Privacy Policy

DOCUMENTFORGE ("DOCUMENTFORGE", "we", "us", "our") is a document processing utility platform operated as a Sole Proprietorship in India.

Principal place of business: [OWNER: Business address not set]

For privacy-related enquiries or data requests, contact: privacy@documentforge.tech

2.1 Account Data (registered users only)

• Email address — used to authenticate your account and communicate essential service notices.
• Display name — used to identify your profile within the account interface.
• Hashed password — stored as a salted, one-way scrypt hash; plaintext passwords are never saved.
• Account lifecycle timestamps (creation date, last login date, last seen date).
• Current plan tier (FREE or PRO) and account status.

2.2 Uploaded Documents

• Files you upload are placed in dedicated temporary directories on our processing server filesystem strictly for the duration required to execute the job and the retention window defined below. Files are never transferred to external cloud storage buckets.
• We store document metadata in the database (original filename, sanitized filename, file size, MIME type, tool slug) for quota tracking, job status polling, and error diagnostic logs.

2.3 Usage & Quota Records

• Daily and monthly job counts, tracked to enforce fair usage quotas.
• Bytes processed per operation, recorded for bandwidth rate limits.
• Tool identifiers, processing duration, and status codes (COMPLETED, FAILED, EXPIRED).

2.4 Session and Technical Information

• Authenticated session tokens (HttpOnly cookie) — required to keep you signed in.
• Anonymous session identifier (HttpOnly cookie) — randomly generated string used to associate jobs and quota for unauthenticated users, enabling job claiming upon registration.
• IP address and User-Agent headers — captured in session logs and rate-limiting counters to protect against credential stuffing and brute-force attacks.

2.5 Billing Records

• Payments are managed by Cashfree Payments India Pvt. Ltd.. We do not collect or store card numbers, expiration dates, CVVs, or bank credentials on our infrastructure.
• We store subscription status (ACTIVE, CANCELLED), subscription identifiers, and period timestamps received via Cashfree webhooks to determine your entitlement level.

2.6 Data We Do NOT Collect

• We do not load third-party analytics trackers (such as Google Analytics, Mixpanel, or Meta Pixel).
• We do not deploy marketing cookies, remarketing scripts, or behavioral profiling mechanisms.
• We do not harvest phone numbers or physical mailing addresses through the document processing interface.

File retention periods are enforced according to your account entitlement tier:

Upon job creation, an expiration timestamp is set. When accessing or downloading a job, the server checks the timestamp; expired jobs are marked EXPIRED and access is refused. Both input files and generated output artifacts are permanently wiped from the local filesystem during retention cleanup.

User Responsibility: Please download and verify your processed files promptly upon completion. Once deleted, file contents cannot be recovered.

DOCUMENTFORGE uses exactly two first-party cookies, both of which are strictly necessary:

We do not set tracking, analytics, or advertising cookies. Detailed information is available in our Cookie Policy.

We do not sell personal data. We disclose information only to the following necessary recipients:

• Cashfree Payments India Pvt. Ltd. — when initiating a Pro subscription, your customer identifier and email are communicated to Cashfree to generate the subscription session. Transactions are governed by Cashfree's Terms and Privacy Policy.
• Statutory & Law Enforcement: We may disclose data if strictly required pursuant to valid legal orders or summons from competent judicial or governmental authorities under Indian law.

We implement administrative and technical safeguards designed to protect personal data and documents from unauthorized access or disclosure:

• Transport encryption via HTTPS/TLS across all public routes and APIs.
• Scrypt password hashing (N=32768, r=8, p=1) with cryptographically random salts.
• Server-side authorization checks verifying user ownership before file downloads.
• Magic byte verification, input validation, and path traversal protections.
• Sliding-window IP rate limiting protecting authentication endpoints.

For complete technical details, see our Security Architecture page.

DOCUMENTFORGE is designed to handle personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025.

Note on implementation: The DPDP Act 2023 and its associated rules operate under phased commencement. Our systems, disclosures, and response protocols will continue to adapt as specific statutory provisions, rules, and regulatory standards become operational.

Your Rights as a Data Principal:

• Right to Information: The right to obtain a summary of personal data being processed and the processing activities undertaken.
• Right to Correction & Updating: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: The right to request deletion of your personal data, subject to legal, tax, or fraud-prevention retention requirements.
• Right of Nomination: The right to designate a nominee to exercise rights in the event of death or incapacity.
• Grievance Redressal: The right to readily available grievance redressal mechanisms regarding personal data obligations.

To exercise any of these rights, please write to privacy@documentforge.tech.

⚠️ Account deletion: Self-service account deletion is not yet available in the UI. To request deletion of your account and associated records, email our support team. We process verified deletion requests within 30 days.

DOCUMENTFORGE provides customer support and complaint contacts for service, account, billing, privacy, and security concerns.

We aim to acknowledge complaints within 7 calendar days of receiving them. We will review and address complaints as promptly as reasonably practicable, taking into account the nature and complexity of the matter, the information required, and any relevant third-party or technical dependencies. Where a matter cannot be resolved promptly, we will provide an appropriate status update and any material next steps.

• Contact: Customer Complaints Desk
• Email: support@documentforge.tech

We may update this policy as our services evolve or as statutory provisions under the DPDP Act and DPDP Rules take effect. The "Effective date" at the top of this notice reflects the latest revision. Continued use of the platform after updates signifies acknowledgement of the revised practices.

For questions or assistance regarding personal data handling:

• Privacy Email: privacy@documentforge.tech
• General Support: support@documentforge.tech
• Principal Address: [OWNER: Business address not set]