Effective: August 18, 2026 · Version 1.2
This policy covers the Docos AI service operated by AshvenX Technologies Inc. (Vancouver, BC, Canada). Use of the service is also governed by our Terms of Service.
Docos AI is a document intelligence service. When you upload a document, we do more than store it: we read it, classify it, and extract structured records from it — amounts, dates, vendors, parties, line items, deadlines. Those records are then filed into the workspaces they belong to, such as bookkeeping, tax preparation and contract obligations.
This matters for your privacy because the extracted records outlive the reading step and are retained as data in your account. A receipt does not simply sit in a folder; it becomes a coded transaction, a deduction and, where applicable, a tracked obligation with dates attached.
Information you provide. Your email address, name, and password (stored only as a hash), or the profile information your identity provider returns if you sign in with Google or Microsoft. Organization and workspace names. Billing details if you subscribe to a paid plan. Anything you write to us in feedback or support messages.
Documents and their contents. The files you upload, and everything we extract from them.
Usage data. Sign-in timestamps, processing history, credit consumption, and the corrections you make to extracted data — the last of these is used to improve coding accuracy within your own account.
Technical data. IP address and browser user agent, recorded when you accept a legal document so the acceptance can be evidenced, and in server logs for security and debugging.
To operate the service: authenticate you, process your documents, maintain your records, meter credits, take payment, and send you transactional email. To keep the service secure and diagnose faults. To respond when you contact us. To send product updates and newsletters only where you have opted in, which you can withdraw from any email we send.
We do not sell your personal data, and we do not use the contents of your documents to train AI models — neither our own nor a third party’s.
Delivering the service requires third parties, and your data — including, in one case, the contents of your documents — is transmitted to them. This is the complete list of sub-processors at the effective date above:
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Google Cloud Platform | Hosting, database, and document storage | All service data, including uploaded documents and extracted records | United States (us-central1) |
| Google (Gemini AI models) | Reading and extracting structured data from your documents | The contents of documents you upload for processing | United States |
| Stripe | Payment processing for paid plans | Billing name, email, and payment details (we never receive full card numbers) | United States |
| Resend | Transactional and product email delivery | Your email address and the contents of emails we send you | United States |
| Intuit QuickBooks / Xero | Only if you connect them — exporting coded transactions | The transaction records you choose to export | Per that provider's terms |
We will update this list before adding a sub-processor that handles document content, not after.
AshvenX Technologies Inc. is a Canadian company, and the service runs on infrastructure located in the United States. If you are in Canada, the European Economic Area, the United Kingdom or elsewhere, your data — including your documents — is transferred outside your country to be processed.
Where required, we rely on the European Commission’s Standard Contractual Clauses, or the equivalent UK addendum, in our agreements with the providers listed above. Some jurisdictions give authorities rights of access to data held locally that differ from your own; we tell you where the data goes so you can take that into account before uploading.
Account data is retained while your account is active. Documents and the records extracted from them are retained until you delete them or close your account.
You can export your entire account as JSON at any time, and delete it in a single action. On deletion, your documents, extracted records and account data are removed from live systems within 30 days. Encrypted database backups are retained on a rolling 7-day cycle and are overwritten as that cycle turns, so a deleted record can persist in a backup for up to a further 7 days.
We may retain a minimal record where the law requires it — for example, billing records for tax purposes, and legal-acceptance rows evidencing which document version you agreed to.
Docos AI is in beta. As set out in the Terms of Service, the beta environment may be reset, and data in it may be deleted. Keep your own copies of anything you cannot afford to lose. This is a statement about the current state of the service, not a reservation of a right to lose your data casually.
Data is encrypted in transit and at rest. Passwords are hashed, never stored in a recoverable form. Credentials for connected accounting systems are encrypted at rest with a separate key. Access to production data is limited to personnel who need it to operate or support the service.
No system is perfectly secure. If you believe you have found a vulnerability, please write to support@ashvenx.com rather than disclosing it publicly.
We use essential cookies and browser localStorage to keep you signed in and to remember your preferences. These are required for the product to work — they are set when you sign in, not before — and we do not ask for consent to them for that reason. You may clear your browser storage at any time, which will log you out.
We do not currently run any third-party analytics, advertising or session-recording tools. Nothing on our pages reports your activity to another company.
If we introduce product analytics we will update this policy before switching anything on, and where consent is required we will ask for it first rather than set the cookie and tell you afterwards. Two commitments will not change: we will never send the contents of your documents — not document names, file contents, extracted fields, search terms or the text of your questions — and we do not use advertising cookies, sell your data, or share it with advertisers.
We make the service available worldwide, and the rights you have depend on where you live. In most places these include the right to access a copy of your personal data, correct it, delete it, restrict or object to processing, withdraw consent, and receive your data in a portable format. Canadian users have rights under PIPEDA and, in British Columbia, the Personal Information Protection Act; users in the EEA and UK under the GDPR; California residents under the CCPA/CPRA, including the right not to be discriminated against for exercising them; Australian users under the Privacy Act 1988.
The export and delete controls in your account settings satisfy the access, portability and erasure rights directly and immediately. For anything else, write to support@ashvenx.com. We aim to respond within 30 days.
You may also complain to the data protection authority where you live. In Canada that is the Office of the Privacy Commissioner of Canada, and in British Columbia the Office of the Information and Privacy Commissioner for BC.
The service is not directed at children and is not intended for anyone under 16. We do not knowingly collect their personal data. If you believe a child has provided us with data, write to the address above and we will delete it.
We may update this policy. Substantive changes bump the version number shown at the top, and you will be asked to review and accept the new version before continuing to use the service — which is also how we can tell you which version you agreed to, and when.
AshvenX Technologies Inc. is incorporated in Vancouver, British Columbia, Canada, and is the controller of the personal data described in this policy.
Privacy and data rights: support@ashvenx.com
Legal notices: contact@ashvenx.com