Roles
Where you upload documents containing personal data, you act as controller and Docovly (Pvt) Ltd acts as processor. We process that data only on your documented instructions, which for these purposes means the jobs you run in the product or through the API.
Scope of processing
- Subject matter - restoration of documents and extraction of the fields they contain.
- Duration - for as long as the relevant job and account exist.
- Nature and purpose - image restoration, verification and structured data capture.
- Categories of data - whatever appears in the documents you upload, which may include special category data such as health records.
Sub-processors
We use infrastructure providers and, for some treatments, model providers. All are bound by contract to process data only for the purpose of delivering the service, and are not permitted to retain or train on it.
A current list of sub-processors is available on request, and we will give notice before adding a new one.
Security measures
- Account-level isolation enforced at the query layer.
- Signed session tokens in httpOnly cookies, with server-side route guarding.
- Encryption of storage integration credentials held against an account.
- Read-only storage integrations - the platform cannot write to, move or delete anything in your storage.
- Server-side separation of providers, models and instructions from anything the browser can reach.
Data subject requests
Where a data subject contacts us directly about data you control, we will refer them to you and assist you in responding, taking into account the nature of the processing.
Breach notification
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification obligations.
Deletion and return
On termination, or on your instruction, we delete the documents, versions and captured data associated with your account. Export what you need before closing the account.
Audits and residency
Enterprise agreements can include a security review, agreed audit arrangements, and data residency or on-premises deployment. Contact us to start that process.