Last updated 26 September 2026
Privacy policy
This notice explains what personal data DocMind Technologies Pvt Ltd (“DocMind”, “we”) processes, why, and the rights you have under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”). We keep it short and specific to how the product actually works.
Draft for review by qualified counsel before launch. It describes how the DocMind product is built to handle data.
1. Our two roles
For your DocMind account (your name, email, login and billing details) we are the Data Fiduciary: we decide why and how that data is processed.
For the content you put into DocMind — documents, web pages, Q&A pairs, and conversations your assistant has with your customers — you (our customer) are the Data Fiduciary and we process it only on your instructions, as your Data Processor. If you are a visitor who chatted with a business's DocMind assistant, contact that business first about your data; we will help them respond.
2. Personal data we process
- Account data: name, email address, password (stored only as a salted hash), and your Google profile name, email and picture if you sign in with Google.
- Workspace content: files, URLs, text and Q&A you add, the search index built from them, and conversations with your assistants, including feedback ratings.
- Widget visitor data: the messages visitors send, a random visitor identifier, their IP address (used for rate limiting and abuse prevention), and an email address only if the visitor chooses to leave one.
- Billing data: billing name, address, state, GSTIN and invoice history. Card, UPI and bank details are collected and stored by Razorpay or Stripe, never by us.
- Technical data: security and error logs, IP address, browser type, and records of sensitive actions (such as role changes or workspace deletion) kept in an audit log.
3. Why we process it
- To create and secure your account, verify your email and let you sign in (consent).
- To provide the service: index your content and answer questions from it with citations (consent / your instructions).
- To bill you, issue GST invoices and meet tax and legal obligations (legitimate use permitted by law).
- To prevent fraud and abuse, enforce rate limits, and keep workspaces isolated from one another (legitimate use).
- To send service emails such as verification, password reset, invitations, usage warnings and receipts.
We do not sell personal data, and we do not use it for advertising.
4. How AI providers are used
To answer a question, DocMind sends the question and the most relevant passages from your own workspace to an AI model provider. We only use providers whose API terms prohibit training their models on customer data, and we never use your content to train any model ourselves. Providers may keep request data briefly for abuse monitoring under their own terms.
5. Consent and withdrawal
We ask for your consent when you create an account. You can withdraw it at any time by deleting your workspace (Settings → Delete workspace) or by writing to our Grievance Officer. Withdrawal doesn't affect processing that already happened, and means we can no longer provide the service to you.
6. Your rights
Under the DPDP Act you may:
- obtain a summary of the personal data we process about you and the processing activities;
- have inaccurate or incomplete data corrected, completed or updated;
- have your personal data erased when it is no longer needed, unless the law requires us to keep it;
- nominate another person to exercise your rights in the event of your death or incapacity; and
- have your grievances addressed, and escalate to the Data Protection Board of India if you are not satisfied.
You can correct your name and workspace details in the app at any time. For anything else, contact the Grievance Officer below.
7. How long we keep data
- Account and workspace data are kept while your account is active.
- When an owner deletes a workspace, its files, search index, conversations and settings are permanently deleted from our live systems straight away, and remaining copies in encrypted backups expire within 30 days.
- Invoices and payment records are kept for as long as Indian tax law requires (currently up to 8 years).
- Security and audit logs are kept for up to 1 year.
8. Who we share data with
We use these service providers (processors), each bound by contract to protect your data and use it only to serve DocMind:
- Vercel — Application hosting
- Supabase or Neon — Database (Mumbai, ap-south-1)
- Cloudflare R2 / AWS S3 — Storage of uploaded files
- Anthropic — Answer generation (Claude models)
- OpenAI — Text embeddings and fallback answer generation
- Cohere — Search result re-ranking
- Inngest — Background processing of uploads
- Resend — Transactional email
- Razorpay — Payments in INR
- Stripe — Payments in USD
We may also disclose data where required by Indian law or a lawful order.
9. Where data is stored
Workspace data is stored in India (Mumbai region) by default. Some providers, such as AI model providers, may process data in other countries, including the United States, to answer a request. We only transfer data to countries not restricted by the Government of India under Section 16 of the DPDP Act.
10. Security
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Every workspace is isolated at the database level with row-level security, API keys are stored only as hashes, and staff access to customer data is limited and logged. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as the DPDP Act requires.
11. Children
DocMind is a business tool and is not intended for anyone under 18. We do not knowingly create accounts for children. Customers who deploy DocMind in services used by children are responsible for obtaining verifiable parental consent and must not enable tracking or targeted advertising towards children.
13. Grievance Officer and contact
Grievance Officer: [Name to be appointed], DocMind Technologies Pvt Ltd. Email: grievance@docmind.app.
We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
14. Changes to this notice
We will post changes here and, for material changes, email account owners before they take effect. See also our Terms of service.