Privacy policy
Last updated: 18 October 2026
Who we are
DocuStride is an independent service, currently run by its founder as a private project; no company has been registered yet. When a company is registered, it will take over the service and these documents, and we will tell you by email. Contact: support@docustride.com.
For the data about your account, we decide how it is used (we are the controller). For the documents your DocuWare workflows send to the service, you decide, and we only process them on your behalf (we are your processor, see section 8 of the terms).
What we process and why
| Data | Why | How long |
|---|---|---|
| Documents your DocuWare workflows send (PDFs, scans and images) | To add the QR code, watermark or microtext you asked for and save the result back to DocuWare. | Not stored. Processed in memory and discarded as soon as the new version is saved in DocuWare. |
| Account data: name, email address, password (only as a salted one-way hash), two-step verification (an encrypted secret and one-way codes for the recovery codes), sign-in times, and your settings | To let you sign in securely and manage your account. | Until you delete your account. |
| DocuWare connection: your DocuWare address, the App Registration's client ID, its client secret and a refresh token (both encrypted) | To read and save documents on your instruction. We never see or store your DocuWare password. | Until you disconnect or delete your account. |
| API key | To recognise calls from your DocuWare workflows. | Only a fingerprint (hash) is stored; the key itself is shown once. |
| Transaction log: time, duration and outcome of each call, document ID and version, file sizes, the names of the fields sent (never their values), the calling program and its IP address | To show you your activity and usage, to apply plan limits, and to find and fix problems. | 90 days. |
| Usage counters per month and service | Plan limits and your usage reports. | Until you delete your account. |
| Security log: sign-ins and failed attempts, password, API key and two-step changes, blocked requests and unknown API keys, each with time, the email address entered, IP address and browser | To protect accounts, detect and stop attacks such as password guessing, and investigate incidents. | 180 days, also after an account is deleted. |
| Account history: what changed in your account and when (plan, connection, settings), including changes our team made | To answer questions and settle disagreements about what happened. | 2 years, also after an account is deleted. |
| Support requests and website messages: name, email, your messages and our answers, and any screenshots or files you attach | To answer your questions and fix problems. | Conversations: 2 years after the last message. Attachments: 90 days after the request is closed. Deleted with your account. |
| Notes our team keeps about your account (for example a summary of a support call) | To help you consistently. | Until you delete your account. |
| Feedback, ratings and feature requests, votes, beta missions and tutorial progress | To improve DocuStride and decide what to build next. Other customers see an idea, never who suggested or voted for it. | Until you delete your account; ratings and ideas are then kept without your name or email. |
| Plan requests and waiting lists (for example "tell me when Enterprise or on-premises is ready") | To handle your request and contact you when something is ready. | Until you remove yourself or delete your account. |
| Invitations: the email address of a colleague you invite, when, and whether they created an account | To send one invitation in your name, never twice to the same person (legitimate interest). The invitation says who sent it and has a link to block further invitations; then only a one-way code of the address is kept. | Until you delete your account; the one-way code of a blocked address is kept so the block lasts. |
| Email preferences and consent: tips and reminders on or off, whether you agreed to product news (and when), when you accepted which version of our terms, and which emails we sent you (time, subject, delivery result and the details filled into it; personal links such as password-reset links are never kept) | To respect your choices, to show that you agreed (consent, Art. 6(1)(a) GDPR, for product news), and to answer "I never got the email". | Until you delete your account; the list of emails sent: 12 months. |
| Record of a deleted account: one-way codes of the email address and DocuWare address, the plan history and the number of transactions per month. No name, email address, content or keys. | To recognise an account that is deleted and created again, and to prevent misuse of free allowances (legitimate interest). | 24 months after the account is deleted. |
| Website statistics: per day, how many people opened which public pages, the website or campaign that sent them, their country and the type of device | To see how people find the website and improve it (legitimate interest). No cookie, no script, and no IP address is stored for this: to count each visitor once a day, the IP address and browser are turned into a one-way code with a secret that changes every day and is kept only in memory, so it cannot identify you. | The daily counts: 2 years. The one-way codes: never stored, gone the next day. |
| Technical logs of the web servers and of Cloudflare: addresses requested, time, IP address and browser | To keep the service running and investigate errors and attacks. | Up to 30 days. |
| Backups of the database | To restore the service after a failure. | 7 days, then overwritten; deleted data disappears from them within that time. |
Legal bases (GDPR): performing our contract with you (Art. 6(1)(b)), our legitimate interest in running a secure, reliable service and preventing misuse (Art. 6(1)(f)), your consent where we ask for it (Art. 6(1)(a)), and legal obligations (Art. 6(1)(c)). We do not use your data for automated decisions about you, and we do not sell it.
Cookies and storage in your browser
We use only what the service needs to work, so there is no cookie banner: a cookie that keeps you signed in, one that protects forms against forgery, a short-lived one while you connect DocuWare (and, if you sign in with Microsoft, Microsoft's short-lived sign-in cookies). Your browser also remembers a few choices you make on the site (light or dark mode, the menu, the Live/Test switch in the designers, and a closed notice) on your own device. There are no advertising, analytics or tracking cookies.
Where your data is kept and who helps us
The service runs on Microsoft Azure in the EU: hosting, database, encryption keys and email delivery (Azure Communication Services). Cloudflare protects the website against attacks and delivers it: your connection passes through Cloudflare's network, usually a data centre near you, which sees what passes through (including your IP address) but keeps only short security logs. Microsoft and Cloudflare are our sub-processors and work under their data processing terms, including the EU Standard Contractual Clauses. If you sign in with Microsoft, Microsoft confirms your identity to us; we receive your name, email address and an account ID.
We run and support the service from outside the EU, currently from the United Arab Emirates, so we access the data there when we look after the service or answer your questions. We protect it the same way wherever we work, and we only access what the task needs. We do not share your data with anyone else, except where the law requires it.
Security
All connections use HTTPS. Secrets are encrypted before they are saved, with keys that are themselves locked by a separate key in Azure Key Vault. Passwords are hashed, API keys are stored as fingerprints, accounts are locked after repeated failed sign-ins, two-step verification is available to everyone (and required for our team), and the database is reached without any stored password. If a breach affects your personal data, we tell you without undue delay.
Your rights
You can ask for access to, correction or deletion of your data, ask us to restrict or stop processing it, object to processing based on legitimate interest, withdraw a consent at any time, and receive your data in a portable format. Most of this you can do yourself under Settings, where you can also download a copy of your data (Your data) and delete your account. For anything else, write to support@docustride.com. You can also complain to the data protection authority where you live or work.
Changes
If we change this policy in a way that affects how your data is used, we tell you by email before the change applies, at least 30 days before if it reduces your rights.