DocRoundupWho this notice covers
This notice covers people visiting DocRoundup, business account holders and their team members, and clients responding to requests. The business requesting documents decides what information it needs and how it uses that information for its own work. Contact that business about the contents or purpose of a particular request.
Information we handle
We handle account names, email addresses, authentication records, workspace membership, client contact details, request instructions, uploaded documents, written answers, messages, review decisions, signing fields and signing activity. We also handle support messages, subscription and payment status, and technical records needed to operate the service. Documents may contain personal or sensitive information; provide only what the requesting business needs.
How information is used
Information is used to create and secure accounts, verify client access, deliver requests and reminders, store and display submissions, support review and signing, manage subscriptions, answer support questions and investigate misuse or service problems. We do not sell client documents or use them for advertising.
Storage and service providers
The application and database are hosted with Hetzner in Germany. Uploaded documents and backups use private Cloudflare R2 storage. Resend delivers service emails; mailbox services are provided through Bluehost. Stripe processes subscription payments, and Cloudflare Turnstile checks contact submissions for abuse. These providers process the information needed for their roles under their own service terms. Payment-card details entered in Stripe are handled by Stripe; DocRoundup receives payment and subscription records rather than full card details. Providers may process information outside your country, where different laws may apply.
AI document processing
When AI checks are enabled, uploaded documents and requirement details are sent to Google’s paid Gemini API to check whether they match the request. Documents may contain personal or sensitive information. Google does not use paid API content to improve its products, but may temporarily retain it for abuse monitoring. AI suggestions can be wrong; the business makes the final review decision. Optional Gemini request logging is disabled. Google may process information outside your country. The requesting business is responsible for informing clients and obtaining any required permission before providing their information. Provider handling is governed by Google’s applicable paid-service terms.
Access and safeguards
Business access is checked against workspace membership. Client access is scoped to a request using a link and email verification. Files use private storage and authorized preview and download routes. HTTPS protects information in transit. Authorized administrators may access records when needed for support, security or service operation. No online service can guarantee that every risk is eliminated.
Technical diagnostics and contact protection
Technical diagnostics record page labels, action attempts, failures, timestamps and a temporary session identifier. Signed-in events can be associated with an account and workspace. Diagnostic events exclude form values, document contents, private links and credentials; this feature is not a screen recording. Contact messages include the name, email, topic and message you provide. Spam protection uses Cloudflare Turnstile and limited request counters, including a protected representation of the email address for rate limiting.
Optional website analytics
If you accept analytics cookies, Google Analytics measures visits to our public informational pages. We send public page paths without query strings or fragments, and do not send form contents, account identifiers, client documents or private request links. Google receives technical connection information when the tag loads. Advertising features are disabled. You can decline or withdraw through Cookie preferences on public pages. Google may process analytics information outside your country.
Retention and deletion
Workspace content is retained to provide the service, including earlier upload versions and review history. Account deletion includes a recovery period before permanent removal; the available period is shown when deletion is requested. Completed signing records can be held for review before permanent deletion. Backup copies are removed as backups rotate rather than immediately when an active record is deleted. Some records may need to be retained for security, payment, dispute or legal purposes. Contact us about a specific deletion request.
Your choices and questions
For access to, correction of or deletion of information in a client request, contact the requesting business first. For your DocRoundup account or other privacy concerns, use our Contact page and choose Privacy or security. We may ask you to verify your identity and authority before acting. You can ask about our handling of your information or raise a privacy complaint through the same channel.
Updates to this notice
The updated date identifies the current notice. Material changes to AI providers or processing practices will be disclosed, and additional permission will be requested where required.