Privacy Policy

Last updated: August 23, 2026

DocuSearch AI ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data Controller

The data controller responsible for the personal data processed through the Service is:

• Iassonas Georgakopoulos, sole trader (entrepreneur individuel), trading as DocuSearch
• Registered address: 51 Grande Rue de la Guillotière, 69007 Lyon, France
• SIREN 101 996 049 · SIRET 101 996 049 00017 · registered with the French Registre National des Entreprises (RNE) on 4 March 2026
• VAT not applicable: franchise en base de TVA, Article 293 B of the French General Tax Code (CGI)

For data protection inquiries, contact us at privacy@docusearch.eu. Our full legal notice is set out in our Terms of Service.

2. Data We Collect

2.1 Account Data

• Email address: used for authentication, communication, and account recovery
• Password: stored as a secure bcrypt hash; we never store or have access to your plain-text password
• First and last name: collected during profile completion
• Primary use case: an optional answer (Receipts & invoices, Contracts, Research / reports, Other) collected during signup so we can tailor the onboarding experience
• Account creation date

2.2 Uploaded Documents

• Documents you upload for OCR processing (PDFs, images, Word files)
• OCR output (markdown text and extracted images)
• Document embeddings stored in our vector database for search functionality

2.3 Usage Data

• Pages processed, queries made, and features used
• Subscription plan and billing history
• Chat conversations with the AI assistant (saved to your account so you can revisit them; you can delete any conversation at any time)

2.4 Technical Data

• Browser type and version
• IP address (server logs)
• Access timestamps

3. How We Use Your Data

Purpose	Legal Basis (GDPR)
Provide OCR, embedding, and chat services	Performance of contract (Art. 6(1)(b))
Account authentication and security	Performance of contract (Art. 6(1)(b))
Send transactional emails (verification, password reset, receipts)	Performance of contract (Art. 6(1)(b))
Send usage alerts and service notifications	Legitimate interest (Art. 6(1)(f))
Send a small number of onboarding and feedback emails in the first days after you sign up (help getting started, and one short survey if you stop using the Service)	Legitimate interest (Art. 6(1)(f)) - you can opt out at any time via the unsubscribe link in any such email
Send product updates, tips and offers by email	Consent (Art. 6(1)(a)) - only if you ticked the optional box at sign-up; withdrawable at any time
Usage tracking and billing	Performance of contract (Art. 6(1)(b))
Service improvement and debugging	Legitimate interest (Art. 6(1)(f))
Legal compliance	Legal obligation (Art. 6(1)(c))

4. Third-Party Services

We use the following third-party services to provide the Service:

Service	Purpose	Data Shared	Location
Microsoft Azure	Cloud hosting (application, database, document & file storage)	All account data, uploaded documents & OCR output	France Central (EU)
Mistral AI	OCR processing, embeddings, AI chat	Document content	France (EU)
Qdrant	Vector database for document search	Embeddings & metadata	France (EU)
Stripe	Payment processing	Email, payment method	EU processing
Resend	Transactional email delivery	Email address, email content	US (SCCs)
Dropbox (optional)	Cloud file import (user-initiated)	OAuth tokens, file access	US (SCCs)
Google (optional)	Sign-in, only if you use “Continue with Google”	Email, basic profile	US (SCCs)
Google Ads & Google Analytics (consent-based)	Measuring which adverts lead to sign-ups, and how the website is used	Only with your consent: a cookie identifier, pages viewed, and whether you signed up or subscribed. Never your documents, their content, or your email address	US (SCCs)

Each third-party service processes data according to their own privacy policies. We only share the minimum data necessary for each service to function.

Team workspaces. If you join a team (Business) workspace, content you place in or explicitly share with that workspace (including any Dropbox folder you choose to “share with the team”) becomes visible to other members of that workspace who have access to the relevant folder. Content you keep private (your personal storage and any Dropbox folder you have not shared) is never visible to other members, including workspace administrators. Sharing is always an explicit action on your part; connecting Dropbox never shares anything automatically.

5. Data Retention

• Account data: Retained while your account is active. When you delete your account it is scheduled for erasure but retained for 30 days first, during which you can restore it by logging back in; after 30 days it is permanently deleted.
• Uploaded documents and OCR output: Stored until you delete them or close your account
• Document embeddings: Stored until you delete the file or folder, or close your account
• Usage logs: Retained for 12 months for billing and support purposes
• Server logs: Retained for 90 days
• Chat conversations: Saved to your account until you delete the conversation or close your account. Included in your data export and erased when you delete your account.

6. Your Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): Request a copy of all personal data we hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to Data Portability (Art. 20): Request your data in a structured, machine-readable format. You can download a complete copy of your account at any time from Account → Export my data. To keep this sustainable we pace how often a full copy can be downloaded: you can always export your entire library at least once every 30 days. Your data is never removed or withheld by this limit — it only spaces out repeat downloads.
• Right to Restrict Processing (Art. 18): Request limitation of processing in certain circumstances
• Right to Object (Art. 21): Object to processing based on legitimate interest
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at privacy@docusearch.eu. We will respond within 30 days.

6.1 Email preferences

Every onboarding, feedback and product email we send carries an unsubscribe link, and supports your mail provider's own one-click unsubscribe control. Using either takes effect immediately and permanently: it records an objection under Art. 21 and withdraws any marketing consent you previously gave. No further onboarding, feedback or marketing email will be sent to you.

Essential account emails - email verification, password reset, billing receipts, payment failures and security notices - are not covered by the unsubscribe link. These are necessary to perform our contract with you and to keep your account secure, and cannot be switched off while the account remains open. Deleting your account stops them.

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Passwords are hashed using bcrypt with salt
• Authentication via JWT tokens with limited expiry
• User data is isolated; each user can only access their own documents and folders
• Database access is restricted to the application layer
• Third-party API keys are stored as environment variables, not in code

8. Cookies and Local Storage

Strictly necessary storage. The Service uses browser localStorage to store:

• Your authentication token (for maintaining your login session)
• Your email address (for display purposes)
• Your interface preferences (language, light/dark theme) and your cookie choice

This data is stored locally on your device, is required for the Service to work, and is not transmitted to third parties. You can clear it at any time by logging out or clearing your browser storage.

Advertising and analytics cookies (optional, consent-based). We advertise the Service through Google Ads. To know which adverts actually lead to sign-ups, we use Google Ads conversion tracking and Google Analytics. These set cookies in your browser and are disabled by default.

• On your first visit you are asked to choose. Nothing is set unless you select “Accept all”; “Essentials only” is equally easy to choose and is the default state until you decide.
• Until (and unless) you consent, we use Google Consent Mode v2 with all advertising and analytics storage set to denied. Google receives only anonymous, cookieless signals with advertising identifiers redacted.
• If you consent, Google may receive: the pages you viewed, a randomly generated cookie identifier, and the fact that a sign-up or subscription occurred (including the subscription amount, so we can measure advertising return).
• Google never receives your documents, their content, your search queries, your chat messages, or your email address.
• To withdraw consent, clear your browser storage for this site (or use your browser’s “delete cookies for this site” option). The banner will appear again and you can choose “Essentials only”.

The lawful basis for these cookies is your consent (Art. 6(1)(a) GDPR and the ePrivacy Directive), which you may withdraw at any time.

9. International Data Transfers

All core data processing occurs within the European Union. Our application is hosted on Azure France Central. Our AI provider (Mistral AI) and vector database (Qdrant) are both hosted in France. Transactional email delivery via Resend may involve processing outside the EEA; where such transfers occur, Standard Contractual Clauses (SCCs) apply. Dropbox file imports are user-initiated and subject to Dropbox's own data processing terms. If you consent to advertising and analytics cookies, Google may process the associated data outside the EEA under Standard Contractual Clauses; declining leaves your data unaffected. For full details, see our Security & Compliance page.

10. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the Service at least 30 days before taking effect. The "Last updated" date at the top indicates when the policy was last revised.

12. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.

13. Contact

For privacy-related questions or to exercise your data rights:

• Email: privacy@docusearch.eu
• General support: support@docusearch.eu