Privacy Policy

1. Who we are

Docutrix is operated by ZGuy Software Solutions Pty Ltd (ABN 48 617 716 597), based in Wollongong, New South Wales, Australia ("Docutrix", "we", "us"). This policy explains how we handle personal information when you visit docutrix.com, contact us, or use the Docutrix app at app.docutrix.com.

We handle personal information in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the EU or UK General Data Protection Regulation (GDPR) applies to you, we also follow it.

2. Your documents are different

When your organisation uploads documents to Docutrix, your organisation decides what is uploaded and who can access it. For that content we act as a data processor (or service provider) on your organisation's behalf, and your organisation is the data controller.

• We use your documents, questions and answers only to provide the service to your team.
• We never use them to train, fine-tune or improve AI models, on any plan.
• Access inside your workspace follows the permissions your admins set.

Enterprise customers can sign a Data Processing Agreement (DPA). See our Security page for how documents are isolated, encrypted and processed.

3. Information we collect

Information you give us. This includes:

• Contact form: your first and last name, email address, company, the subject you choose and your message.
• Discount offer: your work email address.
• App account: your name, email address and sign-in details.
• Connected sources: if your organisation connects Google Drive or Microsoft SharePoint, we receive the access it grants and the files it chooses to sync.
• Billing and support: details you give us when you buy a plan or ask for help.

Information collected automatically. This includes:

• Usage data from Google Analytics, through Google Tag Manager, but only if you accept statistics cookies.
• Advertising and campaign measurement data, but only if you accept marketing cookies.
• In the app, product usage data from PostHog, but only if you accept statistics cookies.
• Technical data such as your IP address, browser type and the pages you request. Our hosting provider processes this, and so does Cloudflare Turnstile, which checks that visitors are not bots on our contact form and on the app's sign-up, sign-in and "Try without signing in" pages.
• In the app, application logs and traces with timestamps, user identifiers, document references and the text of questions, kept for security, troubleshooting and audit purposes.

4. Trying Docutrix without an account

You can try the Docutrix app without signing up. We don't ask for your name or email address. For a guest session we store:

• A temporary guest user and workspace with a random, undeliverable email address.
• The questions you ask and the answers and citations you receive. These are processed like any other question in the app (see "Who we share it with").
• Your IP address, in a counter that limits how many guest sessions can be started and expires after one hour. Cloudflare Turnstile also receives it to check that you are not a bot.
• Cookies that keep you in your guest session, link it to your account if you sign up later (kept for 90 days), and give your browser a random identifier so we can count how many people try Docutrix (kept for 2 years).

We delete the guest user, its workspace and its conversations 24 hours after the session starts.

Where GDPR applies, we rely on our legitimate interests in letting people try Docutrix before they sign up and in protecting it from abuse. Analytics and marketing tools run in a guest session only if you accept them in the cookie banner.

5. How we use your information

• To reply to your enquiry, arrange a demo, or send the discount you requested.
• To provide, secure and support the Docutrix app.
• To understand how visitors use our website and improve it (with your consent).
• To send product or marketing emails where you have asked for them or the law allows. Every marketing email has an unsubscribe link.
• To prevent spam, fraud and abuse, and to meet our legal obligations.

Where GDPR applies, we rely on your consent (for analytics and marketing cookies), on the performance of our contract with you or your organisation, and on our legitimate interests in running and protecting our business.

6. Who we share it with

We don't sell personal information. We share it only with service providers that help us run Docutrix, such as:

• DigitalOcean, which hosts our servers, database and document storage in Sydney, Australia.
• Coolify, which we use to deploy the app. It can read server configuration and logs, but does not store your documents.
• OpenAI, Anthropic (through Amazon Web Services Bedrock) and Pinecone, our AI and search providers. When you or your team add a document, its text is sent to OpenAI to turn it into embeddings (numeric representations used for search), which are stored in Pinecone; OpenAI does the same with your questions. When you ask a question, your question and the relevant passages from your documents are sent to OpenAI or Anthropic, depending on the model configured for your workspace, to write the answer. They process this data only to provide the service to us, under agreements that protect it to a standard at least equal to this policy, and they don't use it to train their models. The Docutrix mobile and desktop apps ask your permission before they send anything to them. Enterprise customers can run a private model in their own environment instead.
• Stripe, which processes payments and billing details.
• Postmark, which sends our account and notification emails.
• PostHog, for product analytics in the app (EU hosting), with your consent.
• Google, for Analytics and Tag Manager (with your consent) and, if your organisation connects it, Google Drive.
• Microsoft, if your organisation connects SharePoint.
• Cloudflare, for Turnstile bot protection on our forms and the app's sign-up, sign-in and guest pages.
• Mautic, our customer relationship and email platform, which stores contact form and discount submissions.

We may also disclose information if the law requires it, or as part of a merger or sale of our business.

7. International transfers

Docutrix is run from Australia. Our servers, database and document storage are in Sydney, and our logs are kept in Australia. If you are in the EU or UK, using Docutrix therefore transfers your personal information to Australia, which does not have an EU adequacy decision.

Some of our service providers also process data in other countries:

• United States: OpenAI (embeddings and, if your workspace uses it, chat), Stripe, Postmark, Google and Cloudflare.
• United States or the European Union: Pinecone (search index).
• European Union: PostHog.
• Amazon Web Services Bedrock runs in Australia when your workspace uses an Australian model. Some models are served from other regions.

Where GDPR applies, we protect these transfers with the European Commission's standard contractual clauses (and the UK addendum), either in our own agreements or in our providers' data processing terms, and we rely on adequacy decisions where they exist, such as the EU-US Data Privacy Framework for certified providers. Where Australian law applies, we take reasonable steps to make sure overseas recipients protect your information to a standard comparable to the Australian Privacy Principles. You can ask us for a copy of the relevant safeguards at support@docutrix.com.

Data residency options are available for Enterprise customers.

8. How long we keep it

We keep enquiry and marketing contact details while they are relevant to our relationship with you, or until you ask us to delete them or unsubscribe.

We keep account and workspace data for as long as your organisation's subscription is active. After a subscription ends, we delete customer documents in line with our agreement with your organisation. We may keep limited records longer where the law requires it (for example, tax and billing records).

We delete guest sessions, including their questions and answers, 24 hours after they start.

We keep application logs and traces for 15 days, then delete them automatically.

9. Cookies

Our cookie banner lets you choose which cookies we use:

• Necessary: required for core website functions such as navigation and security. These are always on.
• Preferences: remember settings such as dark mode.
• Statistics: help us understand how visitors use the site and the app (Google Analytics and PostHog). These collect usage data linked to an identifier for your browser, so they are not anonymous.
• Marketing: used to measure our marketing campaigns and show relevant ads.

The website and the app each show this banner. Statistics and marketing cookies stay off until you accept them. You can change your choice at any time with the cookie settings link on the website or in the app.

10. Your rights

You can ask to access the personal information we hold about you, or to correct it. Where GDPR applies, you can also ask us to delete it, restrict or object to its use, or give you a copy in a portable format, and you can withdraw consent at any time.

If your information is in a Docutrix workspace run by your employer or another organisation, contact that organisation first. We will help them respond.

To make a request, email support@docutrix.com. We may need to verify your identity before acting on it.

11. Security

We protect personal information with measures that include tenant isolation, AES-256 encryption at rest, TLS 1.2+ encryption in transit, and role-based access controls. Read more on our Security page.

12. Children

Docutrix is a business service and is not directed at children. We don't knowingly collect personal information from children.

13. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the "Last updated" date. If the changes are significant, we will let customers know by email or in the app.

14. Contact us and complaints

Questions or complaints about privacy can be sent to support@docutrix.com. We aim to respond within 30 days.

If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au. If you're in the EU or UK, you can also contact your local data protection authority.