Privacy policy
Last updated: 1 October 2026
This is a translation of the Spanish original. In case of any discrepancy, the Spanish version prevails.
Draft: the details in square brackets are missing, and a lawyer must review it before it is published.
1. Who processes your data
[company name] (tax ID [tax ID], [registered address]), owner of Doconda. For any privacy question: contact@doconda.com.
We process personal data in two different roles:
- As controller, for the data of the people who use Doconda and of visitors to this website: this policy explains that processing.
- As processor, for the personal data customers include in their documents, files and artifacts. There the customer is in charge, and it is governed by the data processing agreement in the terms of use.
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account: email, name, organization, projects, role, sign-in (also with Google, GitHub or Microsoft) | Giving you access and providing the service | Contract (art. 6.1.b GDPR) |
| Usage: operations, pages, cost, dates, IP and technical logs | Billing, showing you your usage, security and abuse prevention, improving the service | Contract and legitimate interest (art. 6.1.f) |
| Billing: tax details, payments; of the card only the brand and last 4 digits (Stripe handles the rest) | Billing and meeting tax and accounting obligations | Contract and legal obligation (art. 6.1.c) |
| Communications: what you write to us | Replying and giving you support | Contract or legitimate interest |
We do not use document content to train artificial intelligence models, and we do not sell personal data. This website uses no analytics or advertising cookies.
3. How long we keep it
- Account data: while the account is active and, afterwards, for as long as needed to meet legal liabilities.
- Invoices and payment data: the periods required by law (in general, six years under Spanish commercial law).
- Document content: until the customer deletes it or closes the account. With
store: false, or in a project that stores nothing, it is deleted 15 minutes after finishing. Each document's events are deleted after 7 days. - Technical logs: [log retention period].
4. Who we share it with
With the providers that help us provide the service, as processors and under contract, and with the authorities when the law requires it:
- Google Cloud (Vertex AI): the AI models, in the project's region (EU, Frankfurt, or US).
- Amazon Web Services: file storage, job queues and dashboard sign-in, in the project's region (EU, Ireland, or US).
- API and database hosting: [provider and region].
- Stripe: payments, subscriptions and invoices (EU and US).
- Request interpretation: [TypeSafe or Vercel AI Gateway: provider and region], only where enabled.
- Brave Search: image search on the internet when a document asks for it; it only receives the search text (US).
We will give at least 30 days' notice before adding or changing one of these providers.
5. Where it is processed
Each project has a region, European Union or United States, chosen when it is created: its documents and AI calls are processed in that region. Some providers (for example, the payment provider) may process data outside the European Economic Area; in that case they do so with GDPR safeguards (an adequacy decision, such as the EU-US Data Privacy Framework, or standard contractual clauses).
6. Your rights
You can request access, rectification, erasure, objection, restriction and portability of your data, and withdraw consent if you gave it, by writing to contact@doconda.com. If the data is in a customer's document, we will refer you to that customer, who is the controller. If you are not satisfied, you can complain to the Spanish Data Protection Agency (aepd.es).
7. Security
Encryption in transit and at rest, isolation between organizations, API keys stored as a cryptographic hash and never in plain text, signed download links that expire, isolated execution without internet for the code the AI writes, and minimal team access.
8. Cookies
This website uses no cookies or tracking of any kind. The dashboard and the editor plugin store in your browser only what they need to work (your session, the selected project, the light or dark theme and the plugin's licence grant), which does not require consent. When you pay, Stripe uses its own cookies.
9. Changes
If we change this policy significantly, we will let you know by email or in the dashboard.