Privacy Policy

This policy describes data processing on the Doc Guard website and application, available at docguard.app. Our contact for privacy matters and data subject requests is info@docguard.app.

Doc Guard determines the purposes and means of processing data needed for accounts, service operation and billing. If you use the platform on behalf of an organization, that organization is responsible for determining the purpose and legal basis for processing third-party data in the documents it chooses to analyze. Doc Guard processes analysis records to provide the requested service, not for its own advertising purposes.

We do not store original files submitted for analysis or complete images. Access to file content is necessary to perform the inspection. Storage is limited to the history records and evidence described below; Doc Guard is not a document storage or backup service.

To let you track results, history records the file name, format, size, date, analysis status, findings, finding locations and reading limitations.

History may also contain limited excerpts of detected evidence and the context needed to interpret it, including text from images or metadata. These excerpts are stored encrypted. In a very short document, an evidence excerpt may cover all its text. File names and excerpts may contain personal data; encryption does not make them anonymous.

We do not use documents or history excerpts to train AI models, sell datasets or target advertising. You remain responsible for keeping the original file.

• Account and access: email, account identifier, workspace name, registration and update dates, email confirmation and authentication records. Your password is protected by the authentication service; it is not stored as readable text in your history.
• Google sign-in, if you choose this option: Google account identifier, confirmed email and basic profile information such as name and photo, received by the authentication service to identify your account. We do not request access to Gmail, Google Drive or documents in your Google account.
• Detection history: the data and excerpts described in the previous section, associated with your account.
• Plan usage: subscribed plan, number of documents analyzed, analysis reservations and usage period, to enforce service limits.
• Subscription and billing: customer and subscription identifiers, plan, amounts, currency, dates, payment status, invoices and events needed for reconciliation. Card details are provided in Stripe's environment. Doc Guard does not receive or store the full card number or security code.
• Operation and security: session cookies and technical records that may include IP address, date and time, browser, requests and errors, depending on hosting and authentication infrastructure logs.
• Support: contact address and content you voluntarily send to resolve a request. Avoid sending complete documents, passwords or card details by email.

We process account, history and subscription data to perform the service you contracted or requested, including the free plan (Article 7(V) of Brazil's LGPD). Data required for tax, accounting or other legal obligations is processed under Article 7(II).

Security and abuse-prevention controls may rely on legitimate interests, limited to what is necessary and respecting your rights (Articles 7(IX) and 10). Records needed for legal proceedings may be processed for the regular exercise of rights (Article 7(VI)).

Reading this policy is not blanket authorization for any use of your data. If a new purpose requires consent, it must be requested specifically, with the option to withdraw it.

Only analyze files you can lawfully access and are authorized to process for the intended purpose. Minimize or remove personal data that is unnecessary for analysis, especially sensitive information, children's and adolescents' data and third-party confidential information.

The service does not require sensitive personal data to create an account. If present in a document, it may appear in history evidence. Authorization to process such data depends on specific legal grounds under the LGPD; accepting the Terms of Use does not replace the required legal basis.

We use providers to deliver the service, with access limited to their role:

• Supabase: authentication, history database and server functions.
• Google: authentication when you choose to continue with your Google account.
• Vercel: hosting for the website, application and server routes, and aggregate browsing statistics through Vercel Web Analytics.
• Resend: sending confirmation emails, account recovery emails and security notices. It receives the email address and content needed for the message, without documents or analysis reports.
• Stripe: checkout, subscriptions, payments, billing portal and fraud prevention. Stripe may also act as an independent controller for its own legal and security obligations.

We do not sell your data or share history for advertising. Information may also be provided when required by law, a valid authority order or the regular exercise of rights, subject to applicable limits.

These providers may process data outside Brazil. International transfers must comply with the LGPD and ANPD regulations, using the appropriate legal mechanism. You can request information about applicable countries, recipients and safeguards through our privacy contact.

See also the policies of Supabase, Google, Vercel e Stripe.

We keep your language preference in an essential cookie for up to 180 days. When you change it in Settings, we also save it to your account. This does not change your subscription currency.

We use cookies and session features needed to authenticate you, maintain access and protect your account. This version of the website does not include behavioral advertising tools or marketing trackers.

If you allow analytics in the cookie notice, we use Vercel Web Analytics to understand page usage and improve the service, with aggregate statistics on visits, devices, browsers and approximate location. The tool does not use cookies for this measurement. We do not send names, emails, documents, detected excerpts or report identifiers in browsing events. URL parameters are removed, and confirmation and account recovery pages are excluded. Learn more in the Vercel Web Analytics privacy documentation .

Analytics remain disabled until you choose “Allow analytics”. You can choose “Essential only” and continue using the service. To change or withdraw permission, open “Cookie preferences” in the website footer. The change stops new events; it does not erase aggregate statistics already received.

Your choice is saved in this browser's local storage for up to 180 days, without personal identifiers or document data. If you clear that storage, change browsers or the period expires, the notice appears again. If the browser blocks storage, your choice applies only while the page remains open.

You can remove or block cookies in your browser settings. Blocking necessary cookies may prevent sign-in and access to restricted areas. Stripe checkout is also governed by that provider's privacy rules and information.

History remains associated with your account for reference until you delete it or request its deletion. In Settings, the Delete history option removes reports and excerpts from the active database. Original files do not need to be deleted from the service because they are not stored.

Deleting history does not close your account, cancel your subscription or reset plan usage. Account, usage and billing data continue to serve their respective purposes. To close your account or request deletion of other data, email info@docguard.app.

Once the purpose ends, data must be deleted or anonymized, except where retention is legally permitted. Tax, billing, security and legal-defense records may have their own retention periods based on applicable obligations and deadlines; they should not be kept indefinitely without justification.

Removal from the active database does not mean instant deletion from backups or records retained by law. Backups follow the provider's retention cycle and restricted access. When responding to a request, we will explain any data retained, the reason and the retention period or criteria.

We use HTTPS, authentication, per-user access rules, server-side validation and encryption of saved excerpts. History is not public. Operational access must be limited to authorized people and providers who need it to support, protect or maintain the service.

No system eliminates every risk. If an incident requiring notification occurs, affected data subjects and the ANPD must be informed under applicable legal requirements and deadlines. Use a unique password and report suspected unauthorized access to support.

You may request the following free of charge, within the limits and conditions of the LGPD:

• Confirmation of processing, access to and correction of your data.
• Anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data.
• Portability, subject to regulations and commercial and industrial secrets.
• Information about sharing, consent, the consequences of refusal and withdrawal of consent when it is the applicable legal basis.
• Deletion of data processed with consent, subject to legal retention exceptions, and objection to unlawful processing based on another legal ground.
• Review of solely automated decisions affecting your interests, where applicable. Detection reports provide signals for your review; they do not make decisions about people on your behalf.

Send your request to info@docguard.app, preferably from your account email. We may request proportionate identity verification to protect your data. Do not send your password. Confirmation and access requests are answered immediately in simplified form or through a complete statement within 15 days, under Article 19 of the LGPD.

If a legal or technical impediment exists, we will explain why. You may also petition the ANPD and contact consumer protection authorities where applicable.

Changes will be published on this page with the new version date. Material changes to purposes, sharing or rights will be prominently communicated; where new consent is legally required, it will be requested before the corresponding processing.

This policy should be read together with the Terms of Use. References: Brazilian General Data Protection Law (LGPD) e ANPD guidance on data subject rights .