Privacy Policy

1. Data controller

Doxalio (doxalio.io), headquartered in France, is the controller of your personal data in accordance with the General Data Protection Regulation (GDPR — EU 2016/679).

DPO contact: privacy@doxalio.io

2. Data we collect

We collect the following data:

• User identifier — Anonymous UUID generated locally (stored in localStorage)
• Uploaded documents — PDF files uploaded to the platform, stored encrypted on AWS S3
• Session data — Conversation history linked to your identifier
• Analytics data — With your consent: pages visited, session duration (Google Analytics)
• Email — Only if you sign up for the waitlist

3. Purposes and legal bases

4. Hosting and transfers

All your data is hosted exclusively on AWS us-east-1 (Northern Virginia, USA). This transfer to a third country is governed by the European Commission's Standard Contractual Clauses (SCCs), in accordance with Art. 46 GDPR.

AWS services used: S3 (storage), DynamoDB (database), Textract (OCR), Bedrock (AI), SES (email).

5. Retention periods

• Uploaded documents: 12 months from last access
• Conversation history: 12 months
• Analytics data: 26 months (Google Analytics)
• Waitlist data: until consent is withdrawn

6. Your GDPR rights

Under the GDPR, you have the following rights:

• Right of access — Obtain a copy of your data
• Right to rectification — Correct inaccurate data
• Right to erasure — Delete your data ("right to be forgotten")
• Right to portability — Receive your data in a structured format
• Right to object — Object to processing based on legitimate interest
• Right to withdraw consent — At any time, without prejudice

To exercise these rights: privacy@doxalio.io. Response guaranteed within 30 days. You may also lodge a complaint with the CNIL (the French supervisory authority).

7. Security

Your data is protected by AES-256 encryption at rest and TLS 1.3 in transit. No data is ever used to train AI models. Access to your documents is restricted to your unique identifier.

8. Cookies

We only use cookies necessary for the service to function (session). Analytics and marketing cookies require your explicit consent. You can change your preferences at any time via the cookie banner.

9. Changes

This policy may be updated. In the event of a substantial change, you will be notified by email (if provided) or via a banner on the platform.