Legal
Privacy
What we collect, why, and for how long. Written to be read.
Who we are
Docsroom is provided by ONAF Limited, a company registered in England and Wales. We are the data controller for this website and for your account. You, or the organisation you use Docsroom for, are the data controller for the information collected through Docsroom from the people you ask; we process it on your instructions.
This website
We do not use analytics cookies or tracking scripts. The contact and start forms open a message in your own mail app; nothing you type is stored on this site. Our web server keeps standard access logs for 30 days for security.
Your account
To run Docsroom we hold your name, email address, a hash of your password, and a record of when you signed in. We hold the names and email addresses of the people you ask, the requests you create, the replies and files they send, and a trail of activity. All of it is used only to provide the service and is never sold or used for advertising.
Request emails, reminders and sign-in links are sent through Resend, a transactional email provider. The recipient’s address, the subject and the message body pass through their systems for delivery.
Payments
Subscriptions are paid through Stripe. Your card details go to Stripe and never reach Docsroom. We see your name, email address, organisation name, the plan you chose and whether each payment went through.
Drafting a request list with AI
Docsroom can draft a list of requests from a description, and it is off unless an administrator connects an OpenAI key. When it is on, the only thing sent from your account is the description a member of your team types into that box, alongside our own fixed instructions, and it is sent with OpenAI’s storage switched off. No client name, no reply, no file and no existing request goes with it, and the draft it comes back with is not saved until somebody accepts it.
How long it is kept
Data is kept for as long as your account is active. When an account closes, you can download everything and then ask us to delete it. Backups are replaced every night, and each one is kept for 30 days. On the Office plan you may run Docsroom on your own infrastructure, in which case none of the information you collect reaches us.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@docsroom.co.uk. You can also complain to the Information Commissioner’s Office. Requests from the people you ask about data collected through your account should go to you; we will help you answer them.