Privacy Policy

1. Introduction

CreateDocs.ai LLC, a Wyoming limited liability company ("Company", "we", "us", or "our"), is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and how we protect it when you use our AI-powered document generation platform ("Service").

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address (or phone number, if registering by phone).
• Password (stored only as a cryptographic hash; we never store plaintext passwords).
• Organization name (optional, if you create a team workspace).
• OAuth profile data (name, email, and profile picture) if you sign in via GitHub or Google.

2.2 Payment Information

Payment processing is handled by Stripe. We do not store your credit card numbers, bank account details, or other sensitive payment information on our servers. Stripe provides us with limited information such as the last four digits of your card, card brand, expiration date, billing address, and transaction history. For details on how Stripe handles your data, see Stripe's Privacy Policy.

2.3 Document Content

We collect and store the content you create through the Service, including:

• Text, data, and other inputs you provide for document generation.
• Prompts and instructions you submit to AI features.
• AI-generated documents and outputs produced from your inputs.
• Templates you customize or create.

2.4 Usage Data

We automatically collect information about how you interact with the Service, including:

• Pages visited and features used.
• Number and types of documents generated.
• AI generation requests and feature adoption patterns.
• Session duration and frequency of use.

2.5 Device and Technical Information

We automatically collect technical information including:

• IP address.
• Browser type and version.
• Operating system and device type.
• Screen resolution and language preferences.
• Referring URLs and access timestamps.

2.6 Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookie Policy.

3. How We Use Your Data

We use the information we collect for the following purposes:

• Service delivery: To provide, operate, and maintain the Service, including AI-powered document generation, template management, and team features.
• AI processing: To process your inputs through AI models and generate documents (see Section 4 for details).
• Billing and payments: To process Subscription payments, one-time purchases, and manage your billing account through Stripe.
• Customer support: To respond to your inquiries, troubleshoot issues, and provide technical assistance.
• Analytics and improvement: To understand usage patterns, measure performance, identify issues, and improve the Service.
• Security: To detect, prevent, and respond to security incidents, fraud, abuse, and unauthorized access.
• Marketing (opt-in only): To send you product updates, tips, and promotional communications via Mautic, but only if you have explicitly opted in. You may unsubscribe at any time.
• Legal compliance: To comply with applicable laws, regulations, legal processes, and governmental requests.

4. ⚖️ AI Data Processing

Our Service uses artificial intelligence models to generate documents from your inputs. This section explains how your data is handled during AI processing.

4.1 How AI Processing Works

When you use our AI document generation features, your inputs (prompts, template variables, and instructions) are sent to AI language models for processing. We use a combination of self-hosted models (Ollama/vLLM) and Cloudflare AI to power document generation.

4.2 Data Handling During AI Processing

• No training on your data: Your inputs and generated outputs are not used to train, fine-tune, or improve AI models. Your data is used solely to fulfill your document generation request.
• Real-time processing: Inputs are processed in real-time and are not persistently retained by the AI processing infrastructure beyond what is needed to complete your request.
• Self-hosted models: Where we use self-hosted AI models (Ollama/vLLM), your data is processed on infrastructure we control and is not transmitted to third-party AI providers.
• Cloudflare AI: Where we use Cloudflare AI, processing is subject to Cloudflare's data handling practices and our data processing agreement with Cloudflare.

4.3 Your AI Data Choices

You control what data you submit for AI processing. Do not include sensitive personal information, confidential business data, or protected health information in AI prompts unless you understand and accept the processing described above.

5. Data Storage & Security

We implement robust security measures to protect your data:

• Database encryption: User data is stored in PostgreSQL (hosted by Neon) with encryption at rest.
• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS.
• File storage: Documents and generated files are stored in Cloudflare R2 with encryption at rest and in transit.
• Tenant isolation: Our multi-tenant architecture ensures that each organization's data is logically isolated from other tenants. Users in one organization cannot access another organization's data.
• Access controls: Role-based access controls limit who within your organization can access your data.
• Incident response: We maintain incident response procedures and will notify affected users within 72 hours of a confirmed data breach.

6. Third-Party Services

We use the following third-party services to operate the Service. Each service may process your data as described below:

• Stripe (payments): Processes payment information, manages subscriptions, and handles billing. Stripe Privacy Policy.
• Cloudflare (hosting, R2 storage, Turnstile bot protection): Hosts our application, stores files, and provides security services. Cloudflare Privacy Policy.
• Neon (PostgreSQL database): Hosts our database infrastructure. Neon Privacy Policy.
• Mautic (marketing automation): Manages marketing email communications for users who have opted in. Self-hosted instance.
• GitHub / Google (OAuth authentication): Provides sign-in functionality. We receive only basic profile information (name, email) that you authorize during the OAuth flow.

7. Data Sharing & Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

• Service providers: With the third-party vendors listed in Section 6, solely to operate the Service.
• Team members: With other users in your Tenant/organization, as determined by your role-based access control settings.
• Legal requirements: When required by law, court order, subpoena, or governmental request.
• Safety and rights: To protect the rights, property, or safety of CreateDocs.ai, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.

8. Data Retention

• Active accounts: Your account data and Content are retained for as long as your account remains active.
• Deleted accounts: After you delete your account, we retain your data for 30 days to allow for recovery or data export requests. After 30 days, your data is permanently deleted.
• Billing records: Payment and transaction records are retained for 7 years as required by tax and financial regulations.
• Usage logs: Aggregated usage analytics are retained for up to 90 days. Identifiable log data is retained for 30 days.

9. Your Rights

9.1 GDPR Rights (European Union)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to data portability: Request a copy of your data in a structured, machine-readable format.
• Right to restriction: Request restriction of processing of your personal data.
• Right to object: Object to processing of your personal data for specific purposes, including profiling.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

9.2 CCPA Rights (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know: Request disclosure of the categories and specific pieces of personal information collected about you.
• Right to delete: Request deletion of your personal information.
• Right to opt-out of sale: We do not sell your personal information. No opt-out is necessary.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

9.3 Rights for All Users

Regardless of your location, all users of our Service can:

• Export your data: Request a machine-readable export of your account data and documents through your account settings or by contacting us.
• Delete your account: Permanently delete your account and all associated data through your account settings.
• Opt out of marketing: Unsubscribe from marketing communications at any time using the unsubscribe link in any marketing email or through your account settings.
• Update your information: Access and update your account information through your account settings.

To exercise any of these rights, contact us at support@createdocs.ai. We will respond within 30 days (or sooner where required by law).

10. Cookies

We use cookies and similar technologies to operate the Service, remember your preferences, and understand how you use the Service. For complete details on the cookies we use, how to manage them, and your choices, please see our Cookie Policy.

11. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected data from a child under 18, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us at support@createdocs.ai.

12. International Transfers

Your data may be processed in the United States and other countries where our service providers operate. Cloudflare's global network means that certain data (such as cached content and security checks) may be processed at edge locations worldwide.

For transfers of personal data from the EEA, UK, or Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Data Processing Agreements with all sub-processors.
• Applicable data privacy framework certifications where available.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (to the address associated with your account) at least 30 days before the changes take effect. Non-material changes may take effect immediately upon posting. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

14. Contact

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your rights, please contact us:

CreateDocs.ai LLC
Email: support@createdocs.ai
Data Protection Officer: dpo@createdocs.ai
State of Formation: Wyoming, United States