Who we are

Docovly (Pvt) Ltd provides a document restoration platform. In this policy, we, us and our mean Docovly (Pvt) Ltd.

This policy covers both the marketing site you are reading and the application at https://app.docovly.com. It explains what personal data we handle, why, for how long, and what you can ask us to do about it.

For anything this policy does not answer, write to support@docovly.com and a person will reply.

The short version

The detail follows, but these are the commitments that matter most and the rest of this policy is consistent with them.

Your documents belong to your account. We do not sell them, rent them, or share them with anyone for their own purposes.
Nothing you upload is used to train models - ours or anybody else's.
Nobody at Docovly (Pvt) Ltd reads your documents as a matter of course. Support staff only open a specific document when you ask them to look at it.
Deleting a job deletes the document, its versions and the data captured from it.
This marketing site sets no cookies, and measures nothing beyond anonymous page counts you have switched on.

What we collect

We collect four categories of data, and no more than each purpose needs.

Account data - your email address, a hashed password or the identifier from the sign-in provider you chose, your display name, and your plan.
Documents and outputs - the files you upload, every restored version produced from them, any regions you marked, and the fields captured from them. These may contain other people's personal data, and may include special category data such as health or biometric information, depending on what you upload.
Usage data - which consoles and treatments you used, points consumed, job outcomes, error diagnostics, approximate location derived from IP address, and basic device and browser information. This is what tells us a treatment is failing on a class of document.
Billing data - your plan, billing country, invoice history and the last four digits and expiry of your card. Full card numbers are handled by our payment processor and never reach our servers.
Support data - the messages you send us and anything you choose to attach to them.

Why we process it, and on what legal basis

Where the UK GDPR or EU GDPR applies, we rely on the following bases.

To provide the service you asked for - restoring your documents, running jobs, storing versions, showing your history. Basis: performance of a contract with you.
To take payment and keep accounting records. Basis: performance of a contract, and legal obligation for the records we must retain.
To keep the platform secure, prevent abuse, and investigate misuse. Basis: our legitimate interest in a service that is not used to commit fraud.
To improve reliability - understanding which treatments fail, on what material, and why. Basis: our legitimate interest in the product working. This uses job outcomes and diagnostics, not the content of your documents.
To reply when you contact us. Basis: our legitimate interest in answering you, or performance of a contract where you are a customer.
To send product email you asked for. Basis: your consent, which you can withdraw at any time.

How your documents are used

Your documents are processed to produce the result you asked for, and for nothing else.

They are not used as training data. They are not used to improve a model, ours or a provider's. They are not pooled into a dataset, and they are not shared with other customers or with anyone buying access to content.

No member of staff reads your documents in the ordinary course of business. If you ask support to look at a specific job, an authorised person may open that job to diagnose it, and only that job. Access of that kind is logged.

Automated processing

Restoration is performed by machine-learning models rather than by a person reading your document. That processing produces a restored image and, where you ask for it, captured text.

It does not make decisions about you. No legal or similarly significant decision about any person is made on the basis of it, and the platform does not profile you.

Where a value cannot be read with confidence it is withheld and marked rather than guessed, so nothing in an export silently represents an uncertain reading as a fact. You remain responsible for reviewing withheld and flagged values before relying on captured data.

Who else touches your data

We use a small number of service providers, each bound by contract to process data only to deliver our service, and none permitted to retain it or train on it.

Cloud hosting and storage, to run the platform and hold your files.
Model providers, for the treatments that do not run locally.
A payment processor, for subscriptions.
Email delivery, for account and transactional messages.
Error and performance monitoring, to find faults.

Sub-processor list and notice

A current list of sub-processors, naming each provider and what it does, is available on request from support@docovly.com. We give notice before adding a new one to an account on a Data Processing Agreement.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Where your data is processed

Documents are processed on infrastructure that may sit outside your own country. Where personal data leaves the UK or the EEA we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses with each provider, together with additional safeguards where the destination requires them.

If you need processing confined to a specific region, or an on-premises deployment, that is handled on the Enterprise tier. Write to support@docovly.com before you upload anything, not after.

How long we keep things

Retention is tied to what the data is for. Where a period is set by law, the law wins.

Documents, versions and captured data - until you delete them, or until 30 days after your account is closed, whichever comes first. Deletion from backups follows within a further 30 days.
Account data - for as long as your account is open, then 30 days.
Billing and invoice records - six years from the end of the relevant financial year, because tax law requires it.
Usage and diagnostic data - up to 24 months, after which it is aggregated so it no longer identifies anyone.
Support correspondence - up to 24 months from the last message in the thread.

How we protect it

No system is perfectly secure. If a breach affects your personal data we will tell you without undue delay, with what you need to meet your own obligations.

Encryption in transit, and encryption at rest for stored documents and versions.
Account-level isolation enforced at the query layer, so one account cannot reach another's material.
Signed session tokens in httpOnly cookies, with server-side route guarding.
Encryption of any storage-integration credentials held against your account.
Read-only storage integrations - the platform cannot write to, move or delete anything in your own storage.
Providers, models and instructions kept server-side, out of reach of anything running in the browser.
Access to production data restricted to the staff who need it, and logged when exercised.

Your rights

Wherever you are, you can ask us to do the following, and we will not charge you or make the service worse for asking.

Access - get a copy of the personal data we hold about you.
Correction - have inaccurate data put right.
Deletion - have your data erased. Most of this you can do yourself from inside the product.
Portability - receive your data in a portable format, or have it sent to another provider where technically feasible.
Objection - object to processing we carry out on the basis of legitimate interests.
Restriction - ask us to pause processing while a dispute is resolved.
Withdraw consent - for anything you consented to, without affecting what was lawful before you withdrew it.

How to exercise them

Most of it is self-service inside the product: export a job, delete a document, close an account. For anything else, write to support@docovly.com. We respond within one month, and will tell you if a request is genuinely complex enough to need longer.

We may ask you to confirm your identity before acting on a request, which is a protection for you rather than an obstacle.

If you are in the UK or the EEA

You have the right to complain to your data protection supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EEA it is the authority for the country you live or work in. Nothing in this policy restricts that right or asks you to give it up.

We would rather hear from you first - write to support@docovly.com - but it is your right either way.

If you are in California

Under the CCPA as amended by the CPRA, the categories of personal information described in What we collect map to identifiers, commercial information, internet activity, geolocation, and the contents of documents you choose to upload. We collect them for the business purposes described above, from you directly and from your use of the service.

We have not sold or shared personal information for cross-context behavioural advertising in the preceding twelve months, and we do not do so now. We do not knowingly collect or sell the personal information of anyone under 16.

You have the right to know, to delete, to correct, to opt out of sale or sharing (which does not arise here), and to limit the use of sensitive personal information. You have the right not to be discriminated against for exercising any of them. Submit a request to support@docovly.com, or have an authorised agent do it for you with written proof of authority.

Other US state privacy laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas and other states with comprehensive privacy laws have broadly equivalent rights to access, correct, delete and port their data, and to opt out of targeted advertising, sale and profiling that produces legal effects. None of those three activities takes place here.

Where a state gives you the right to appeal a refused request, write to support@docovly.com with the word appeal in the subject and a different person will review it.

Children

The service is not directed at children and is not intended for anyone under 16. We do not knowingly collect their personal data. If you believe a child has given us personal data, write to support@docovly.com and we will delete it.

This is different from restoring a document that happens to be about a child, such as a birth certificate or a school record. That is ordinary use of the platform by an adult account holder.

Marketing

We send transactional email - receipts, job outcomes, security notices - because they are part of the service, and you cannot opt out of those while you have an account.

Product news and anything promotional is opt-in, and every one of those messages carries an unsubscribe link that works immediately. We do not sell or rent our mailing list.

Cookies and local storage

This marketing site sets no cookies at all. There is no advertising network and nothing that follows you between sites - the only thing written to your browser is your answer to the cookie notice, stored locally so the notice does not reappear on every page. You can change or withdraw that answer at any time using Cookie settings in the footer.

If you turn the analytics switch on, these pages load Vercel Analytics, which counts page views without cookies and without building a profile of you. It is the only non-essential script on the site, it is never fetched while the switch is off, and turning the switch back off stops it immediately.

The application sets one session cookie so you can stay signed in. It is httpOnly, which means page scripts cannot read it, and it is not used for advertising or shared with anyone.

Do Not Track and Global Privacy Control

This site runs no advertising or cross-site tracking, so there is nothing of that kind to opt out of. For the one optional thing it does load - anonymous page counts - a Global Privacy Control signal from your browser is treated as a valid instruction to keep it off, and overrides the cookie panel even if analytics was switched on there.

Changes to this policy

If this policy changes materially we will say so in the product and by email to account holders, rather than quietly updating the date at the top of this page. The date at the top is the last revision.

Continuing to use the service after a change takes effect means you accept the revised policy. If you do not, you can close your account and ask us to delete your data.

How to reach us

Write to support@docovly.com and it reaches Docovly (Pvt) Ltd. Questions about any of this go to a person, not a form.

This document is written in plain language to match how the product actually behaves. It is a template rather than legal advice - have it reviewed by a qualified lawyer in your jurisdiction before relying on it.

Privacy Policy