Privacy policy

1. Controller

The controller for the processing of personal data in DocMind is:

Marcus Pock, Brandfichtenweg 1, 16259 Bad Freienwalde, Deutschland
Email: info@geekinfinity.net
Phone: +49 155 60240707

No data protection officer has been appointed. The conditions of Art. 37 GDPR and section 38 BDSG are not met.

2. What data is processed

Account data. Your email address, a display name if you provide one, and your password as a hash. The password itself is not stored and cannot be read by us either.

Your documents. The uploaded files themselves, the text extracted from them, the details produced by the analysis such as title, category, date, summary and keywords, and any deadlines found. In addition, numeric representations of text passages that make the search possible.

You decide what your documents contain. They may include special categories under Art. 9 GDPR, for example health data in a doctor's letter. Only upload such material if you want to.

Usage data. Time and type of access, IP address, browser identification, and a request reference that allows an error to be traced.

Payment data. Only on a paid plan: a customer reference and the state of the subscription. Card details are neither collected nor stored by us; they are entered only at the payment provider.

3. Purposes and legal bases

Providing the service — account, storage, analysis, search, deadline detection. Legal basis is Art. 6(1)(b) GDPR: processing is necessary to perform the contract.

Operation and security — logs, abuse detection, troubleshooting. Legal basis is Art. 6(1)(f) GDPR. The legitimate interest is keeping the service stable and secure.

Payment processing — Art. 6(1)(b) GDPR; retention of invoice records additionally Art. 6(1)(c) GDPR in conjunction with commercial and tax retention obligations.

Account emails — registration confirmation, address change, account deletion, and deadline reminders if requested. Art. 6(1)(b) GDPR.

No advertising is sent. Your behaviour is not analysed for advertising purposes.

4. Who else receives the data

DocMind shares data only with providers required for operation. All act on instructions as processors under Art. 28 GDPR.

IONOS SE, Germany — servers, database and email delivery. Receives all stored data.

Anthropic PBC, USA — document analysis and chat answers. Receives the text of the document concerned, or the passages found plus your question.

OpenAI, L.L.C., USA — generating search vectors. Receives the text passages of your documents.

Stripe, Inc., USA — payment processing. Receives payment data and your email address.

Only the excerpt needed for the specific request is transferred to Anthropic and OpenAI, not your entire collection. Under their terms, neither provider uses content submitted through their API to train their models.

5. Transfer to the United States

Anthropic, OpenAI and Stripe process data in the United States. The transfer is based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR, unless the provider concerned is certified under the EU-US Data Privacy Framework.

Despite these measures, access by US authorities cannot be ruled out. If you want to avoid this, do not upload material that is particularly sensitive to you.

6. How long data is kept

Documents and account remain until you delete them. If you delete your account, documents, text passages, search vectors and shares are deleted with it.

Versions. If you replace a document, the previous version stays available until you remove it.

Logs are currently not deleted automatically. They are deleted once no longer needed for operation and troubleshooting, at the latest when the account is deleted.

Invoice records are kept for ten years. This is a statutory obligation and continues to apply after an account is deleted.

7. Cookies

DocMind only sets technically necessary cookies. There are no advertising or analytics cookies and no disclosure to third parties for such purposes.

session cookie — keeps you signed in. Expires on sign-out or at the end of the session.

lang — remembers the selected language. One year.

dm_theme — remembers light or dark appearance. One year.

No consent is required for technically necessary cookies under section 25(2) TDDG.

8. Shares

If you share a document via a link, anyone holding that link can retrieve it — subject to the conditions you set, such as a password or an expiry date. A share can be revoked at any time.

You are responsible for passing on the link. If the document contains other people's data, you are the controller for that disclosure within the meaning of the GDPR.

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR).

Much of this is implemented directly in the application: documents can be deleted individually, the account can be deleted in full, and your documents can be downloaded as an archive.

For anything else, a message to info@geekinfinity.net is enough.

10. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the country of your residence, place of work, or of the alleged infringement.

The authority responsible for the controller is:
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany

11. Obligation to provide data

An email address is required to create an account; without it the service cannot be used. All other details are optional.

There is no automated decision-making producing legal effects concerning you under Art. 22 GDPR. The analysis of your documents produces suggestions, not decisions.

12. Changes to this policy

This policy is updated when the service or the legal situation changes. The version in force is available here; the version number and date are shown at the top.