Privacy notice

Version 1.7.2 · effective 1 December 2026

This notice explains which personal data we process when you use Docuvoza, for what purposes, on which legal basis, who receives it and how long we keep it. It is based on Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").

1. Controller

The controller for the processing of your data in Docuvoza is:

Amikem Chemeza Herve, sole proprietorship under German law ("Einzelunternehmen"), trading as "Docuvoza"
Am Hinterfeld 39 A
84028 Landshut
Germany

Email: contact@docuvoza.com

Please send questions about data protection and requests to exercise your rights to privacy@docuvoza.com or by post to the address above.

2. Data protection officer

We have not appointed a data protection officer because we are not required to: fewer than 20 people at our business are permanently engaged in the automated processing of personal data (section 38(1) of the German Federal Data Protection Act, BDSG); our core activities consist neither of regular and systematic monitoring of individuals on a large scale nor of large-scale processing of special categories of data (Art. 37(1) GDPR); and we carry out no processing that requires a data protection impact assessment.

3. In short

• Docuvoza is currently free of charge. There are no accounts and no payments.
• Many tools run entirely in your browser. Your file is then not sent to us.
• Some tools need a server. The file is then sent to servers in the EU and deleted no later than 60 minutes after upload.
• For the free allowance and protection against abuse, we set one strictly necessary cookie (dv_anon) as soon as you use a server tool or an AI feature. We set no tracking or advertising cookies.
• The AI features are optional. They are operated by our AI provider (data centres in the EU).
• Voice input ("Speak") is optional. The microphone only records when you press the button and allow it in your browser. We do not store your recording.
• If you sign up via "Notify me at launch", we process your email address and a few details about your work with your consent, only at our email and SMS delivery provider (EU).
• We do not sell data and we do not analyse the content of your documents.

4. Visiting the website and server logs

Purpose: When you open Docuvoza, your browser has to send data to our servers so that we can deliver the pages. We log requests to find errors, keep the service stable and detect and fend off attacks.

Data: IP address, date and time, the address requested, status code, amount of data transferred, browser and operating system (user agent) and technical error messages. For operations, our application logs only technical details (operation number, tool, duration, errors). The content and names of your files, passwords and the email addresses entered in "Notify me at launch" are not in the logs.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is secure, stable and error-free operation of the website.

Recipient: our hosting provider (data centres in the European Union), as our processor, which runs our servers and stores the logs.

Transfers outside the EU: none.

Retention: logs are deleted automatically after 14 days, the detailed troubleshooting lines after 48 hours.

Error number: If something goes wrong, we show an error number. It points to the log lines of that operation. If you send us the number, we can find the error. We then link your message to these lines (section 15). We collect no new data for this.

"Turn on troubleshooting": If you click "Turn on troubleshooting" yourself, we log in more detail for 15 minutes what happens in this session: steps, duration, size and type of files, and technical error details. We do not log the names or content of your documents. For this we put a random code in the storage of this browser tab. It disappears when you close the tab. During the 15 minutes our site sends the code along so that we can match the log lines. Troubleshooting ends by itself after 15 minutes. Turning it on is also logged. We delete the detailed log lines after 48 hours. The legal basis is Art. 6(1)(f) GDPR; our interest is finding errors that you report to us. We store the code because you request the function yourself (Art. 5(3) of Directive 2002/58/EC; section 25(2) no. 2 TDDDG).

5. Domain name management (DNS)

The name resolution (DNS) for our domain is managed by our DNS provider, based in the USA. When your device looks up docuvoza.com, it is usually your internet provider's DNS server that queries our DNS provider, not your device itself. The DNS provider therefore usually does not receive your IP address.

6. Tools that run in your browser

What happens: Merge, split, organise, images to PDF, PDF to JPG, PDF to Word, scan, annotate, watermark, sign, fill in a form, form designer, "Create a document" and the workspace process your file entirely on your device. The file is not sent to us. We see neither its content nor its name.

Exception for Office files: If you use a Word or other Office file when merging or in the form designer, we convert that file to PDF on our server. Section 7 then applies to that file (upload, deletion after 60 minutes at the latest, counted against the allowance). The rest of the process stays in your browser.

Exception for voice input: If you dictate with "Speak" in one of these tools, your voice recording is sent to our server. There it is converted into text and not stored (section 10, voice input). Your file still stays in your browser.

Storage in your browser: So that reloading the page loses nothing, your browser keeps a working copy of your documents in its local storage. It is deleted 7 days after the last change, or at once when you choose "Start over". Signatures you choose to "remember on this device" (at most 3), the draft in "Create a document" and your favourite and recently used templates also stay only in your browser until you delete them. This data does not leave your device; we have no access to it. An overview is in section 14.

Note on the "Sign" tool: The signature is inserted into the PDF as an image. This is a simple electronic signature within the meaning of Art. 3(10) of Regulation (EU) No 910/2014 (eIDAS): no certificate, no time stamp and no identity check.

Legal basis: For storage in your browser, the exemption for storage that is strictly necessary to provide the service you explicitly requested (Art. 5(3) of Directive 2002/58/EC, implemented in Germany by section 25(2) no. 2 TDDDG). We do not receive any personal data from these tools.

7. Tools that run on our servers

Purpose: Convert (for example Word to PDF), compress, protect and unlock need software that does not run in a browser. The same applies to converting Office files when merging and in the form designer (section 6).

Data: the file you upload (with all the content it contains), the password entered for protect or unlock, and details of the operation (see below).

Process and retention:

• The file is transferred in encrypted form, stored with our provider of object storage and backups (data centres in the EU, France) and processed on our servers at our hosting provider (data centres in the European Union).
• The file and the result are deleted no later than 60 minutes after upload. "Delete now" on the result deletes them at once.
• Passwords for protect and unlock serve only that operation. They are held for at most 10 minutes in a cache on our servers in the EU, deleted as soon as the operation ends, and never written to our database or logs.
• For each operation, our database stores: tool, status, number, type, size and page count of the files, timestamps, the outcome of the operation and the identifier from the dv_anon cookie (section 8). It does not store the name or content of your file. We remove the identifier 90 days after the operation; after that, only details without any link to your browser remain, for our usage statistics.
• Backups of our database (without files) are kept for at most 30 days; a deletion takes effect there after 30 days at the latest.

Content of your files: We do not analyse or look at the content. Processing is automated and serves only the operation you start. Please upload only files you are entitled to work on. If a file contains special categories of personal data (such as health data) or data about other people, we likewise process it only to carry out the operation you started and delete it within the periods above.

Legal basis: Art. 6(1)(b) GDPR: under the terms of use, you ask us to work on your file. For the details of the operation, Art. 6(1)(f) GDPR; our legitimate interest is counting the allowance, detecting abuse and tracing errors.

Recipients: our provider of object storage and backups (data centres in the EU, France) and our hosting provider (data centres in the European Union), each as our processor. Office files are converted with software we run ourselves on these servers; no other provider receives the file.

Transfers outside the EU: none.

8. Free allowance, abuse protection and the "dv_anon" cookie

Purpose: Without an account, server tools and AI features are free up to a limited amount (for the launch 50 operations per week, of which at most 10 AI requests; after the launch 15, of which at most 3). To count this and fend off abuse, we need an identifier for your browser and we limit requests per network address.

dv_anon cookie: When you start a server tool or an AI feature, our server sets the dv_anon cookie. It contains a randomly generated identifier that reveals nothing about you. Only our server can read it (HttpOnly), and it expires after 365 days. You can delete it in your browser at any time; the allowance for that browser then starts again, and an additional check (section 9) may become necessary.

Other data used for counting and abuse protection:

• counters of operations per identifier and week, which expire 7 days after the end of the week;
• a counter per network address and week. For this we do not store your IP address but a check value (hash) derived from the IP address with a secret value, which changes every week; it expires 7 days after the end of the week;
• short-term limits per minute or hour, derived from a hash of the IP address or of the identifier; they expire after 1 hour at the latest (after 20 minutes at the latest for AI requests);
• risk signals, for example whether a page was viewed before the operation, whether the cookie is new, whether invalid requests repeat or whether the browser is recognisable as a script. They expire after 1 hour up to 2 days at most. We check the browser identifier (user agent) only in memory and do not store it;
• if a network address is blocked or flagged for abuse, this lasts 24 hours. We record the flag with the hash of the address and the reason; this record is deleted after 12 months.

Legal basis:

• For setting and reading the cookie: the exemption for storage that is strictly necessary to provide a service explicitly requested by you (Art. 5(3) of Directive 2002/58/EC; section 25(2) no. 2 TDDDG). The cookie is essential to provide you with free use of the server tools within the allowance. We therefore set it only when you start such a tool and use it for nothing else, in particular not for statistics or advertising.
• For the further processing: Art. 6(1)(f) GDPR. Our legitimate interest is a fair free offer that is not exhausted by automated or abusive use.

Recipient: our hosting provider (servers, cache, database), as our processor.

Transfers outside the EU: none.

9. Protection against automated access

Purpose: If you start a server tool or an AI feature without an account and one of the risk signals in section 8 occurs, we use a service that protects against automated access (provider based in the USA) to check that a human is making the request. Genuine users usually do not see the check. Without a risk signal, this service is not loaded; we do not use it on the "Notify me at launch" form.

Data: When the service loads, your browser connects to the provider's servers. The provider processes your IP address and technical features of your browser and device, which the service reads in your browser. Our server sends the check result (token) and your IP address to the provider to have it confirmed.

Legal basis: For access to your device, the exemption for strictly necessary access (Art. 5(3) of Directive 2002/58/EC; section 25(2) no. 2 TDDDG): the check takes place only when a risk signal occurs, to protect the free service from automated exploitation. For the further processing, Art. 6(1)(f) GDPR; our legitimate interest is protecting the service from abuse.

Recipient: a service that protects against automated access (provider based in the USA), as our processor.

Transfers outside the EU: USA, see section 17.

Retention: we do not keep the check result beyond the operation. The provider keeps the data for as long as is necessary to provide the service.

10. AI features ("Create with AI", "Change with AI")

Purpose: In the "Create a document" tool you can have an AI system propose a draft form or document, or change an existing draft. Use is optional.

Data: Only when you use the feature do we send your description and, for a change, the document's structure with its texts (title, introduction, headings, labels, text blocks and default values) and the values the AI itself filled in. These texts are sent even if you wrote them yourself. Not sent: values you entered yourself in fields and tables, photos, signatures, other people's answers and your letterhead. Please do not include in the description any details about people that the draft does not need.

Provider: The language model is operated by our AI provider (data centres in the EU), as our processor. It processes the data only to generate the proposal.

On our side: We do not use your input for training. So that a retry is not counted twice against your allowance, we hold the finished proposal for at most 5 minutes in a cache on our servers in the EU. We log only details without content: model, number of text units processed (tokens), cost, duration and outcome. Each AI request counts as one operation in the allowance (section 8); if a risk signal occurs, the service that protects against automated access may be loaded (section 9).

Labelling: Proposals are marked "AI draft". They are generated by an AI system and may contain errors. Please check the content, prices, terms and legal details before you use a proposal. The AI makes no decisions about you.

Legal basis: Art. 6(1)(b) GDPR: you expressly request the proposal. For the logs without content, Art. 6(1)(f) GDPR (counting the allowance, cost control, troubleshooting).

Recipients: our AI provider (data centres in the EU) and our hosting provider (servers, cache), each as our processor.

Transfers outside the EU: none.

Retention: proposal in the cache: at most 5 minutes; logs without content: 14 days; aggregated cost and usage figures without any link to a person: up to 400 days. At the AI provider: for as long as is necessary to provide the service.

Voice input ("Speak")

Purpose: You can dictate text instead of typing it. You will find the microphone button "Speak" in "Create with AI" and next to multi-line text fields in the form designer and when filling in a form. We convert your speech into text and insert the text into the field. Use is optional. You do not need an account.

Microphone: Recording only starts when you press the button. Your browser then asks whether our site may use the microphone. Without your permission we record nothing. A recording lasts at most 90 seconds. You can stop it earlier. We store nothing on your device for this.

Data: your voice recording and the text produced from it. The recording contains everything you say. It may also contain details about other people or health data if you say such things. Please only say what belongs in the field. We do not use your voice to recognise or identify you. We do not analyse emotions or moods either.

How it works:

• Your browser sends the recording to our server in encrypted form. A recording may be at most 3 MB.
• Our server passes the recording to the service that converts speech into text. This service runs either on our own servers in the EU or at our AI provider in the EU.
• The text comes back into the field. You can check and change it.
• In "Create with AI", the text only goes to the AI when you send the AI request yourself (see above).
• Voice input is counted against the free allowance by speaking time (section 8). For this we store your remaining speaking time in seconds with the identifier from the dv_anon cookie. No content is included. If a risk signal occurs, the check that protects against automated access may be loaded (section 9).

Storage on our side: We process the recording and the text in memory only. We do not store either of them. We do not write either of them to logs. We log only details without content, such as duration, size and outcome. We do not use your recordings for training.

At the AI provider: If the conversion runs at our AI provider, it processes the recording as our processor. Under its contract, it does not store the content of requests, does not write it to logs and does not use it to train its models. There is one exception: if a request shows an error or a suspicion of misuse, the provider may keep its full content temporarily. This then includes the recording. According to its public information, this is for up to 2 weeks. It uses the content only to find the cause or a security vulnerability.

Legal basis: Art. 6(1)(b) GDPR: you start the conversion yourself. For the logs without content, Art. 6(1)(f) GDPR (allowance, cost control, troubleshooting). For access to the microphone, Art. 5(3) of Directive 2002/58/EC as implemented in Germany by § 25(2) no. 2 TDDDG: we use it only when you press the button and only for the feature you requested.

Recipients: depending on the setting, our hosting provider (data centres in the EU, our own servers) or our AI provider (data centres in the EU), each as our processor.

Transfers outside the EU: none.

Retention: We do not store the recording or the text. Remaining speaking time: up to 365 days after your last voice input. Logs without content: 14 days. At the AI provider: only requests showing an error or a suspicion of misuse, temporarily (according to the provider, up to 2 weeks).

Obligation to provide data: none. You can always type the text instead.

11. "Notify me at launch": waiting list and beta application

Purpose: The "Notify me at launch" form lets you (a) join the waiting list to be told by email when Docuvoza accounts and Signovoza start for everyone, or (b) apply for the beta to receive an invitation and news about the beta and the launch. The beta only starts once the future company operates Docuvoza (section 24). If you consent, we also write to you with:

• requests for feedback, for example a short survey or a short call;
• no more than once, a request to write a voluntary public review on a review platform. This request goes to everyone who consented, not only to satisfied users. There is nothing in return for a review.

We use your line of work, team size and country to choose beta testers deliberately, for example from different countries and lines of work. We use how you heard about us and any partner or campaign code to see which channels bring people to us.

Data:

• Required: email address, language, your choice (waiting list or beta), line of work or industry (for "Other", your own text), team size, country, your consent and the version of the consent text; for the beta also your name.
• Optional: how you heard about us; for the beta, your intended use.
• Partner or campaign code: If you reach our page through a link with such a code (for example from a partner or a campaign), we take the code from the page address into your entry. We set no cookie for this and store nothing in your browser.
• Our email and SMS delivery provider also records the time of your sign-up and of your confirmation.

Where the data is kept: We store all these details only at our email and SMS delivery provider (EU), as attributes of your contact. They are not in our own database or in our logs.

Double opt-in: So that nobody can enter someone else's address, you first receive an email with a confirmation link. You are on the list only after you click it. Sign-up goes directly through this provider. To prevent abuse we limit the number of sign-ups per address and per network; for this we store only check values (hashes) that expire after a short time.

Legal basis: your consent (Art. 6(1)(a) GDPR; for the emails also Art. 13 of Directive 2002/58/EC, in Germany section 7(2) no. 2 UWG). This also applies to the requests for feedback and for a review: they count as advertising and are therefore only allowed with your consent. We keep the proof of your consent on the basis of Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

Voluntary: Signing up is voluntary. Without the required details and your consent we cannot add you; you can still use all the tools.

Withdrawal: You can withdraw your consent at any time with effect for the future, using the unsubscribe link in every email or by writing to privacy@docuvoza.com. This does not affect the lawfulness of processing before the withdrawal.

Transfer to the future company: In the consent text you agree that your details may pass to the owner's future company that will continue Docuvoza. Details are in section 24.

Recipient: our email and SMS delivery provider (EU), as our processor, which sends the confirmation and notification emails and keeps the lists.

Transfers outside the EU: The provider processes the data in the EU. We do not intend any transfer to third countries. If the provider uses its own sub-processors outside the EU, it must ensure appropriate safeguards for this in accordance with Art. 28(4) and Art. 44 et seq. GDPR.

Retention:

• Unconfirmed sign-ups are deleted after 30 days.
• Confirmed entries are deleted when you unsubscribe, at the latest 3 months after the general launch (accounts for everyone). Beta applications that do not lead to an invitation are deleted at the latest at the general launch.
• We delete automatically through our provider's interface.
• What remains after deletion: So that we can demonstrate your consent, only your email address on a suppression list, the times of your sign-up and confirmation and the version of the consent text remain with the provider. We delete all other details: name, line of work, team size, country, source, partner or campaign code and intended use. We keep this proof for 3 years after the end of the year in which the consent ends. The suppression list also makes sure that you receive no further emails.

Minimum age: You can sign up on your own from the age of 16 or, where the law of your country sets a lower age for consent to online services (for example 15 in France), from that age. If you are younger, we need the consent of a parent or other holder of parental responsibility.

Pilot round and quotes on our website

Before the beta, a few businesses try Docuvoza and talk to us about it (pilot round). There are no codes and no credits for this. We keep notes from these conversations without names.

We only show a quote from a person in the pilot round on our website if that person has allowed it in writing, by email or through a form. The quote then appears with name, line of work and place and with the label "Pilot tester with free access". We store which version of the permission text the person confirmed and when. The permission is voluntary. You can withdraw it at any time, for example by email to privacy@docuvoza.com. We then remove the quote from our website.

Legal basis: your consent (Art. 6(1)(a) GDPR). Recipients: The quote is public. The permission is kept in our email mailbox or at our email and SMS delivery provider (EU), each as our processor. Retention: the quote until withdrawal; the proof of the permission (text, version, time) for 3 years after the end of the year in which the quote is removed.

12. Usage statistics without recognising your browser

Purpose: On our own servers we count page views and steps such as "tool started" or "result downloaded". This shows us which tools are used, what does not work and which countries our visitors come from.

Data: name of the event, page viewed without parameters, simple technical details of the event (for example the tool), the time and the country (country code), which we derive from your IP address. We do not store any identifier of your browser (including the one in the dv_anon cookie), no IP address, no browser identifier, no file names and no content. We set no cookies for statistics and store nothing in your browser. We use no analytics software from another provider.

Country and bots: A script on our page sends the event to our server. As with every page request, your browser transmits your IP address and its browser identifier (user agent). We use both only briefly on arrival, and only for two things:

• Filtering out bots: we discard events from bots and search engine crawlers. We only count browsers that ran the script on our page, possibly only after a short time on the page or after an action.
• Determining the country: for this we use a country database that sits on our own servers. No other provider receives your IP address for this.

We store only the country code. We discard the IP address and the browser identifier immediately and do not store them. We do not recognise you again, neither on the same day nor later.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interests: improving the service, understanding how many people we reach in which countries, and keeping automated access out of the statistics. The stored events cannot be linked to any person. You can object (section 20).

Recipient: our hosting provider (servers, database), as our processor.

Retention: individual events with the country code are deleted after 90 days; after that only daily totals per country remain.

Search statistics: We also use aggregated statistics from a search engine about how people find us through search (for example search terms, clicks and countries). These figures come from the search engine's own data. Our website sends no data to the search engine for this.

13. Fonts and content from other providers

We serve fonts from our own servers; visiting Docuvoza does not connect to font providers of other companies. Apart from the service that protects against automated access (section 9), our pages currently load no scripts, images or other content from other providers, no social media plug-ins, no maps and no videos.

14. Cookies and browser storage – overview

We set no tracking cookies, no advertising cookies and no cookies from other providers. That is why we do not show a consent banner. All items below are strictly necessary for features you use yourself (Art. 5(3) of Directive 2002/58/EC; section 25(2) no. 2 TDDDG).

Items in local storage are not sent to us. Exception: during the 15 minutes our site sends the troubleshooting code to us (section 4). You can delete them at any time in your browser settings.

Microphone: For voice input, our site only accesses your microphone when you press the "Speak" button and allow it in your browser. We store nothing on your device for this. You can withdraw the permission at any time in your browser settings.

15. Contact by email and contact form

You can reach us by email at contact@docuvoza.com or privacy@docuvoza.com, or through our contact form (docuvoza.com/en/contact).

Purpose: We process your details to answer your request. You can also use the form to report illegal content to us (topic "Report illegal content (DSA)").

Data: your email address, your name if you give it, the content of your message and timestamps. For the form, also the topic you choose, the language of the page and a reference number for your message. For abuse protection we briefly process your IP address.

How the form works:

• We do not store your message in our database or in our logs.
• Our server passes the message through a queue to our email and SMS delivery provider. The provider delivers it to our mailbox: the topic "Data protection" to privacy@docuvoza.com, all others to contact@docuvoza.com. Your email address is set as the reply-to address.
• You automatically receive a confirmation of receipt with the reference number. For notices of illegal content it states the date and time of receipt. It does not repeat your message.
• We delete the delivery job as soon as our email and SMS delivery provider has accepted the email. If delivery finally fails, we delete it after 7 days.
• Abuse protection: we limit the number of messages per browser, IP address and email address. For this we keep salted hash values of the IP address and the email address in a cache for at most 24 hours. A hidden field detects automated entries. Only if there is a risk signal do we ask for a security check (section 9).

Legal basis:

• Art. 6(1)(b) GDPR if your request concerns the use of Docuvoza; otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering requests.
• Requests to exercise your data protection rights: Art. 6(1)(c) GDPR in conjunction with Art. 12 to 22 GDPR.
• Notices of illegal content and the confirmation of receipt for them: Art. 6(1)(c) GDPR in conjunction with Art. 16 of Regulation (EU) 2022/2065 (Digital Services Act, DSA). Complaints against our decision: Art. 6(1)(f) GDPR.
• Confirmation of receipt for other topics and abuse protection: Art. 6(1)(f) GDPR. Our legitimate interest is confirming receipt to you and protecting the form against spam.

Recipients: as our processors, our email and SMS delivery provider (message and confirmation of receipt), our email provider (mailbox), our hosting provider (servers and cache) and, only if there is a risk signal, the service that protects against automated access (USA, sections 9 and 17).

Retention:

• Form: not in our database. Delivery job until our email and SMS delivery provider accepts it, at most 7 days. Hash values for abuse protection at most 24 hours.
• Messages in our mailbox (email and form): we delete them 6 months after they have been finally dealt with. Longer only where retention is required by law (for example 6 years for business correspondence relevant for tax purposes under section 147 of the German Fiscal Code, AO).
• Requests to exercise data protection rights: 3 years from the end of the year in which they were dealt with, as proof.
• Notices of illegal content and complaints against our decision: 3 years from the end of the year in which we decided. This lets us document how we acted.

Obligation to provide data: For the form we need your email address and your message. Without them we cannot reply. Your name is optional.

16. Recipients and processors

We pass your data only to service providers we need to run the service. They act as our processors, on our instructions, under a contract pursuant to Art. 28 GDPR.

For requests by email and through the contact form we also use our email provider (mailbox) as a processor (section 15).

We will name the individual recipients on request (contact: privacy@docuvoza.com).

Authorities and courts receive data only where a law obliges us to provide it. We do not sell data.

17. Transfers to countries outside the EU

As a rule we process your data in the EU. The exception is the provider of our DNS and of the service that protects against automated access, based in the USA (sections 5 and 9). The transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023, Art. 45 GDPR), insofar as the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914; Art. 46(2)(c) GDPR). You can obtain a copy of these safeguards on request using the contact details in section 1.

18. Retention at a glance

19. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability for data you provided to us on the basis of consent or a contract (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR, see section 20).

You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, write to privacy@docuvoza.com or by post to the address in section 1. We reply within one month; for complex requests this period may be extended by two further months, in which case we will inform you (Art. 12(3) GDPR).

Because there are no accounts, we often cannot link data about operations to a person without additional information (Art. 11 GDPR). If you wish to exercise your rights for such data, please tell us the identifier in the dv_anon cookie of your browser and the approximate time of use.

If you live in France, you also have the right to give instructions on what happens to your data after your death (Article 85 of French Law No. 78-17); you can send such instructions to privacy@docuvoza.com.

20. Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR (sections 4, 5, 7 to 10, 12 and 15), you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Please send your objection to privacy@docuvoza.com.

21. Complaint to a supervisory authority

You can lodge a complaint with any data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (postal address: Postfach 1349, 91504 Ansbach), phone +49 981 180093-0, poststelle@lda.bayern.de, www.lda.bayern.de.

22. Do you have to provide data?

You are under no statutory or contractual obligation to provide us with data. The browser tools need no data from you. For server tools and AI features we have to process the file or your input and count your allowance; without this you cannot use these features. Voice input is optional; you can always type the text instead. For "Notify me at launch" we need your email address, line of work, team size, country and your consent, and for the beta also your name; how you heard about us is optional. For the contact form we need your email address and your message; your name is optional.

23. No automated decisions

We make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR), and we do not create a profile of you. The limits against abuse (sections 8 and 9) apply to everyone equally: when the allowance is reached or a risk signal occurs, you temporarily cannot use server tools, or only after a check. The browser tools always remain available. If you believe you have been limited wrongly, write to us; a person will review it.

24. Transfer to a company of the owner

The owner is founding a German limited liability company in the form of an "Unternehmergesellschaft (haftungsbeschränkt)", which is to run Docuvoza in future. On the transfer, that company will become the controller.

• "Notify me at launch" entries: they pass to the company so that it can notify you as you requested. The legal basis is your consent, which covers this transfer (Art. 6(1)(a) GDPR), and our legitimate interest in continuing the service (Art. 6(1)(f) GDPR).
• Other data (for example logs and details of operations within their retention periods) pass to the company insofar as it needs them to run the service; legal basis Art. 6(1)(f) GDPR.
• Prior information: we will inform you at least 6 weeks before the transfer, with the name and address of the company, by email (if you have signed up) and on this page. You can object to the transfer of your data or unsubscribe until the transfer date; we will then delete your data instead of transferring it.

25. Changes to this notice

We update this notice when the service, the providers we use or the law change, for example when accounts or payments are introduced. The version shown here with its date and version number applies. Earlier versions are available on request. We will inform you by email of material changes that affect your "Notify me at launch" entry.

Version 1.7.2 · effective 1 December 2026