Privacy policy

DocAsker is client document collection software. Firms such as accountants, immigration consultants and law firms use it to request documents from their own clients through a secure link. Because of this, we handle personal data in two different roles.

We act as a controller for data about visitors to our website, people who sign up for a trial and the people who hold or use a DocAsker account. In this role we decide why and how that data is used, and this policy applies in full.

We act as a processor for the documents and details that firms collect from their clients through DocAsker. The firm is the controller of that data and decides what to collect, why and for how long. We only process it on the firm's instructions and under our agreement with the firm. If you uploaded documents to a firm through DocAsker, the firm's own privacy notice applies, and you should contact the firm first with any questions.

Account and trial data: your name, work email address, firm name, password (stored in hashed form), plan and billing details, and the settings you choose. Payment card details are handled by our payment provider and are not stored on our servers.

Usage and technical data: the pages and features you use, log records of uploads, checks and downloads, IP address, browser and device type, and error reports. We use this to run, secure and improve the service.

Communications: messages you send us, such as support requests, and records of the emails we send you about your account.

Collected documents (processor role): the files a firm's clients upload, the checklist items they relate to, the results of the checks, and the contact details the firm enters so we can send the link and reminders, such as a client's name, email address and, on some plans, phone number.

We use account and usage data to create and run your account, provide the features of your plan, process payments, send service and security messages, answer support requests and prevent misuse.

We use aggregated information about how the service is used to fix problems and improve DocAsker. We do not sell personal data, and we do not use it for advertising.

We use collected documents and client contact details only to provide the service to the firm that collected them: delivering request links and reminders, running the checks on each upload, renaming and filing accepted files, and keeping the activity log.

When a client uploads a file, DocAsker uses AI to check it, for example for blur, glare or cut-off edges, whether it is the document that was requested, whether dates and periods match the request, whether signature fields are filled in and whether every page is present.

Uploaded documents are processed only to run these checks for the firm that requested them. We do not use customer documents to train AI models, and we do not allow our AI model providers to train their models on them.

The checks help the firm and its client catch problems early. They do not make legal or regulatory decisions about anyone. The firm stays responsible for reviewing documents and for any decision it makes based on them.

Where data protection laws such as the EU and UK General Data Protection Regulation (GDPR) or Turkey's Personal Data Protection Law (KVKK) apply, we rely on a legal basis for each use of personal data we control.

We process account data to perform our contract with you or to take steps before entering into one, such as setting up a trial. We process usage and security data based on our legitimate interests in running a secure, working service. We keep certain records, such as invoices, to meet legal obligations. Where the law requires consent, we ask for it and you can withdraw it at any time.

For collected documents, the firm is the controller and is responsible for having a valid legal basis to collect them. A data processing agreement is available on request at [email protected].

We share personal data only with service providers who help us run DocAsker, under written agreements that require them to protect it and use it only for the services they provide to us. These include providers of cloud hosting and storage, email and SMS delivery, payment processing and AI models used to run the document checks.

If a firm connects Google Drive, Dropbox or OneDrive, accepted files are sent to that account on the firm's instructions. We may also disclose data if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of our business, in which case this policy will continue to apply.

Our providers may process data in countries other than your own. When personal data is transferred across borders, we use the safeguards that applicable law requires, such as standard contractual clauses, and we take steps to make sure the data keeps an equivalent level of protection.

We keep account data while your account is active. After an account is closed, we delete or anonymize it within a reasonable period, except for records we must keep for legal, tax or accounting reasons, or to resolve disputes.

For collected documents, the firm decides how long files are kept and can delete a request and its files at any time. When a firm deletes files or closes its account, we remove them from our active systems, and copies in backups are removed as those backups are replaced.

Files and data are encrypted in transit using TLS and encrypted at rest. Access to customer data within DocAsker is limited to staff who need it to run and support the service.

Firms control their own requests: links can expire or be revoked at any time, and every upload, check and download is logged. No system is perfectly secure, but we work to protect your data and will notify affected customers and authorities of a personal data breach as the law requires.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, object to or restrict certain uses, and receive a copy in a portable format. You can also withdraw consent where we rely on it, and complain to your local data protection authority.

To use these rights for data we control, email [email protected]. We may need to confirm your identity before we act, and we will reply within the time the law allows.

If your request is about documents you uploaded to a firm through DocAsker, please contact that firm, because it controls that data. If you contact us instead, we will pass your request to the firm and help it respond.

We use only essential cookies and similar storage that the website and service need to work, such as keeping you signed in, protecting forms against misuse and remembering your language preference.

We do not use advertising cookies, and we do not allow third parties to track you across other websites through our site. If we ever add non-essential cookies, we will update this policy and ask for your consent where the law requires it.

DocAsker is a business service and is not directed at children. We do not knowingly collect personal data from children through our website or accounts.

A firm may sometimes collect documents that relate to a child, such as a birth certificate for a visa application. In that case the firm is the controller and is responsible for collecting it lawfully.

We may update this policy as our service or the law changes. We will post the new version on this page with a new date, and if a change is significant, we will tell account holders by email before it takes effect.

For any question about this policy or your personal data, email [email protected].