Privacy Policy

This Privacy Policy explains how DociCA (“DociCA”, “we”) handles personal information when you create an account, generate documents, or request an AI-assisted review during our invite-only beta. It is written to comply with Canada’s PIPEDA and, for Alberta users, Alberta’s PIPA. This is a beta policy and may change; we will update the “last updated” date above.

Information we collect

We collect only what we need to run the beta:

• Account details — email and authentication data.
• Document contents — the answers you enter into a document wizard, and the text of any document you upload for AI-assisted review. Treat these as containing whatever personal information you put into them.
• Uploaded files — files you submit for review.
• Usage data — basic analytics (pages visited, feature usage) and security logs.

How we use your information

To generate and review documents, operate and secure the service, respond to support and feedback, and improve the product. We do not sell your personal information, and we do not use your documents or uploaded files to train AI models.

AI processing

AI-assisted review processes the text of your document to produce an issue summary. This runs entirely on a self-hosted AI model on our own Canadian infrastructure in Québec — your document text is processed in Canada, is not transmitted across the border, and is not sent to any third-party AI provider. The model runs in our environment, so document text is used only to perform your review and is not used to train any AI model. We do not operate a cloud-AI path for review; if that ever changes, we will update this policy and disclose it before any such processing occurs.

Where your data is stored, and data residency

Our application database and backups are hosted on Canadian-hosted infrastructure in Québec, and AI review runs on a self-hosted model on that same Canadian infrastructure — so your document content and review are processed and stored in Canada. Some operational subprocessors (see below), such as email delivery and analytics, may process limited data; we list each with its data location. Data is encrypted in transit; database access is restricted. We describe our remaining data-residency work as ongoing for those operational subprocessors, not as an absolute guarantee across every vendor.

Retention and deletion

You can delete documents and AI reviews from your account. When you delete an item, it is removed from our active systems promptly. Note on backups: deleted data may persist in encrypted database backups and write-ahead logs for up to 90 days (our backup/point-in-time-recovery window) before it is purged. We do not claim instantaneous destruction from backups. Account data is retained while your account is active and deleted on request.

Sharing and subprocessors

We share data only with service providers needed to run DociCA, under contract. Our current subprocessors are listed on our Subprocessors page and include hosting (Supabase/Postgres), AI processing, email delivery, analytics, and — where you choose to use them — payment and e-signature providers.

Your rights

Under PIPEDA and Alberta PIPA you may access, correct, or delete your personal information, and withdraw consent. To exercise these rights, email support@docica.ca. You may also contact the Office of the Privacy Commissioner of Canada, or the Office of the Information and Privacy Commissioner of Alberta.

Contact

Questions about this policy? Email support@docica.ca or see our contact page.