Privacy Policy

Last updated: October 30, 2026

This Privacy Policy explains how DocsChase collects, uses, stores, shares, and protects personal information ("process") when you use our website at https://docschase.com and our document-collection service (together, the "Services"). DocsChase is operated by Cheikh Ahmed Andallah, an individual based in Tevragh Zeina, Nouakchott, Mauritania ("we," "us," or "our"). If you have any questions, contact us at privacy@docschase.com.

Summary of key points:

• What DocsChase does? Bookkeepers and accounting firms ("Firms") use DocsChase to request documents from their clients ("Clients"). Clients upload documents through a secure link, without creating an account.
• What we collect? We collect: Firm account details (such as name and email), Client names and email addresses provided by Firms, the documents Clients upload, and limited technical data needed to run the Services securely.
• Our role: we decide how Firm account data is processed. For Client documents and Client contact details, we act on behalf of the Firm that requested them.
• Sensitive data: uploaded documents (such as tax records, invoices, or bank statements) may contain sensitive financial or identity information.
• Payments: handled by Paddle, our Merchant of Record. We never see or store your full card details.
• Where data is stored: in Germany (Frankfurt). Transactional emails are sent through a provider in the United States, and payments are processed by a provider in the United Kingdom.
• We do not sell personal information, and we do not use it for advertising.
• Your rights: depending on where you live, you can access, correct, delete, or obtain a copy of your personal information. See Section 10.

1. Our role: controller and processor

• Firm account data: For information about Firms and their users (account details, billing status, support requests), we are the controller: we decide how and why it is processed.
• Client documents and Client contact details. When a Firm requests documents from its Clients, we process the Client's name, email address, and uploaded documents on behalf of that Firm and on its instructions. The Firm is the controller of this information and is responsible for having a lawful basis to collect it. We act as its processor.

If you are a Client and have questions about how your documents are used, please contact the Firm that sent you the upload link first. You can also contact us at privacy@docschase.com (see Section 10).

2. What information we collect?

Information Firms provide to us:

• name and email address
• account password (stored securely by our authentication provider in hashed form; we cannot see it)
• information about the documents they request, and the names and email addresses of their Clients.
• Messages and communications you send us, for example, to support@docschase.com or privacy@docschase.com

Information Clients provide through upload links:

• the documents they upload (PDF, PNG, or JPEG files).

Information we receive from third parties:

• From Firms: Client names and email addresses, so we can send upload links and reminders.
• From Paddle: limited purchase information, such as subscription status, plan, and transaction identifiers.
• We do not buy personal information from data brokers.

Information collected automatically:

• technical data such as IP address, browser type, and server logs, used to operate, secure, and troubleshoot the Services
• cookies that are strictly necessary for the Services to work, such as keeping you signed in (see Section 6)

sensitive information:

We do not ask for sensitive information in our account forms. However, documents uploaded by Clients may contain sensitive information, such as government identification numbers or detailed financial data. We process this information only to provide the document-collection service to the Firm, and we never use it for any other purpose.

Payment information:

If you buy a subscription, your payment is collected and processed by Paddle.com, our Merchant of Record. We do not collect or store your full card number or security code. See Paddle's Privacy Policy, https://www.paddle.com/legal/privacy.

3. How we use your information?

We use personal information to:

• create and manage Firm accounts, and authenticate users
• provide the document-collection service: sending upload links, receiving and storing documents, and showing Firms what has been received
• send automated reminder emails to Clients on behalf of Firms. Every email we send to a Client about a request includes a link to stop further emails about that request, and we let the Firm know when a Client uses it
• send service-related messages, such as security notices, trial and billing information, and changes to our terms
• respond to support and privacy requests
• keep the Services secure and prevent fraud and abuse, including checking that each email address uses the free trial only once (see section 8)
• comply with legal obligations and enforce our terms

We do not currently send marketing emails. If we do in the future, we will only do so where permitted by law, and every message will include a way to unsubscribe.

4. Legal bases for processing:

Where applicable law requires a legal basis (for example, under Mauritanian Laws or, for users in the EEA and UK, the GDPR), we rely on:

• Contract: to provide the Services to Firms under our Terms and Conditions.
• Legitimate interests: to secure the Services, prevent fraud, and improve how the Services work, where these interests are not overridden by your rights.
• Legal obligation: to comply with laws, such as tax and accounting rules or lawful requests from authorities.
• Consent: where we ask for it. You can withdraw consent at any time.
• Firm instructions: for Client documents and Client contact details, we process data on behalf of the Firm, which is responsible for its own legal basis.

5. Who we share information with?

We share personal information only with service providers that help us run DocsChase:

These providers process personal information on our behalf, under their data processing terms, and only to provide their services to us.

Paddle (United Kingdom) acts as our Merchant of Record. Paddle processes buyer information as an independent controller under its own privacy policy, to handle payments, taxes, invoicing, refunds, and fraud prevention.

We may also disclose information:

• If required by law, court order, or a lawful request from a public authority
• to protect our rights, the security of the Services, or the safety of any person.
• in connection with a sale or transfer of DocsChase, in which case this Privacy Policy will continue to apply to your information.

We do not sell personal information, and we do not share it for targeted advertising.

6. Cookies:

We use only cookies that are strictly necessary for the Services to function, such as authentication cookies that keep Firm users signed in. We do not use advertising cookies, and we do not display third-party advertising.

When you use Paddle's checkout, Paddle may set its own cookies for payment processing and fraud prevention, as described in Paddle's privacy policy, https://www.paddle.com/legal/privacy.

You can set your browser to block or delete cookies, but parts of the Services, such as signing in, may then stop working.

7. International transfers

DocsChase is operated from Mauritania. Our application and stored documents are hosted in Germany. Email delivery takes place through Resend in the United States, and payment processing through Paddle in the United Kingdom. As a result, your information may be processed in countries other than your own, which may have different data protection laws.

Where required, we rely on appropriate safeguards provided in our service providers' data processing terms, such as the European Commission's Standard Contractual Clauses. You can request more information by contacting privacy@docschase.com.

8. How long we keep information?

• Firm account data : kept while the account is active, and deleted within "60 days" after the account is closed.
• Inactive accounts: if a Firm account has not been used for 12 months (no sign-in and no use of the dashboard) and has no active subscription, we send a warning to the account’s email address. If the account is still not used within 30 days of that warning, we close it and delete its data, including Client documents, as described above. Signing in or using the dashboard at any time cancels the warning.
• Client documents and Client contact details: kept until the Firm deletes them, or until the Firm's account is closed. They are then deleted within "60 days".
• Backups: deleted data may remain in secure backups for a limited period until those backups are overwritten. Backup data is not used for any other purpose.
• Billing records: kept by Paddle, and by us where required, for as long as tax and accounting laws require.
• Support and privacy requests: kept for as long as needed to handle the request and keep a record of it.
• Free trial fingerprint: To keep our free trial fair for everyone, we keep a one-way fingerprint of your email address after your account is deleted. This is not your email address itself, and it cannot be turned back into it. We use it only to check whether an email has already used a free trial when a new account is created. It is never used to contact you or for any other purpose.

9. How we protect information?

We use reasonable technical and organizational measures to protect personal information, including:

• encryption of data in transit (HTTPS/TLS).
• encryption of stored data at rest, provided by our hosting provider.
• a private storage area for documents, with access controls that separate each Firm's data.
• server-side checks that each request, upload, and download belongs to the Firm that owns the data.
• database access rules that let each Firm reach only its own data.
• unique, hard-to-guess upload links for Clients, which expire automatically after 30 days. We store only a one-way fingerprint of each link, not the link itself. A link also stops working when its request is completed or deleted. Emails we send to Clients about a request (the upload-link email and reminders) contain a new private link for the same request, and a Firm can create a new one from its dashboard if a link is lost. Each new link follows the same rules.
• short-lived download links, available only to the Firm that requested the documents.
• restricted file types (PDF, PNG, or JPEG) and sizes (up to 25 MB per file) for uploads, checked again on our servers after each upload.
• a minimum password length of 10 characters for Firm accounts, and confirmation of the email address before a new Firm account can be used.
• limits on repeated requests and on reminder emails, to protect against misuse.
• browser security protections on our website, such as a Content Security Policy.
• payment card details handled by our payment provider, Paddle; we do not receive or store them.
• verification that payment notifications really come from Paddle before they change any account.
• automated security scanning of our code and dependencies, including checks for exposed secrets.
• daily backups of our database, kept for 7 days. Uploaded files are not included in these backups (see Section 13 of our Terms and Conditions).

No system is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities where required by law.

10. Your privacy rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you, and receive a copy
• Correct inaccurate information
• delete your information
• restrict or object to certain processing.
• receive your information in a portable format.
• Withdraw consent at any time, where processing is based on consent

How to exercise your rights?

• Firms: you can update your details, and delete your account, from your account Settings. For any other request, including a copy of your data, email privacy@docschase.com.
• Clients: your documents are held on behalf of the Firm that requested them, so please contact that Firm first. You can also email privacy@docschase.com, and we will help or pass your request to the Firm.

We may need to verify your identity before acting on a request. We respond without undue delay, and within the time required by applicable law (generally within one month). We will not treat you differently for exercising your rights.

Complaints

If you believe your personal information has been processed unlawfully, you may lodge a complaint with the data protection authority in the country where you live, or in the country where you believe the issue occurred. If you are in the European Economic Area or the United Kingdom, this is your local data protection authority.

We would appreciate the chance to address your concern first. Please contact us at privacy@docschase.com.

11. Additional information for United States residents:

We collect the following categories of personal information, as described in Section 2:

• Identifiers: names, email addresses, IP addresses.
• Customer records: account and contact information.
• Sensitive personal information: account login credentials, and any sensitive information contained in uploaded documents.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you. Retention periods are described in Section 8.

Residents of certain US states may have the rights described in Section 10, as well as the right to appeal a decision about their request. To make a request or an appeal, email privacy@docschase.com. You may use an authorized agent; we may ask for proof of the agent's authority.

Do Not Track: there is no common standard for Do Not Track signals, so we do not currently respond to them. Since we do not use tracking for advertising, this does not change how your information is handled.

12. Children:

The Services are intended only for people aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact privacy@docschase.com and we will delete it.

13. Governing law

This Privacy Policy is governed by the laws of the Islamic Republic of Mauritania. This does not limit any rights you have under the mandatory data protection laws of your country of residence.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top shows when it was last revised. If we make significant changes, we will notify Firms by email or by a notice in the Services.

15. Contact us:

Cheikh Ahmed Andallah operating as DocsChase
Tevragh Zeina, Nouakchott, Mauritania
privacy@docschase.com