Privacy Policy

Our Unwavering Commitment

We guarantee in writing and contractually that:

Your documents are NEVER used to train AI models

Your information is NEVER shared with third parties

Nobody on the team looks at your documents to analyse usage: the internal report only shows figures

In the Cloud version, your documents are stored until you delete them or your account

In the desktop version, your documents do not leave your computer

How It Works Technically

AI Processing

Desktop Version: Open-source AI models running locally on your computer. No internet connection required.

Cloud Version: We use Google Gemini to process queries in the cloud. Data is transmitted encrypted (TLS 1.3), processed in memory and not stored on Google servers or used to train models. Google acts as a data processor under a DPA agreement in compliance with GDPR.

End-to-End Encryption

All communication between your device and our servers is encrypted with TLS 1.3.

No Content Telemetry

We do not collect metrics about the content of your queries. We only log anonymous technical data (response times, errors) to improve the service, never the content of your documents.

What is stored in the cloud

Queries to Public Experts store no document of yours. The documents you upload to a cloud Expert are stored until you delete them or your account. Details are below.

Desktop Version: Absolute Privacy

For maximum security, we offer a desktop version where information NEVER leaves your computer.

How does the local version work?

1. Local AI Engine

An open-source artificial intelligence engine is installed directly on your computer. This engine processes all documents locally, without requiring an internet connection.

2. Local Database

The indexes and embeddings of your documents are stored in a local database (SQLite + vectors). This information remains exclusively on your hard drive.

3. No Connection Required

Once installed, the system works completely offline. You can disconnect the network cable and continue working normally.

4. Auditable Code

All installed software is open source. You (or your IT department) can audit exactly what each component does.

Important: In the local version, not even DOCU.expert as a company can access your information. Data does not leave your computer under any circumstances.

Team Mode: Private Collaboration

For teams and companies, we offer local network synchronization while maintaining total privacy.

Local Network Synchronization

Installations within the same local network can synchronize with each other. When a user indexes a document as "public for the team," it automatically replicates to other members.

Private documents: only on your machine
Team documents: synchronized on local network
No external servers involved

Operating Modes

Each installation can be configured according to needs:

Individual: No synchronization, maximum privacy
Server + Client: One central machine, others connect
P2P: All machines synchronized with each other

Regulatory Compliance

GDPR and LOPDGDD

DOCU.expert complies with the General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD).

Your rights

Right of access to your personal data
Right to rectification of inaccurate data
Right to erasure ("right to be forgotten")
Right to data portability
Right to object to processing

Data we process

We only process strictly necessary data:

Account: Email (for authentication)
Billing: Tax data (paid plans only)
Technical: Anonymous access logs

In the desktop version, the content of your documents does not leave your computer. In the Cloud version it is stored as explained below.

Your documents in the Cloud version. We know they are sensitive content, so this is exactly what happens. When you upload a document to an Expert, we store the original file in Cloudflare R2 and its text, fragments and indexes in our database, and Google Gemini processes them to index them and answer your questions. They stay there until you delete them or delete your account from Settings: we then delete the files, text, indexes and your conversations at that moment, and whatever remains in backups disappears with their normal cycle. We keep your invoices, as the law requires, and any feedback you sent us. They are not end-to-end encrypted, so whoever administers the service could technically access them; we do not do so to analyse usage. The internal report on each user shows figures (experts, documents, actions per day), never their content. We only see the text of a query when you send it to us: in a conversation with support or when you rate a chat answer, which stores the question and the answer.

Language model providers and international transfers. The conversational assistant on this site runs on AgenteUno. Chat messages are processed by Cerebras Systems Inc. (United States) as data processor. Google LLC (Gemini, United States), which processes cloud queries, is certified under the EU-US Data Privacy Framework (DPF), so that transfer relies on the European Commission adequacy decision, and its data processor terms also incorporate the standard contractual clauses. Cerebras Systems Inc. is not on the DPF list: the transfer to this provider relies on the standard contractual clauses (Commission Implementing Decision (EU) 2021/914) incorporated into its data processing agreement (DPA). If you use the assistant's voice mode, the audio is processed with Google Gemini Live (Google LLC, certified under the DPF). The chat only keeps a session identifier in your browser's session storage and its analytics are enabled only if you accept analytics cookies.

How we analyse the use of DocuExpert

We want to understand what fails and what we do not explain well. To do so we analyse how the service is used: browsing on the website, logins, activity figures, questions put to the website's help assistant and the opinions you send us. Your documents and your queries to the Experts are not part of this analysis: from them we only use figures, never their content.

Analysis of the use of the service and help emails based on that activity: Art. 6.1.f GDPR, legitimate interest. You can object by writing to [email protected], with no need to give reasons and without losing the service, and turn those emails off in Settings.
Heatmaps and session recording: Art. 6.1.a GDPR, consent in the cookie banner, which you can withdraw at any time. The recording hides the text and fields of the page.
No automated decisions: this analysis produces no automated decision with legal effects on you or similarly affecting you. It does not change your price, your plan or your access.
Controller: Codelabs Studio, S.L., PASAJE Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), Spain.

DPO Contact

To exercise your rights or for privacy inquiries:
privacy@docu.expert