Privacy Policy

1. Data controller

Doxalio International LLC, a Wyoming (USA) company, is the controller of your personal data in accordance with the General Data Protection Regulation (GDPR — EU 2016/679), applicable whenever the service is offered to individuals located in the European Union.

DPO contact: contact@doxalio.com

2. Data we collect

We collect the following data:

• User account — Email and password (stored hashed, never in plain text) when you create an account
• Billing data — Stripe customer/ subscription identifiers linked to your account (see article 4 for how payment details themselves are handled)
• Uploaded documents — PDF files uploaded to the platform, stored encrypted on AWS S3, along with the extracted (OCR) text and the structured accounting data (amounts, VAT, vendor…) derived from them
• Connections to your accounting software — If you enable a connector (Xero, QuickBooks, Sage, or FreeAgent), the OAuth authentication tokens needed for syncing are stored encrypted
• Slack integration — If you enable this option, the Slack file, channel, and thread identifiers associated with a document
• API key and webhooks — If you use programmatic access, your API key and the webhook URL/secret you configure
• Cabinet offer — team members — For an account on the Cabinet offer, the email and role (preparer, reviewer…) of each team member invited on the account
• Cabinet offer — end-client documents — When a firm uploads documents belonging to one of its own clients, those documents and the data extracted from them (see Terms section 9.7 for how responsibility is split between the firm and its end client)
• Analytics data — With your consent: pages visited, session duration (Google Analytics), and browsing behavior in the form of heatmaps and session recordings (Hotjar)
• Email — If you sign up for the waitlist, with no account created

3. Purposes and legal bases

4. Hosting and transfers

Your documents and data are stored exclusively on AWS us-east-1 (Northern Virginia, USA) (S3, DynamoDB, Textract, SES). AI processing (Bedrock) may use AWS's broader commercial region network to optimize performance — never AWS China or GovCloud regions. All transfers outside the EU are governed by the European Commission's Standard Contractual Clauses (SCCs), in accordance with Art. 46 GDPR.

AWS services used: S3 (storage), DynamoDB (database), Textract (OCR), Bedrock (AI), SES (email).

For paid subscription billing, your billing data (name, email, payment method) is processed by Stripe, Inc. (USA), under its own data processing agreement and Standard Contractual Clauses. Doxalio never stores your full card number.

With your consent, audience-measurement and browsing-behavior analysis tools are used: Google Analytics (traffic statistics) and Hotjar (heatmaps and session recordings). These tools load only after acceptance in the cookie banner (see article 8).

5. Retention periods

• Uploaded documents (outside the one-off Audit offer) and data derived from them: 12 months from last access while the account stays active; 30 days after account cancellation if that occurs first (see Terms section 10)
• One-off Audit offer — Supporting documents for the audit report are kept for 10 years from delivery, with no early deletion possible during that period (immutable archive), consistent with standard accounting-record retention practice in France and the United States
• Conversation history: 12 months
• Analytics data: 26 months (Google Analytics); see Hotjar's own policy for its retention period
• Waitlist data: until consent is withdrawn

6. Your GDPR rights

Under the GDPR, you have the following rights:

• Right of access — Obtain a copy of your data
• Right to rectification — Correct inaccurate data
• Right to erasure — Delete your data ("right to be forgotten")
• Right to portability — Receive your data in a structured format
• Right to restriction of processing — Request temporary suspension of processing in certain cases (contested accuracy, unlawful processing, objection under review)
• Right to object — Object to processing based on legitimate interest
• Right to withdraw consent — At any time, without prejudice

To exercise these rights: contact@doxalio.com. Response guaranteed within 30 days. We apply these rights as our baseline privacy practice for all users, regardless of location.

7. Security

Your data is protected by AES-256 encryption at rest and TLS 1.3 in transit. No data is ever used to train AI models. Access to your documents is restricted to your unique identifier.

8. Cookies

Cookies necessary for the service to function (authentication, session) are always active. Analytics (Google Analytics) and marketing (Hotjar) cookies require your explicit consent and load only after acceptance. You can change your preferences at any time via the cookie banner.

9. Changes

This policy may be updated. In the event of a substantial change, you will be notified by email (if provided) or via a banner on the platform.