Legal
Privacy Policy
What DocoMatic collects, why, how long it is kept, where it is stored, and how to exercise your rights — in plain language.
Effective date: September 16, 2026Version 1.0
The English version governs. Translations are provided for convenience.
1. Who this covers and our role
1.1
This policy explains how Monocubed, Inc. ("DocoMatic", "we") handles personal information on the DocoMatic website, in the free public tools and on the platform. For your account and for information collected on this site, DocoMatic decides how the information is used and is accountable for it (in privacy-law terms, the controller).
1.2
For the documents you upload to the platform, DocoMatic acts as a processor (a service provider): they are your content, handled only on your instructions under the Data Processing Agreement.
2. What we collect
2.1
Account and organization data: your name, work email, role, organization name and type, and country.
2.2
Customer content: the documents you upload, the remediated outputs, verification reports and audit records.
2.3
First-party usage analytics, sent only to our own servers: which pages are viewed, which buttons and forms are used, how far pages are scrolled, the referring website's name, campaign tags in the link, site language, and a general device type and browser. We set no cookies and store no IP address, name or email address with these records; each page load gets a random number that is forgotten when you leave. When you follow a sign-up link from this site, a short description of that visit (the first page, campaign tags, referring website and time) goes with it, and we record it against your organization's new account to see which pages lead to sign-ups. We use no third-party advertising pixels or trackers, and nothing is sent when your browser signals Do Not Track or Global Privacy Control. These records are deleted after 13 months; only daily totals are kept longer.
2.4
Leads from the free tools: the email address and inputs you provide when you run a scan, check a document or request a report.
2.5
Billing data: handled by our payment processor; we do not store full card numbers.
2.6
Support correspondence and, for gated signups, the review information you submit.
2.7
Technical logs: our servers record IP addresses, request details and errors in order to run and secure the service.
2.8
Abuse checks: when unusual activity from your network triggers it on a public form, Cloudflare Turnstile loads and processes technical information about your browser and connection to tell people from automated traffic. It is not loaded otherwise.
3. Why we collect it
- To provide and operate the service, including remediation, verification and the audit trail.
- To verify eligibility for an account under our access rules.
- To bill for the service and maintain usage statements.
- To provide support and send transactional service notifications.
- To improve the product using aggregated, de-identified usage data.
- To secure the service and prevent abuse.
4. Your documents
4.1
Documents uploaded to the platform are customer content. We process them only to provide the service, and we never use them to train AI models.
4.2
Image descriptions for alt text use an outside AI provider only under a contract that forbids training on your documents and keeps no copy of them; otherwise our own software is used and nothing leaves our systems. Each customer organization can turn outside AI off entirely in its settings.
4.3
Documents uploaded to the free public tools are deleted within 24 hours and are likewise never used for training.
5. Retention
5.1
Source files and outputs are retained according to your plan. Automatic deletion at the end of each retention period is not switched on yet; until it is, we delete data on request, and our operations team can provide a record of what was removed.
- Free trial: 30 days.
- Starter: 1 year.
- Growth: 3 years.
- Scale: 7 years.
- Enterprise: custom, per contract.
5.2
When a trial expires, the account is read-only for 30 days, after which its documents may be deleted unless the account converts to a paid plan.
5.3
Account, billing and support records are kept while your account is open, and afterwards for as long as we need them for tax, accounting and legal purposes. When an account closes, customer content is deleted as the Data Processing Agreement describes.
6. Where data is stored
6.1
We store customer data in the United States, on Amazon Web Services: the primary region is US East (N. Virginia), with encrypted backups in US West (Oregon). We do not offer a Canadian region.
6.2
If you are in Canada, your personal information will be stored and processed in the United States, and it may be accessible to US courts, law enforcement and national security authorities under US law.
7. Sub-processors
7.1
We use a small set of infrastructure and service providers to run DocoMatic: cloud hosting and storage, payment processing, AI model providers used only under no-training and no-retention contracts, and Cloudflare Turnstile for abuse checks. The current list is published on the security page.
7.2
Customers are told at least 30 days before we add or replace a provider that processes customer data, as the Data Processing Agreement describes.
8. How we protect information
We protect personal information with encryption in transit and at rest, tenant isolation, role-based access control, malware scanning of uploads and audit logging, as described on the security page. If a security breach affects your personal information, we notify as the law requires; for customer documents, we notify the customer as the Data Processing Agreement describes.
9. Your rights
9.1
You can request access to, correction of, or deletion of your personal information, and you can withdraw consent you have given (for example, to marketing email). If your organization needs to find the documents that concern a particular person, contact us and we will help locate them.
9.2
If your personal information appears in a document that one of our customers uploaded, that customer controls the document. We will refer your request to them and help them respond.
9.3
Send requests to [email protected]. We verify the requester and respond within the timelines required by applicable law.
9.4
If you are not satisfied with our response, you can complain to the privacy regulator where you live. In Canada, that is the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.
10. Marketing email
10.1
Marketing consent is separate from transactional email. For Canadian recipients we follow Canada's Anti-Spam Legislation (CASL) and rely on express consent; for US recipients we follow the CAN-SPAM Act. Every marketing message includes a working unsubscribe, honored promptly.
10.2
Transactional messages — verification results, billing notices, security alerts — are sent regardless of marketing preferences because the service requires them.
11. No sale of data
We do not sell or rent personal information, and we do not share it with third parties for their own advertising. There is no third-party advertising tracking on this site.
12. Children and students
DocoMatic is a service for organizations. It is not directed at children, and we do not knowingly collect personal information directly from children. Student information that appears in documents a school uploads is handled for that school under the Data Processing Agreement, including its terms for education records.
13. Changes and contact
13.1
We may update this policy. For a material change, we post the new version on this page and email account administrators at least 30 days before it takes effect, and we update the version and effective date at the top.
13.2
Privacy questions and requests: [email protected]. Postal address: Monocubed, Inc., 651 North Broad Street, Suite 206, Middletown, DE 19709, United States.