Privacy Policy

1Who we are and what this covers

Docsumo is an intelligent document processing (IDP) platform, operated by Docsumo Pte. Ltd. (UEN 202003040H), 160 Robinson Road, #20-03, Singapore 068914 ("Docsumo", "we", "us").

This policy covers personal data we handle through www.docsumo.com, the Docsumo app at app.docsumo.com, our APIs and integrations, our support site, and our sales, marketing and events. It forms part of our agreement with customers, together with our Terms of Service, any Order Form and, where they apply, our Data Processing Agreement (DPA) and Business Associate Agreement (BAA). A signed Order Form or master agreement takes priority if they conflict.

Our two roles

• Controller for account, contact, billing, website and marketing data. We decide how that data is used, and this policy explains how.
• Processor (a "service provider" under California law) for personal data inside Customer Data: the documents our customers upload and the data extracted from them (Output). We process Customer Data only on the customer's instructions, under our agreement and DPA with them.

If your personal data appears in documents a Docsumo customer uploads (for example, a bank statement you gave your lender), that customer's privacy notice applies. Send requests to them, and we'll help them respond.

2What we collect

Information you give us

• Contact and account details: name, work email, phone number, company, job title and login credentials. Passwords are stored only as salted hashes.
• Billing details: billing address and tax identification number (such as VAT or GST).
• What you send us: demo requests, support tickets, survey answers, event sign-ups and messages.

Information collected automatically

• Usage data from the app: features used, settings and actions, kept in your account's activity log.
• Device and connection data: IP address, browser, device type, approximate location derived from the IP address, and the pages you visit.
• Cookie data, described in Cookies.

Customer Data

Documents you upload through the app, by email, through the API or through an integration, and the data extracted from them. Depending on how you use Docsumo, these can include personal data such as names, addresses, financial and account details, government ID numbers and health information. You decide what to upload.

Information from others

• Sign-in providers, if you sign in with a third-party account such as Google.
• Partners, resellers and event organisers who pass on your details with your agreement.
• Public sources and business data providers, for company and business contact information we use in sales and marketing.

3How we use it

We use personal data only for the purposes below. For people in the European Economic Area (EEA) and the UK, the last column shows the legal basis we rely on.

We don't make decisions about you based only on automated processing that have legal or similarly significant effects on you.

4Customer Data and AI

• Used only to serve you. We process Customer Data to provide the service to the customer who uploaded it, as instructed in our agreement and DPA.
• No shared or third-party model training. We read documents with machine learning models, including large language models called through APIs from the AI providers listed on our Subprocessors page. Customer Data is not used to train shared or third-party models.
• Learning from your corrections. The service can learn from the corrections made in your account to improve results for you. You can pause automatic training at any time.
• Never sold, never used for marketing.
• Need-to-know access. Only authorised Docsumo staff can access Customer Data, only when needed to support you, keep the service secure or meet a legal duty, and that access is logged.
• Data Processing Agreement. Available on request, and part of your agreement wherever data protection law requires one.
• Deletion on your terms. Delete documents in the app or by API at any time. Everything is deleted automatically when your agreement ends.

5When we share personal data

We don't sell personal data, and we don't give it to third parties for their own marketing. We share it only in these cases:

• Subprocessors and service providers that host, process or support our service: cloud hosting, AI model APIs, databases, error monitoring, email, CRM and analytics. They act on our instructions under written data protection terms. Those that handle Customer Data are listed on our Subprocessors page.
• Integrations you turn on. When you send Customer Data to your own endpoint or to a tool such as Google Sheets, Salesforce, Zapier or Microsoft Power Automate, that provider's terms and privacy policy apply.
• Advertising and analytics partners such as Google, Microsoft and LinkedIn, through cookies on our website, subject to your cookie choices.
• Legal reasons: when the law, a court order or a regulator requires it, or to protect the rights, safety and property of Docsumo, our users or others.
• Business changes. If Docsumo is involved in a merger, acquisition, financing or sale of assets, personal data may pass to the new owner under this policy. We'll tell you before your data becomes subject to a different policy.
• With your consent, in any other case.

6Where your data is stored

Customer Data is stored in the hosting region the customer chooses: the United States, the European Union (Frankfurt), the United Kingdom (London), India, Singapore or Australia. Our team works from the United States, India and Nepal, and some of our service providers are in other countries, so personal data may be accessed from or transferred to countries other than your own.

When we transfer personal data out of the EEA, the UK or Switzerland, we use safeguards the law recognises, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Transfers out of Singapore meet the requirements of Singapore's Personal Data Protection Act (PDPA).

7Cookies and similar technologies

Cookies are small files a website stores in your browser. We and our partners use cookies, pixels and similar tools on our website and in the app. These are the ones we use today:

Your choices

• In the EEA, the UK and Switzerland, analytics and advertising cookies stay off until you accept them.
• Everywhere else, they're on by default, and you can turn them off with the button below.
• Global Privacy Control. If your browser sends a Global Privacy Control signal, our website treats it as a request to opt out of analytics and advertising cookies.
• You can also block or delete cookies in your browser's settings. Some features may not work without them.

Manage cookie choices

8How long we keep it

We delete or correct personal data within 30 days of a verified request, unless the law requires us to keep it.

9How we protect it

• SOC 2 Type 2 audited and ISO/IEC 27001:2022 certified
• Encryption in transit (TLS) and at rest (AES-256)
• Role-based access, single sign-on, multi-factor authentication and an activity log in every account
• Daily backups and an independent penetration test every year
• Security and privacy training for staff when they join and every year after

No system is perfectly secure. If we learn of a breach that affects your personal data, we'll notify you and the authorities as the law requires, without undue delay. Please keep your password and API keys confidential. More on our Security page.

10Your rights

Depending on where you live, you can ask us to:

• Give you access to your personal data, including a copy in a portable format
• Correct data that's wrong or incomplete
• Delete your data
• Restrict certain uses, or object to processing based on legitimate interests
• Stop marketing emails, and opt out of the sale or sharing of personal data and of targeted advertising
• Withdraw consent you've given, without affecting processing before that

How to ask

Email privacy@docsumo.com. We'll verify your identity and reply within 30 days, or tell you if we need longer as the law allows. You can make a request through an authorised agent, and we won't treat you differently for using your rights.

If we turn down your request, you can appeal by replying to our answer. You can also complain to your local data protection authority (for example in the EU, the UK or Singapore) or, in the US, your state attorney general.

For Customer Data, send your request to the Docsumo customer that uploaded it.

11Notice for US state residents

California and other US states with privacy laws (such as Virginia, Colorado, Connecticut, Texas and Oregon) give their residents the rights above. In the last 12 months we collected these categories of personal information:

We don't sell personal information for money. Letting advertising partners set cookies on our website may count as "sharing" or "targeted advertising" under these laws. You can opt out with Manage cookie choices or a Global Privacy Control signal. We don't use sensitive personal information to infer characteristics about you. Sources, purposes and retention are set out above.

12Emails from us

We send service emails about your account, security and changes to our terms. With your consent where required, we also send product news and invitations. Every marketing email has an unsubscribe link; service emails continue while you have an account.

13Other websites

Our website and app link to sites and services we don't control. Their own privacy policies apply.

14Changes to this policy

We'll post any change on this page with a new date. For material changes, we'll tell you by email or in the app before they take effect.

15Contact us

Privacy questions and requests: privacy@docsumo.com.

By post: Privacy Officer, Docsumo Pte. Ltd., 160 Robinson Road, #20-03, Singapore 068914.

This policy is governed by the laws of Singapore. That doesn't take away any protection the law where you live gives you.