Privacy Policy

The controller of your personal data is Matěj Tomeček, a sole trader registered under the Czech Trade Licensing Act, IČO 22186603, with a registered place of business at Fabiánka I 178, Kudlov, 760 01 Zlín, Czech Republic, operating the service under the brand "DOXIO" ("we"). You can reach us at hello@doxio.pro or by post at the address above.

We have not designated a data protection officer, as the GDPR does not require one at our scale. Data-protection requests go to hello@doxio.pro.

We are the controller of the personal data we need to run the service itself: account, organization and billing data, security and technical logs, and the audit records of signing events.

For the documents an organization uploads and for the names, e-mail addresses and other data it enters about its recipients, signers and clients, that organization is the controller and we act as its processor under our Data Processing Agreement. If you received a document through DOXIO and have questions about its content or about why the organization holds your data, please contact that organization; we will assist it in responding.

Account holders (users and organization members): name, e-mail address, password hash or sign-in method, profile picture if you add one, language and time-zone preference, organization membership and role, and sign-in sessions with their IP address and browser identifier. We use this data to create and secure your account, to sign you in with one-time codes, and to communicate with you about the service. Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legitimate interest in the security of the service (Article 6(1)(f)). Providing this data is necessary to conclude the contract; without it we cannot provide an account.

Billing: the plan, subscription status, billing period, invoices and the identifier of your customer record at our payment processor, Stripe. Card details are entered directly into Stripe's payment form and never reach our servers. Legal basis: performance of the contract and our legal obligation to keep accounting records (Article 6(1)(c)).

Documents, signatures and fields: the documents you upload, their hashes, the signature images and typed names of signers, the values filled into fields, and the signed output. For organizations' content we act as processor (see section 2). We process it only to provide the service. Legal basis, as regards data we process as controller: performance of the contract.

Audit and signing evidence: for every access, view, one-time-code verification, signature, decline and administrative action we record the time, the acting person (account or e-mail address), the IP address, the browser identifier and the hash of the document version concerned. This tamper-evident record is what makes a DOXIO signature evidentially useful. Legal basis: performance of the contract and our and our customers' legitimate interest in being able to prove what was signed, by whom and when, and in detecting misuse (Article 6(1)(f)).

Technical and security data: server logs, rate-limit counters and error reports. Error reports are sent to our error-monitoring provider with personal data removed. Legal basis: our legitimate interest in the security, stability and improvement of the service.

Communications: e-mails you send us and our replies. Legal basis: performance of the contract or our legitimate interest in answering your request.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects. We do not use your data for advertising and we do not sell it.

If an organization sends you a document through DOXIO, we receive your name and e-mail address from that organization so that we can deliver the document link and, where required, a one-time access code. When you open, fill in or sign the document, we collect directly from you the time, your IP address, your browser identifier, the signature you draw or type, the field values you enter and — if you decline — the fact that you declined.

The organization that sent you the document is the controller of its content and of your contact details. We are the controller of the audit record of the signing event, which we keep so that the signature can be evidenced if it is later disputed, as described in section 6. You have the rights described in section 7 in relation to that record, and you can exercise them by writing to hello@doxio.pro; because signers do not have accounts, requests cannot be made in the app.

We send you only the messages needed for the document: the link, the access code, reminders requested by the sender, a copy of the signed document and notices about the outcome. We never send marketing messages to signers.

We share personal data only with the sub-processors listed on our Sub-processors page, each under written data-processing terms: hosting, database and file storage (Railway), payment processing (Stripe), transactional e-mail (Resend), server-side error monitoring (PostHog) and, only for organizations that have switched on Document extraction, AI extraction of accounting documents (Mistral AI). Our application, database, file storage, e-mail sending, error monitoring and AI extraction are configured in European Union regions.

Some of these providers have parent companies established outside the European Economic Area, and support access from a third country cannot be entirely excluded. Such transfers rely on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR), supplemented by encryption in transit and access controls. A copy of the clauses is available on request.

Within the service, your data is visible to the members of your organization according to their role, and to the recipients and signers with whom you share a document. If you enable webhooks or use the API, the events we send to the endpoints you configure include the names and e-mail addresses of the signers concerned; the operator of that endpoint is then responsible for them.

We disclose data to public authorities only where the law requires it.

While your account is active, we keep your account, organization and document data for as long as you keep it in the service. You can delete documents, clients, templates and members at any time; deleted files are erased from storage and the corresponding records are removed, except for the audit log entries and the signing evidence described below.

When you delete your account or organization, a 30-day grace period applies during which the deletion can be cancelled. After it, we permanently erase your document files, unsigned documents, templates, client records, branding, API keys, webhooks and account data.

For documents that were signed, we retain a reduced set of signing evidence for 7 years from the end of the grace period: the signer's name and e-mail address, the IP address and browser identifier used to sign, the time of signing, the hash of the signed document, and the recipient's name and e-mail address, and, for organization signatures, the name, title and confirmation record of the signatory (their e-mail address, the time, IP address and browser identifier of the confirmation and the text of the signing mandate they accepted), together with the tamper-evident audit log of that document. If you confirmed a signing mandate, were designated for one, or designated someone for one, we keep your name, e-mail address and the mandate record (and, for a confirmed mandate, the IP address and browser identifier of the confirmation) as signing evidence for as long as the organization's record exists and for 7 years after its deletion; your account record is kept in a locked state for that time, even after you delete your account, but your sign-in credentials and memberships are still erased when you delete your account. We keep this so that the existence and integrity of a signature can be demonstrated if it is disputed. This period is our own choice, based on the general limitation periods for contractual claims; it is not required by statute. Legal basis: our and our customers' legitimate interest in preserving evidence of concluded transactions (Article 6(1)(f) GDPR). After 7 years this evidence is permanently erased.

Invoices and accounting records are kept for the period required by Czech accounting law. Sign-in sessions expire automatically; one-time codes expire within minutes and are stored only as hashes. Webhook delivery logs are kept for 30 days. Error reports are kept by our monitoring provider for a limited period and contain no personal data.

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data rectified and incomplete data completed;
• have your data erased, where there is no overriding reason to keep it;
• restrict processing in the cases provided for by the GDPR;
• receive the data you provided to us in a structured, machine-readable format (portability);
• object to processing based on our legitimate interests; we will then stop unless we demonstrate compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.

Account owners and admins can export their organization's data — documents, signatures and the audit log — as a ZIP archive from the settings, and can schedule the deletion of the account or organization there. For any other request, write to hello@doxio.pro. We respond within one month; we may ask you to verify your identity first. Please note that signing evidence retained under section 6 may be kept despite an erasure request where it is needed to evidence a signature.

You also have the right to lodge a complaint with the Czech supervisory authority, Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz, or with the supervisory authority of the EU country where you live or work.

Data is encrypted in transit (TLS). Every query is scoped to the organization it belongs to, so one customer can never reach another's data. Share links, one-time codes and API keys are stored only as hashes. External recipients receive files only through an access-controlled stream, never a direct storage link. The audit log is append-only and hash-chained, so a change to a past entry can be detected. Access to production systems is limited to the persons who operate the service and protected by least-privilege roles. Our providers hold recognised security certifications; details are on the Sub-processors page.

If a personal data breach occurs that is likely to result in a high risk to you, we will inform you without undue delay, and we will notify the supervisory authority where the GDPR requires it.

DOXIO offers an optional module, Document extraction, that reads accounting documents such as invoices and receipts and suggests the values for the accounting record. It is off by default. It runs only after the owner of an organization switches it on and accepts the consent text, and only for the documents the organization chooses to extract. We record which version of the consent text was accepted, by whom and when. The owner can switch the module off at any time.

When a document is extracted, we send the file (PDF or image) to Mistral AI SAS, Paris, France, which processes it in the European Union. The file is sent inside an encrypted request (TLS), never as a public link. Accounting documents may contain personal data of the organization's business partners, such as names, addresses, business IDs, bank account numbers and contact details.

For this content the organization is the controller and we act as its processor under our Data Processing Agreement; Mistral AI is our sub-processor. By switching the module on, the owner gives us the organization's documented instruction to process its documents in this way. This is not consent of the people named in the documents; the organization remains responsible for its own legal basis for processing their data, typically its obligation to keep accounting records.

We do not use documents or extracted values to train AI models. In production we use Mistral AI under a paid plan with a data-processing agreement and with the use of customer data for model training switched off.

The extracted values are stored as part of the document's record. They are only a draft: a person in the organization must check and confirm them, and they never overwrite data taken from ISDOC, a QR payment code or entered by hand. They are deleted together with the document. We do not store the full text recognised in the document. For each extraction we keep run metadata — provider, model, number of pages, outcome, processing time and any error code — for billing, usage limits and support. This metadata contains no document content and is erased together with the organization's other data.

DOXIO uses only strictly necessary cookies and browser storage. Details are in our Cookie Policy.

We publish changes to this policy on this page with a new effective date. We notify account owners by e-mail of material changes before they take effect.