflow features the customer requests.
4. Where information is stored
All customer content and operational data is stored on Amazon Web Services infrastructure in the Asia Pacific (Mumbai) region. Limited operational metadata (e.g., authentication events) may be processed in adjacent AWS regions where the specific service is not available in Mumbai; in such cases the data is encrypted in transit and at rest, and remains under Docvik's control.
Customer documents are encrypted at rest with AWS-managed keys and in transit using TLS 1.2 or higher.
5. Who we share information with
We do not sell personal information. We share information only with the following categories of recipients, under written agreements that restrict their use of the data:
- Sub-processors — Amazon Web Services for hosting, storage, AI inference, and email delivery. AWS processes data on our behalf and is contractually bound by its Data Processing Addendum.
- Authorised customer users — within a customer workspace, content is accessible to users that the customer has invited and assigned access to.
- Law enforcement — only when legally compelled by a valid order under Indian law, and only to the extent required. We will notify the affected customer where lawful to do so.
6. Data retention
Account information is retained for the duration of the customer's subscription and for up to 18 months after termination, unless a longer period is required by law (for example, statutory tax records). Customer content is retained per the customer's workspace retention settings; on termination, customer content is deleted within 30 days unless the customer requests a longer wind-down period.
7. Your rights
Under the DPDPA and other applicable data protection laws, you may have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request erasure of your personal data, subject to legal limits.
- Nominate another person to exercise these rights on your behalf.
- File a grievance with our Grievance Officer (contact below), and if unresolved, with the Data Protection Board of India.
For customer content, requests should generally be made to the customer (Data Fiduciary). We will assist the customer in fulfilling such requests as required by our agreement with them.
8. Security
We follow industry-standard security practices: encryption in transit and at rest, least-privilege access controls, multi-factor authentication for administrative access, segregation of customer data by workspace, and routine security review. No system is completely secure; we encourage you to use strong passwords and to contact us immediately if you suspect unauthorised access.
9. Children
The Service is intended for use by businesses and is not directed to children under 18. We do not knowingly collect personal data from children.
10. Changes to this policy
We may update this policy as the Service evolves or as laws change. Material changes will be notified to active customers by email and posted here with a revised "Last updated" date. Continued use of the Service after such notification constitutes acceptance.
11. Contact
Questions about this policy, or to exercise your rights, contact us:
Grievance Officer
Docvik AI Tech Solutions Pvt Ltd
Hyderabad, India
Email: privacy@docvik.ai