DocRoundupStatus and scope
This is a draft for the local development preview, not a finalized notice for a live hosted service. The legal operator, privacy contact and production processing arrangements must be identified before publication.
Information in a workspace
The application handles business account details, workspace membership, client names and email addresses, request instructions, uploaded documents, written answers, messages, review decisions and activity records. The requesting business chooses what it asks clients to provide.
Why the information is used
These records support authentication, request access, document collection, review, conversation and activity history. Provide only the information needed for the request. Do not upload real confidential client material to this development preview.
Technical diagnostics
To investigate problems, the application records safe page labels, API action attempts, failures, timestamps and a temporary diagnostic session identifier. Signed-in events can be associated with the account and workspace. Super Admin can inspect these records. Diagnostic events exclude form values, document contents, private links, passwords and raw browser error messages. This is not a screen recording or session replay. Log retention is configurable and requires scheduled cleanup.
Access and storage
Business access is scoped to a workspace. Client access is scoped to a request through a link and verification. The current application stores records in its dedicated local database and uploads privately on the host computer. Production location, transfer arrangements and backup access are not yet specified.
AI document processing
When AI checks are enabled, uploaded documents and requirement details are sent to Google’s paid Gemini API to check whether they match the request. Documents may contain personal or sensitive information. Google does not use paid API content to improve its products, but may temporarily retain it for abuse monitoring. AI suggestions can be wrong; the business makes the final review decision. We keep optional Gemini request logging disabled and do not opt into sharing document content for model improvement. Google may process information outside your country. The requesting business is responsible for informing clients and obtaining any required permission before providing their information. Provider handling is governed by Google’s applicable paid-service terms.
Retention and deletion
No final retention period or customer deletion service has been approved. Previous upload versions are retained by the local workflow. Document, message, verification and backup retention rules must be defined and implemented before a real pilot.
Access, correction and questions
For a document request, contact the business that requested the information. A product privacy contact and a verified process for access, correction and deletion requests must be configured before launch. Do not assume that sending a request guarantees immediate deletion of all copies.
Before this notice is published
Confirm the legal operator and privacy contact, the applicable jurisdictions, each processing purpose, service providers, storage locations, retention periods and the procedure for privacy requests. Review this text against the actual production service.