Privacy Policy

1. Overview

This Privacy Policy explains how DocuNext collects, uses, stores, shares, and protects information when you use the dashboard, APIs, document generation features, and related services.

DocuNext is designed for business document automation. You should only upload templates, field values, and documents that you are authorised to process through the service.

2. Information we collect

• Account information, such as email address, authentication records, workspace membership, invitations, and account settings.
• Customer content, including DOCX templates, detected placeholder names, generation field values, generated documents, filenames, and related metadata.
• API and usage information, such as API key identifiers, hashed API keys, request timestamps, template identifiers, generation status, rate-limit events, and error codes.
• Technical information, such as IP address, browser or device data, session information, log events, and security signals.
• Support information you provide when you contact us, including messages, troubleshooting details, and attachments.

3. How we use information

• Provide, operate, secure, and maintain the service.
• Authenticate users, authorise workspace access, and verify API-key ownership.
• Process uploaded templates, replace placeholders, generate files, store outputs, and provide time-limited downloads.
• Monitor usage, enforce limits, prevent abuse, investigate errors, and protect customers and the service.
• Send account, security, product, billing, and support communications.
• Improve reliability, performance, documentation, and user experience.
• Comply with legal obligations and enforce our terms.

4. Customer content and generated documents

We process templates, field values, and generated documents to provide document automation features. Customer content may contain personal information depending on what you choose to upload or submit.

You control the content you upload and the data you submit for generation. You are responsible for confirming that you have a lawful basis and all required permissions to process that content through DocuNext.

5. API keys and credentials

DocuNext stores API keys as hashes and shows the full key only when it is created. We do not intentionally log API keys, passwords, access tokens, document contents, sensitive field values, or service credentials.

You are responsible for protecting API keys and rotating them if they are exposed or no longer needed.

6. How we share information

We do not sell personal information. We share information only as needed to provide and protect the service, comply with law, or complete a transaction you request.

• Service providers that support hosting, authentication, database, storage, email delivery, document conversion, logging, security, customer support, or payment processing.
• Workspace users according to their role and access permissions.
• Authorities, regulators, courts, or other parties when disclosure is required by law or needed to protect rights, safety, security, or service integrity.
• A successor or affiliate in connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate safeguards.

7. Storage, retention, and deletion

We retain information for as long as needed to provide the service, maintain security, comply with legal obligations, resolve disputes, enforce agreements, and operate backups. Retention periods may vary by plan, workspace settings, content type, and legal requirements.

When content is deleted from active systems, backup copies may remain for a limited period until they are overwritten or expire through normal backup processes.

8. Security

We use technical and organisational safeguards designed to protect information, including private storage, authentication controls, row-level access controls, hashed API keys, signed URLs where appropriate, and operational limits on uploads and processing.

No internet service can be guaranteed completely secure. You should use strong passwords, restrict workspace access, keep API keys secret, and promptly report suspected unauthorised access.

9. International processing

Information may be processed and stored in countries other than where you are located. Those countries may have data protection laws that differ from the laws in your jurisdiction. Where required, we use appropriate safeguards for cross-border transfers.

10. Cookies and similar technologies

DocuNext may use cookies, local storage, and similar technologies to support authentication, sessions, security, preferences, and service functionality. You can configure your browser to block some cookies, but parts of the service may not work correctly without them.

11. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to certain processing of personal information. You may also have the right to withdraw consent where processing is based on consent.

Workspace administrators can manage certain account, user, template, document, and API-key records from the product. For requests that cannot be completed in-product, contact support@docunext.app.

12. Children's privacy

DocuNext is intended for business users and is not directed to children. We do not knowingly collect personal information from children under the age required by applicable law. If you believe a child has provided personal information to us, contact us so we can take appropriate action.

13. Changes to this policy

We may update this Privacy Policy from time to time. When changes are material, we will take reasonable steps to notify users, such as updating the effective date or providing in-product notice. Continued use of DocuNext after an updated policy takes effect means the updated policy applies.

14. Contact

Questions, privacy requests, and security concerns can be sent to support@docunext.app.