Privacy Policy

Summary

• DocsWO provides online document tools that work on our servers with the files you upload from your browser.
• You do not need an account. If you create one, we only ask for your email address; we do not use passwords.
• Uploaded files are deleted automatically within 24 hours, and results 2 hours after they are created. You can delete them yourself sooner.
• We process your files only to perform the operation you choose. We do not sell the content or use it for advertising or to train artificial intelligence.
• We use no advertising, analytics or tracking tools. The only cookies are those the service needs to work: Cookie Policy.
• Paid plans cannot be purchased yet.

Data controller

The controller of your personal data is the following company established in Bulgaria ("we"):

• Name: GRAFIT 2025 EOOD
• Address: str. San Stefano 2B, ent. A, 6600 Kardzhali, Bulgaria
• Company number (UIC/EIK): 208399521 (VAT number: BG208399521)
• Contact: info@docswo.com

What data we process

Details

• File content. Your files are stored in a private storage area on our server under a random key that does not contain the file name, and they are accessible only from your session. Content is processed automatically and only for the operation you choose. The scan tool finds the edges of the document in a photo using image processing; the service does not currently read the text in your files (there is no text recognition) and does not use artificial intelligence on the content.
• File names are not written to storage keys or technical logs.
• Deletion. You can delete your files and results at any time with the "Delete files now" button on the tool screen; otherwise they are deleted automatically within the periods above. Deleted files cannot be recovered.
• Use without an account. If you use the service without an account, we recognise you only by a random session ID; we do not ask for your name or email address.
• Sign-in. We do not use passwords. To sign in, we send a single-use link to your email address. We store only an irreversible hash (SHA-256) of the link and of the session token, not the values themselves.
• Usage limit. To apply the daily job limit of the free plan, we count your jobs in the last 24 hours.
• Request limit. To prevent abuse, we apply a per-minute request limit by IP address. This counter is kept only in memory and resets within one minute.
• Operational events. To monitor the health of the service, we record events that contain no personal data or file information (tool type, duration, error code).

Service providers and other parties

What we do not do. We do not sell your personal data. The site has no advertising, analytics tools, social media plug-ins or tracking pixels. Fonts are served from our own server.

Service providers. The following process data on our behalf and on our instructions:

• Hosting (server): Mavihost (infrastructure: BitCommand), Netherlands (Amsterdam). The server that runs the site and processes your files; all data in this policy.
• Cloudflare, Inc. (USA): domain name (DNS) service and the security and content delivery layer in front of the site; IP address and request information.
• Email: our own email server (infrastructure: BitCommand), Bulgaria (Sofia). Sending sign-in link emails and handling support correspondence; email address and email content.

Images. Photos on the site are loaded from Unsplash's image server (images.unsplash.com). When this happens, your browser sends your IP address and browser information to Unsplash; only the site name is sent, not the page you are on. In our measurement this server does not set cookies.

Payment. Paid plans cannot be purchased yet. When purchasing opens, we will add the payment provider and the data it processes to this policy.

Who receives your data and international transfers

Personal data we hold may be disclosed only for the purposes described in this policy and only as needed to:

• the service providers above, processing on our behalf and on our instructions,
• public authorities and courts where the law requires us to provide information.

We are established in the European Union (Bulgaria), and our servers are in the EU (the Netherlands and Bulgaria). When you use the service from Türkiye, your data is collected directly by us, without an intermediary in Türkiye, and processed on these servers. Of our service providers, only Cloudflare (USA) is outside the European Economic Area (EEA); this transfer relies on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework and on the standard contractual clauses in Cloudflare's data processing agreement. You can request a summary of these safeguards at info@docswo.com.

Security

Connections to the site are encrypted with HTTPS. The session cookie cannot be read by scripts on the page (HttpOnly). Sign-in links and session tokens are stored only as hashes. Files are kept in a private storage area under random keys, are accessible only from the session that owns them and are deleted automatically. Every uploaded file passes a format and size check before it is processed.

No system is completely secure. If we learn of a security breach affecting your personal data, we will notify you and the competent authority as the law requires.

Your choices and rights

You can delete your files and results immediately with the "Delete files now" button, sign out of your account and delete cookies in your browser. To have your account deleted, write to info@docswo.com from the email address on your account; when your account is deleted, its sessions are deleted too.

Depending on where you live, you have the right to access, correct, delete, restrict processing of, object to the processing of and receive a copy of your data. Write to info@docswo.com; we may ask for the information needed to verify your identity. We respond within the time required by the applicable law (for example one month under the GDPR and at most 30 days under the KVKK).

European Economic Area and United Kingdom (GDPR)

Under the GDPR you have the rights of access, rectification, erasure, restriction of processing, data portability and objection (art. 15-21), and the right to lodge a complaint with the supervisory authority of the country where you live, work or where you believe the infringement took place (art. 77). In Bulgaria, where we are established, the supervisory authority is the Commission for Personal Data Protection (Комисия за защита на личните данни, cpdp.bg). In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO).

Our legal bases: performance of a contract to provide the service you request (art. 6(1)(b)); legitimate interests for security, abuse prevention and support (art. 6(1)(f)); legal obligation for records we must keep by law (art. 6(1)(c)). Who receives your data and international transfers are described above.

Türkiye: KVKK information notice

For users in Türkiye, this section is the information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). This notice does not ask for explicit consent; your data is processed on the legal bases below.

Data controller (art. 10/a). GRAFIT 2025 EOOD, str. San Stefano 2B, ent. A, 6600 Kardzhali, Bulgaria, info@docswo.com.

Method of collection (art. 10/ç). Data is collected electronically when you use the site, through your uploads and input (files, email address) and automatically (session cookie, technical logs).

Transfers (art. 10/c). Personal data is disclosed only to the recipients listed above under "Who receives your data" and for the stated purposes. Where the data is processed and the basis for transfers outside Europe are also described there.

Your rights (art. 11). By applying to the data controller, you have the right to:

• learn whether your personal data is processed,
• request information about it if it has been processed,
• learn the purpose of processing and whether it is used for that purpose,
• know the third parties in Türkiye or abroad to whom it is disclosed,
• request correction if it is incomplete or inaccurate,
• request deletion or destruction under the conditions of Article 7 of the KVKK,
• request that correction and deletion be notified to third parties to whom the data was disclosed,
• object to a result against you arising from analysis exclusively by automated systems,
• claim compensation if you suffer damage because of unlawful processing.

Application (art. 13). You can send your request in writing or by the other methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller (for example by registered electronic mail or from the email address registered in our system) to info@docswo.com or to str. San Stefano 2B, ent. A, 6600 Kardzhali, Bulgaria. Your application must include your name and surname (and signature for written applications), your Turkish ID number (for foreigners, nationality and passport or ID number), your address for notifications, your email and telephone if any, and the subject of your request. We conclude applications as soon as possible depending on their nature and within thirty days at the latest, free of charge as a rule; if the process involves an additional cost, a fee under the tariff set by the Board may be charged.

Complaint to the Board (art. 14). If your application is rejected, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board within thirty days of learning of the answer, and in any case within sixty days of the application date.

California

If the California Consumer Privacy Act (CCPA) applies to us, you can ask what personal information we hold and request that it be deleted or corrected; you will not be treated differently for exercising these rights. We do not sell personal information or share it for cross-context behavioural advertising.

Children

DocsWO is not designed for people under 18, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, write to info@docswo.com and we will delete it.

Changes to this policy

When we change this policy, we update the date and version at the top and publish the new version at this address. If a change significantly affects how your data is processed, we will also announce it on the site.

Contact

• GRAFIT 2025 EOOD
• str. San Stefano 2B, ent. A, 6600 Kardzhali, Bulgaria
• info@docswo.com