Privacy Policy

How DocuVault collects, uses and protects your personal data and your family’s documents.

Last updated: 30 Sept 2026

1. The short version

Your files are encrypted with a key that belongs to your household alone.
We use AI to read the documents you upload and, when you use Ask, to answer your questions about them. Your documents and questions are never used to train AI models.
We do not sell your data and we do not use it for advertising.
You decide who in your household sees each document, and you can export or delete your data at any time.

2. Who we are

DocuVault is operated by [Company legal name] (“we”, “us”). We decide why and how the personal data described in this policy is processed, so we are its controller. Some local laws use a different term, such as “controlling entity” or “data manager”.

You can contact us about privacy, including our data protection officer where we have appointed one, at support@oneindustry.ai.

3. What we collect

Account details: your email address, name, preferred language and reminder settings, a phone number if you choose to add one, and a record of which version of our Terms and this policy you accepted, and when.
If you sign in with Google: your Google account ID, email address and name. We never receive your Google password, and we get no access to your Gmail, Drive, contacts or anything else in your Google account.
Household details: the household name and country, its members and their roles, and the people you add (name, relationship and nationality).
Documents: the files you upload, the text written on them, and the details read from them or entered by you, such as document type, number, holder name, issue and expiry dates, and notes.
Ask conversations: the questions you type or speak and the answers you receive. If you speak a question, the recording is converted to text and not kept.
Billing details: if you subscribe, our payment processor Stripe collects your payment details. We receive only a customer reference, your plan, its status and renewal date. We never see or store your full card number.
Security and technical data: your active sign-in sessions (a description of the device and browser, and the IP address), an activity log of actions in your household such as viewing, downloading, sharing or changing a document (including who did it and from which IP address), and one-time sign-in codes, which we store only in hashed form.
Messages you send us, for example when you contact support.

We get this data from you, from other members of your household (for example, when an owner invites you or adds you or your children as People), from Stripe about your subscription, and automatically when you use the service.

If you add information about other people, such as relatives, please make sure you are allowed to, let them know, and point them to this policy.

4. Identity documents and sensitive data

Passports, IDs, residence permits and similar documents can contain sensitive information, such as your date of birth, nationality, photograph and the machine-readable zone. Some laws also treat information about children or family relationships as sensitive. You upload these documents so your family can keep them organized and find them when needed, and we process them only to provide that service to you.

Where the law requires your explicit consent to process this kind of data, you give it by choosing to upload a document and confirming its details. You can withdraw it at any time by deleting the document. Withdrawing consent does not affect processing that happened before.

We do not use your photo for facial recognition or to identify you, and we do not use your documents to build a profile of you.

5. How we use your data, and why

Store your documents and show them to the household members you choose: Data used: Account, household and document data; Legal basis: Performing our contract with you
Read a document’s details and text with AI so you don’t have to type them: Data used: The uploaded document; Legal basis: Performing our contract; your explicit consent for sensitive data
Answer your questions about your documents (Ask), by text or voice, and read answers aloud if you ask: Data used: Your questions and conversation, the documents you are allowed to see, and voice recordings while they are converted to text; Legal basis: Performing our contract; your explicit consent for sensitive data
Send sign-in codes, invitations and the reminders you set: Data used: Email address, document titles and dates; Legal basis: Performing our contract with you
Take payments and keep invoices: Data used: Billing details; Legal basis: Performing our contract; our legal obligations for tax and accounting
Keep accounts and documents secure, prevent abuse, and keep the activity log: Data used: Security and technical data; Legal basis: Our legitimate interest in protecting you and the service; our legal duty to keep data secure
Record that you accepted our Terms and this policy: Data used: Accepted version, date and time; Legal basis: Performing our contract; our legitimate interest in showing what was agreed
Answer your messages and support requests: Data used: Your messages and account details; Legal basis: Performing our contract; our legitimate interest in helping you
Comply with the law, and establish or defend legal claims: Data used: The data relevant to the matter; Legal basis: Our legal obligations; our legitimate interest in protecting our rights
Measure how the service is doing, such as how many households subscribe, change plan or leave, and what running it costs: Data used: Plan changes, daily counts of members, activity, documents and storage, and AI usage, recorded under a random number rather than your name or email; Legal basis: Our legitimate interest in running and improving the service

Purpose	Data used	Legal basis
Store your documents and show them to the household members you choose	Account, household and document data	Performing our contract with you
Read a document’s details and text with AI so you don’t have to type them	The uploaded document	Performing our contract; your explicit consent for sensitive data
Answer your questions about your documents (Ask), by text or voice, and read answers aloud if you ask	Your questions and conversation, the documents you are allowed to see, and voice recordings while they are converted to text	Performing our contract; your explicit consent for sensitive data
Send sign-in codes, invitations and the reminders you set	Email address, document titles and dates	Performing our contract with you
Take payments and keep invoices	Billing details	Performing our contract; our legal obligations for tax and accounting
Keep accounts and documents secure, prevent abuse, and keep the activity log	Security and technical data	Our legitimate interest in protecting you and the service; our legal duty to keep data secure
Record that you accepted our Terms and this policy	Accepted version, date and time	Performing our contract; our legitimate interest in showing what was agreed
Answer your messages and support requests	Your messages and account details	Performing our contract; our legitimate interest in helping you
Comply with the law, and establish or defend legal claims	The data relevant to the matter	Our legal obligations; our legitimate interest in protecting our rights
Measure how the service is doing, such as how many households subscribe, change plan or leave, and what running it costs	Plan changes, daily counts of members, activity, documents and storage, and AI usage, recorded under a random number rather than your name or email	Our legitimate interest in running and improving the service

Where a local law does not recognize legitimate interests as a legal basis, we rely on another basis that law provides, such as performing our contract with you or complying with our legal duty to keep data secure.

We do not sell your personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

6. How we use AI

When you upload a document, the file is sent over an encrypted connection to an AI model provider that processes it on our behalf, to read its details and write out the text on each page. The details it returns are a suggestion: you review and correct them before they are saved. The text is encrypted like the rest of your document data.

To let you search and ask about your documents, we also turn their text into search data called embeddings. Embeddings are stored without encryption so they can be searched, but they are kept separate for each household, and our systems only use a document to answer someone who is allowed to see it.

When you ask a question in Ask, your question, your recent messages in that conversation, and the relevant parts of the documents you can see are sent to the AI model provider to write the answer. If you speak a question, the recording is sent to a speech provider to be converted to text and is not kept. If you choose to hear an answer, its text is sent to be converted to speech.

Answers are generated by AI and can be wrong or incomplete. They show which documents they come from so you can check, and they are not legal, immigration or other professional advice.

We only use AI providers whose terms prohibit using your content to train their models and limit how long they keep it to what is needed to provide and secure their service. The provider may be located in another country (see International transfers).

Household members: owners always see every document and the household’s activity log. For each document, you choose whether all members with full access, owners only, or selected members can see it.

Ask conversations are private to the person who had them: other members, including owners, cannot see them, and answers only draw on the documents that person is allowed to see.

People you share with: anyone who has a share link you created can view that document until the link expires, reaches its view limit, or you revoke it.

Service providers who process data for us under contract, and only for the purposes above:

Hosting and storage: What they do for us: Run the service and store your encrypted files and our databases
AI model provider: What they do for us: Read documents you upload, answer your questions in Ask, and convert speech to text and text to speech
Email delivery: What they do for us: Send sign-in codes, invitations and reminders
Google (optional sign-in): What they do for us: Confirm who you are when you choose Continue with Google. Google handles your Google account as an independent controller under its own privacy policy.
Stripe: What they do for us: Process payments and manage subscriptions. For some payment data, such as fraud prevention, Stripe is an independent controller under its own privacy policy.

Provider	What they do for us
Hosting and storage	Run the service and store your encrypted files and our databases
AI model provider	Read documents you upload, answer your questions in Ask, and convert speech to text and text to speech
Email delivery	Send sign-in codes, invitations and reminders
Google (optional sign-in)	Confirm who you are when you choose Continue with Google. Google handles your Google account as an independent controller under its own privacy policy.
Stripe	Process payments and manage subscriptions. For some payment data, such as fraud prevention, Stripe is an independent controller under its own privacy policy.

You can ask us for the current list of the providers we use at support@oneindustry.ai.

We may also disclose data when the law requires it, for example to comply with a valid order from a court or authority. If the business is sold or merged, your data may pass to the new operator, who must keep protecting it as this policy describes, and we will tell you before that happens.

8. How we protect your data

Every household has its own encryption key. Files are encrypted with it before they are stored, and all traffic uses HTTPS.
Document numbers, the text read from your documents, the raw results of AI reading and your Ask conversations are also encrypted in our database.
Access is limited by household roles and per-document visibility, and owners can review who viewed, downloaded, shared or changed each document.
You sign in with a one-time code sent to your email, or with your Google account, and you can see and sign out your other devices from Settings.
Reminder emails contain only document titles and dates, never images of your documents.

No system is completely secure. If a breach affects your personal data, we will notify the relevant authorities within the time the law sets, and we will tell you without undue delay where the breach is likely to affect you, together with the steps you can take to protect yourself.

9. How long we keep data

Account details: How long we keep it: Until you delete your account
Documents, their details, text and search data: How long we keep it: Until you delete the document, its household or your account
Ask conversations: How long we keep it: Until you delete them, leave the household or delete your account
Voice recordings: How long we keep it: Not kept: converted to text, then discarded
Household activity log: How long we keep it: As long as the household exists
A locked household (one without a plan it can use): How long we keep it: Kept while it is locked. If it stays locked for more than a month we may delete it, after telling its owner
Sign-in sessions: How long we keep it: Until you sign out or the session expires after 30 days
One-time sign-in codes: How long we keep it: Valid for 10 minutes, deleted within 1 day
Support messages: How long we keep it: As long as needed to deal with your request and any follow-up
Database backups: How long we keep it: Up to 14 days, after which they are deleted
Billing records: How long we keep it: As long as tax and accounting laws require
Service statistics (plan changes, daily counts, AI usage): How long we keep it: Kept after deletion, without your name, email or documents

Data	How long we keep it
Account details	Until you delete your account
Documents, their details, text and search data	Until you delete the document, its household or your account
Ask conversations	Until you delete them, leave the household or delete your account
Voice recordings	Not kept: converted to text, then discarded
Household activity log	As long as the household exists
A locked household (one without a plan it can use)	Kept while it is locked. If it stays locked for more than a month we may delete it, after telling its owner
Sign-in sessions	Until you sign out or the session expires after 30 days
One-time sign-in codes	Valid for 10 minutes, deleted within 1 day
Support messages	As long as needed to deal with your request and any follow-up
Database backups	Up to 14 days, after which they are deleted
Billing records	As long as tax and accounting laws require
Service statistics (plan changes, daily counts, AI usage)	Kept after deletion, without your name, email or documents

You can delete your account once you own no household: each household you own is first handed to another member, who has to accept, or deleted with its files. Then we delete your user record. Documents belong to the household they were added to, so documents you added to a household someone else owns stay in that household.

Deleted data can remain in our backups for up to 14 days before it is removed.

10. Your rights

Depending on where you live, you have the right to:

know how your data is processed, which is what this policy explains;
access your data and get a copy of it: household owners can download every file and a summary of the records from Settings at any time;
correct inaccurate data, which you can do directly in the app;
delete your data, including your whole account from Settings;
object to processing based on our legitimate interests, ask us to restrict some processing, and withdraw any consent you have given;
receive your data in a portable format.

To use a right that you cannot use directly in the app, email support@oneindustry.ai. If someone else added your data, for example a relative who added you as a Person, you can also contact us. We may ask you to confirm your identity first. We will reply within 30 days. If a request is complex, or you send many requests, we may extend this where the law allows, and we will tell you why. Requests are free unless they are clearly unfounded or excessive.

You can also complain to the data protection authority where you live, for example:

United Arab Emirates: the UAE Data Office;
Saudi Arabia: the Saudi Data and Artificial Intelligence Authority (SDAIA);
Qatar: the National Data Privacy Office at the National Cyber Security Agency;
Bahrain: the Personal Data Protection Authority;
Oman: the Ministry of Transport, Communications and Information Technology;
European Union: the data protection authority in your country; United Kingdom: the Information Commissioner’s Office (ICO).

We would welcome the chance to deal with your concern first, but you do not have to contact us before you complain.

11. Laws we follow

We process personal data in line with the laws that apply to you, including:

United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data;
Saudi Arabia: the Personal Data Protection Law issued by Royal Decree No. M/19 of 9/2/1443H, as amended, its Implementing Regulations, and the Regulation on Personal Data Transfer outside the Kingdom;
Qatar: Law No. 13 of 2016 on the Protection of Personal Data Privacy;
Bahrain: Law No. 30 of 2018 on the Protection of Personal Data;
Oman: the Personal Data Protection Law issued by Royal Decree No. 6/2022, and its Executive Regulation;
the EU General Data Protection Regulation (GDPR), and in the United Kingdom the UK GDPR and the Data Protection Act 2018, where they apply.

In Kuwait, the main data privacy rules, the Data Privacy Protection Regulation issued by the Communication and Information Technology Regulatory Authority (CITRA), apply to licensed telecommunications and IT providers. Whether or not they apply to us, we give users in Kuwait, and everyone else, the protections described in this policy.

12. International transfers

Our servers and service providers, including the AI model provider and Stripe, may be located outside your country. We transfer personal data across borders only where the law allows it and with the safeguards it requires, such as a decision that the destination country protects personal data adequately, standard contractual clauses approved by the relevant authority, or another mechanism the law permits.

You can ask us at support@oneindustry.ai where your data is processed and which safeguards apply.

13. Children

Accounts are only for people aged 18 or over, and everyone confirms this before using the service. Please invite only adults to your household.

Parents and legal guardians can add their children as People in their household and store their children’s documents there. Children do not get accounts and cannot sign in. By adding a child or their documents, you confirm that you are their parent or legal guardian, or are otherwise authorized to do so, and that you act in the child’s best interests and on their behalf.

Where the law requires a parent’s or guardian’s consent to process a child’s data, you give it by adding the child and their documents, and you can withdraw it at any time by deleting them. We use children’s data only to provide the service to your household, never for advertising or profiling. When a child becomes an adult, they can contact us to exercise their own rights over their data.

We do not knowingly create accounts for anyone under 18. If we learn that one exists, we will delete it. If you believe this has happened, contact us at support@oneindustry.ai.

14. Cookies

We only use cookies that are needed to keep you signed in and remember your preferences. We do not use advertising, analytics or tracking cookies. Our Cookie Policy lists them all.

15. Changes to this policy

If we make material changes, we will tell you by email or in the app before they take effect, and ask you to accept the updated version before you continue using the service. The date at the top shows when this policy last changed.