Privacy policy
Who this covers
This policy covers www.documentsynth.com, the public DocumentSynth website. It also describes, at a high level, how DocumentSynth handles data inside a customer environment at <organization>.documentsynth.com.
Inside a customer environment, the customer is the controller of the documents and personal data they put into it, and DocumentSynth is a processor acting on their instructions. The agreement with that customer, not this page, governs that relationship.
What the public site collects
If you submit the “request an environment” form we collect the organization name, the address you asked for, your name and email address, and the name, email address and password you nominate for the first administrator. We use it to assess and, if approved, provision the environment, and to contact you about the request.
Our servers write ordinary access logs — request method, host, path, response status, timing and IP address. They do not record query strings, cookies or authorization headers. The public site sets no advertising or analytics cookies and does not embed third-party trackers.
What a customer environment holds
A customer environment holds the documents the customer uploads, the metadata they record, their users’ account details, and an append-only audit trail of actions taken. The audit trail is deliberately tamper-evident and is not editable — including by us — because its purpose is to be evidence.
Documents are encrypted at rest and are never made publicly addressable. Each environment is isolated from every other.
Retention
Data in a customer environment is retained for the period agreed with that customer and for as long as their regulatory obligations require, which is frequently longer than the commercial relationship.
Requires reviewRetention periods for public-site enquiry data, for logs, and for a customer environment after termination need to be fixed as specific durations and stated here.
Sub-processors and location
Requires reviewThe hosting location and the list of sub-processors must be stated here before launch, with a mechanism for notifying customers of changes. Procurement teams ask for this first, and an answer of “on request” will lose assessments.
Your rights
Depending on where you are, you may have rights to access, correct, export or erase your personal data, and to object to certain processing. If your data is in a customer environment, please contact that organization first — they control it, and we will support them in responding.
Requires reviewThe identity of the data controller for the public site, an establishment or representative where one is required, and a supervisory-authority complaint route need to be named.
Contact
Privacy enquiries: [email protected]. Security reports: [email protected].