Legal
Privacy
What we collect, why, and for how long. Written to be read.
Who we are
Docsroom is provided by ONAF Limited, a company registered in England and Wales. We are the data controller for this website and for your account. You, or the organisation you use Docsroom for, are the data controller for the information collected through Docsroom from the people you ask; we process it on your instructions.
This website
We set no cookies on this website and we run no advertising or third-party tracking scripts. The contact form opens a message in your own mail app, so nothing you type into it is stored on this site. The Start free form is sent to us, because it is how we set your account up: it carries your name, your email address and your organisation’s name, and that becomes your account. Our web server keeps standard access logs for 30 days for security.
Measuring this website
We count how many people reach each step between arriving on this website and paying for Docsroom, so that we know which pages and which links bring people who find Docsroom useful. It is our own measurement, running on our own systems. No analytics company is involved, nothing is shared with anybody, and none of it is used for advertising or sold.
When a page is opened we record the time, the path of the page (for example /pricing/, never anything after a ?), the host name of the site that sent you here if a link did (for example google.com, never the full address, which on a search engine holds what you searched for), and any utm_ values written into the link. When the Start free form is sent, and when an account then goes on to be created, to send its first request or to subscribe, we record that a step was reached.
To tie those steps together, your browser makes a random 32-character identifier for itself the first time it opens a page here and keeps it in its own storage for this site. It is not a cookie and it is never sent to anyone else. It tells us that one browser looked at two pages and later signed up; it holds no name, no address and nothing about who you are or any other site you visit. Because it lives in storage, a browser set to block site data sends none and simply counts as its own visit, and clearing your browser’s data for this site removes it. Switching scripting off in your browser stops the measurement entirely, and the site works without it.
What we never record here: your network address, any part of a web address after the ?, your name, your email address, or anything you type into a form. Steps are kept for 400 days and are then deleted.
The chat on this website
The Chat button opens a conversation with an assistant, which answers from what is published on this site; when it cannot answer, a person at Docsroom joins the same conversation and carries on. We keep the messages, the page the chat started on, the address that brought you to the site and the time, for 12 months. The service also counts recent requests from your network address for two days, so that nobody can flood it. A copy of a chat is emailed only when you ask for one, and then the address you give us is kept with that chat. The assistant is built on OpenAI’s models, so the conversation and the pages it is answering from are sent to OpenAI for each reply, with their storage switched off. When a person takes over, the chat reaches them through our support tools, and they can read everything written in it. The chat keeps a small marker in your browser so a conversation carries from page to page, and it is not used for tracking or advertising. To have a chat deleted before the 12 months are up, email hello@docsroom.co.uk.
Your account
To run Docsroom we hold your name, email address, a hash of your password, and a record of when you signed in. We hold the names and email addresses of the people you ask, the requests you create, the replies and files they send, and a trail of activity. All of it is used only to provide the service and is never sold or used for advertising.
Request emails, reminders, sign-in links and a copy of a website chat are sent through Resend, a transactional email provider. The recipient’s address, the subject and the message body pass through their systems for delivery.
Payments
Subscriptions are paid through Stripe. Your card details go to Stripe and never reach Docsroom. We see your name, email address, organisation name, the plan you chose and whether each payment went through.
Drafting a request list with AI
Docsroom can draft a list of requests from a description, and it is off unless an administrator connects an OpenAI key. When it is on, the only thing sent from your account is the description a member of your team types into that box, alongside our own fixed instructions, and it is sent with OpenAI’s storage switched off. No business or person from your account, no reply, no file and no existing request goes with it, and the draft it comes back with is not saved until somebody accepts it.
How long it is kept
Data is kept for as long as your account is active. When an account closes, you can download everything and then ask us to delete it. Backups are replaced every night, and each one is kept for 30 days. On the Office plan you may run Docsroom on your own infrastructure, in which case none of the information you collect reaches us.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@docsroom.co.uk. You can also complain to the Information Commissioner’s Office. Requests from the people you ask about data collected through your account should go to you; we will help you answer them.