1. What this policy covers
This policy covers the DocuMind AI web application, dashboard, chat widget, and public marketing pages ("the Service"). It does not cover third-party websites that embed the widget — those sites have their own privacy notices.
2. Data we collect
When you create an account or use the dashboard we collect:
- Account data: email address and authentication identifiers.
- Workspace content you upload: PDFs, URLs, extracted text, and vector embeddings derived from them.
- Configuration: assistant name, system prompt, appearance settings, widget domain allowlist.
- Usage data: chat logs, message counts, cache hits, leads captured through the widget, and basic technical metadata (timestamps, coarse IP-derived rate-limit signals).
When a visitor uses a widget embedded on a customer's site we may receive:
- Chat messages the visitor sends and the AI replies.
- Any name, email, company, or phone the visitor voluntarily enters or that the AI extracts from the conversation as a lead.
- IP-based rate-limiting signals (used transiently, not stored as a profile).
3. Why we process it
- To provide the Service (indexing documents, answering questions, storing chat history for the workspace owner).
- To secure the Service (rate limiting, abuse prevention, audit logs).
- To operate the account (billing, support, service notices).
- To improve reliability (aggregate error and performance monitoring).
We do not sell personal data. We do not use your uploaded documents or chat logs to train foundation models.
4. Legal bases (GDPR / UK GDPR)
- Performance of a contract — to deliver the Service you signed up for.
- Legitimate interests — security, abuse prevention, product analytics.
- Consent — where required for optional features (e.g. voice input).
- Legal obligation — where laws require us to retain or disclose data.
5. Sub-processors
We use the following processors to run the Service:
- Lovable Cloud (managed hosting, database, authentication, storage).
- Cloudflare (edge network and DNS).
- AI model providers accessed through the Lovable AI Gateway for chat completions, embeddings, and optional speech features.
- Resend (transactional email delivery — used for human-handoff alerts from the widget and for early-access / contact form notifications sent to the operator).
- VirusTotal (file-hash lookup used to screen uploaded documents for known malware; only a SHA-256 hash of the file is sent, not the file itself).
We use these providers under their standard data-processing terms. A current list is available on request at daniyal@agenticcore.tech.
6. International transfers
DocuMind AI is operated from Pakistan and hosted on infrastructure that may process data outside the EEA / UK. Where we transfer personal data from the EEA or UK we rely on the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism through our sub-processors.
7. Retention
- Account data — kept while your account is active and up to 90 days after deletion for backups and dispute resolution.
- Uploaded documents and embeddings — kept until you delete them from your workspace.
- Chat logs and leads — kept until you delete them or delete the workspace.
- Security logs — up to 12 months.
8. Your rights
If you are in the EEA, UK, or a similar jurisdiction you have rights of access, rectification, erasure, restriction, portability, and objection. Most of these can be exercised directly from your dashboard (delete documents, delete chats, delete account). For anything else, email daniyal@agenticcore.tech and we will respond within 30 days.
9. Cookies
The dashboard uses a small number of first-party cookies and local-storage entries strictly required to keep you signed in and remember your theme preference. We do not use third-party advertising cookies.
10. Children
The Service is not directed to children under 16 and we do not knowingly collect their data.
11. Changes
We may update this policy from time to time. Material changes will be announced in-app or by email at least 14 days before they take effect.
12. Contact
Questions or requests: daniyal@agenticcore.tech.