Privacy Policy

1. About this policy & the app

This Privacy Policy applies to the website at docs2ai.com, the application at copilot.docs2ai.com, and any related document-automation services offered by Docs2AI (collectively, "Docs2AI", the "Service", "we", "us", or "our").

Docs2AI is a document-automation product that lets you describe a workflow in natural language and then ingests documents from sources you connect (such as uploads, Google Drive, or Microsoft OneDrive), uses AI to classify or extract information, optionally routes items for human review, and writes results back to destinations you connect (such as Google Sheets, OneDrive, Slack, or a webhook).

By creating an account or using the Service, you agree to the practices described here. If you do not agree, please discontinue use of the Service.

2. Information we collect

2.1 Information you provide

• Account information — name, email address, organization name, password (or identity-provider identifier), and billing details.
• Workflow content — files, prompts, instructions, classification labels, extracted fields, and run results that you upload, generate, or process in the Service.
• Communications — messages you send to support, on our website, or via integrations.

2.2 Information collected automatically

• Usage data — pages visited, features used, run counts, timestamps, and device metadata.
• Log data — IP address, browser type, operating system, referrer URL, and error reports.
• Cookies and similar technologies — strictly necessary cookies for sessions and preferences, plus aggregated product analytics.

2.3 Information from connected third-party services

• Google account data — see Section 3.
• Microsoft account data — see Section 4.
• Other integrations you connect (Slack, webhooks, Odoo, etc.) — only the data fields you authorize.

3. Google API user data

When you connect a Google account to Docs2AI, you authorize Docs2AI, through OAuth, to access specific Google data only for the purpose of executing the workflows you have configured.

3.1 OAuth scopes we may request

We request only the minimum scopes required to make a workflow function. Depending on the integrations you enable, we may request:

Scope	What it lets Docs2AI do
userinfo.email userinfo.profile openid	Identify your account (name, email, profile picture) so we can sign you in and associate your data with your account.
drive.file (default)	Read & write only the specific Google Drive files you pick using the Google file picker, or files Docs2AI created. We cannot see other files in your Drive.
drive.readonly (optional, with consent)	Used only if you enable a workflow that needs to scan a folder you select. We do not browse Drive beyond the folder you authorize.
spreadsheets	Read and write the specific Google Sheets you choose as a workflow destination.
gmail.send (optional)	Send email from your account only when a workflow you build explicitly sends a notification. We do not read your inbox.

3.2 What we do with Google user data

• Read documents from the Drive files/folders you select so the workflow can process them.
• Pass that content to Anthropic's Claude API (our AI sub-processor) to perform the extraction, classification, or summarization step you configured.
• Write structured results back to the Google Sheet, Drive file, or other destination you specified.
• Maintain a short-lived processing cache and a run history that you can view in your account.

3.3 Limited Use disclosure (Google API Services User Data Policy)

Specifically, Docs2AI does not:

• Use Google user data to serve advertisements, including retargeting, personalized or interest-based advertising.
• Sell Google user data.
• Transfer Google user data to third parties except (a) to provide or improve user-facing features of the Service that are prominent in the user interface and only with your consent, (b) for security purposes (such as investigating abuse), or (c) to comply with applicable law.
• Allow humans to read Google user data unless we have your affirmative agreement for specific messages, it is necessary for security purposes (such as investigating a bug or abuse), to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.
• Use Google user data to develop, improve, or train any generalized or non-personalized AI/ML models, including those provided by Anthropic. Anthropic's Claude API, which we use as a sub-processor, does not use API inputs or outputs to train its models.

3.4 Revoking access

You can revoke Docs2AI's access to your Google account at any time at myaccount.google.com/permissions. After revocation we will no longer be able to access new Google data, and stored data tied to that workflow can be deleted as described in Section 10.

4. Microsoft API user data

When you connect a Microsoft account, you authorize Docs2AI to use the Microsoft Graph API under OAuth scopes you approve to access files, folders, and metadata in your OneDrive or SharePoint.

• Scopes we may request: User.Read, Files.Read, Files.ReadWrite, Sites.Read.All (only for SharePoint workflows). We request the minimum scope needed for the workflow you configure.
• What we do with it: read documents from the OneDrive/SharePoint locations you select, run the workflow, and (optionally) write results back to a location you specify.
• Limited Use: Microsoft account data is processed only to operate the Service. We do not sell it, do not use it for advertising, and do not use it to train any AI/ML model.
• Revoking access: at myaccount.microsoft.com under My account → Privacy → App permissions.

5. Anthropic / Claude (AI provider)

All AI-powered steps in Docs2AI — including classification, extraction, summarization, prompt completion, and natural-language workflow generation — are performed by Anthropic's Claude API. When you run an AI step:

• The prompt and only the document content needed for that step are sent to Anthropic's API on your behalf.
• Anthropic processes the input as a sub-processor under the Anthropic Commercial Terms of Service and the Anthropic Privacy Policy.
• Under those terms, Anthropic does not use API inputs or outputs to train its models.

Other infrastructure sub-processors include our cloud hosting provider, transactional email service, and error-monitoring service. They process data only on documented instructions from us and under written confidentiality and data-protection obligations.

6. How we use your information

• Provide, operate, maintain, and secure the Service.
• Execute the workflows you create — reading documents, running AI steps, and writing results to destinations you connect.
• Authenticate you, manage subscriptions, and process payments.
• Communicate with you about updates, security notices, and support.
• Improve the Service using aggregated, non-identifying usage data. We do not use the content of your documents or your Google/Microsoft data to train AI models.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Comply with legal obligations.

7. How we share information

We do not sell your personal information. We share information only as follows:

• With your team. Other members of your Docs2AI organization can see shared workflows, runs, and the content those workflows process.
• With third-party services you connect. Content is sent to destinations you configure (e.g., a row written to your Google Sheet, a file saved back to OneDrive, a message sent to Slack).
• With sub-processors. The vendors named in Sections 3–5 (Anthropic, plus our hosting, email, and monitoring providers), strictly to operate the Service.
• For legal reasons. When required by law, subpoena, or to protect the rights, property, or safety of Docs2AI, our users, or the public.
• In a business transfer. In connection with a merger, acquisition, or asset sale, subject to the same protections.

8. Storage & security

Docs2AI applies industry-standard safeguards to protect your information:

• Encryption in transit using TLS 1.2 or higher for all connections to the Service and to Google, Microsoft, and Anthropic APIs.
• Encryption at rest for stored documents and database records using AES-256.
• Least-privilege access controls for our personnel, with audit logging.
• Isolated tenancy so one customer's data cannot be accessed by another customer.
• Regular dependency and security reviews and prompt patching of known vulnerabilities.

No internet service can be 100% secure; while we work hard to protect your information, we cannot guarantee absolute security.

9. Data retention

We retain different types of data for different periods, all aligned to the principle of keeping data only as long as needed:

• Account data (name, email, org info): retained while your account is active and for up to 90 days after account closure for billing and legal purposes.
• Workflow content & run results (documents, extracted fields, AI outputs): retained while your workflow is active. You can delete an individual file, run, or workflow at any time from the Service UI; deletion is propagated within 30 days.
• Google & Microsoft cached content: short-lived processing cache used only during a run, deleted within 24 hours after the run completes. Persistent copies are only kept if you explicitly save them as run history.
• Logs & usage analytics: retained for up to 12 months in identifiable form, then aggregated or deleted.
• Backups: encrypted backups are rotated and fully purged within 35 days.

We may retain information longer than the periods above when required to comply with legal obligations, resolve disputes, or enforce our agreements.

10. How to delete your data

You have several ways to delete the data Docs2AI holds about you:

• Delete individual items in-product — workflows, runs, files, and connected accounts can be removed from your dashboard at any time.
• Disconnect an integration — disconnecting your Google or Microsoft account in Docs2AI revokes our tokens. You may also revoke access directly at myaccount.google.com/permissions or myaccount.microsoft.com.
• Delete your entire account — choose Settings → Delete account in the Service, or email us at [email protected]. We will confirm and complete deletion within 30 days, except where we are legally required to retain certain records.
• Request a copy of your data — email [email protected] and we will provide a portable export within 30 days.

11. Your rights

Depending on where you live, you may have the right to access, correct, export, delete, restrict, or object to processing of your personal information, and to withdraw consent. You also have the right to lodge a complaint with your local data protection authority. To exercise these rights, contact [email protected]; we will respond within the timeframes required by applicable law (usually within 30 days).

12. Cookies

We use strictly necessary cookies to keep you signed in and remember your preferences, plus aggregated product analytics. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings, though some features may not work without them.

13. Children's privacy

Docs2AI is not directed to children under 13 (or 16 in the EEA), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

14. International transfers

Docs2AI is operated from the United States, and our sub-processors may process data in the United States and other countries. Where required, we rely on the Standard Contractual Clauses approved by the European Commission (and the UK addendum) to transfer personal data internationally.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Effective" date above. If a change is material, we will give reasonable advance notice — for example, by email or an in-product notice — and you can review the new policy before it takes effect.

16. Contact us

If you have questions about this Privacy Policy, want to exercise a privacy right, or need to report a security issue, please contact us:

• Privacy inquiries: [email protected]
• Security reports: [email protected]
• General support: [email protected]