Privacy Policy

DocStow is operated by Infadale Solutions ("DocStow", "we", "us", "our"), a New Zealand business committed to protecting your privacy. This Privacy Policy applies to the DocStow website (docstow.com), the DocStow web application, and any related services (collectively, the "Service"). We comply with the Privacy Act 2020 (New Zealand), the thirteen Information Privacy Principles (IPPs), and where applicable the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who we are

DocStow is operated by Infadale Solutions, New Zealand. NZBN: 9429053662200. Infadale Solutions is the data controller for the personal information you provide when using the Service. You can contact us at any time at privacy@docstow.com.

2. What information we collect

Information you provide to us

• Account and profile information: your name, email address, account identifier, password authentication data, optional phone number, and optional profile photo.
• Household information: household name, family member names and email addresses you choose to invite, and household access roles.
• Documents, photos and organisation data: the files, scanned document images and card images you upload, plus titles, categories, tags, notes, holder or owner details, dates, reminders, calendar information, tasks and expenses you add or generate.
• Smart Inbox content: files you upload or forward to your personal Smart Inbox address, together with the sender, subject, attachment filename, file type, size, delivery status and provider message identifiers needed for delivery reconciliation. We do not store forwarded email bodies or raw provider payloads.
• Connected storage information: when you connect Google Drive, the connection credentials, selected DocStow folder and relevant file identifiers or metadata needed to provide the feature.
• Subscription information: plan, subscription status, purchase or transaction references and renewal information. Stripe or Google Play Billing handles payment credentials; DocStow does not store full payment card numbers.

Information we collect automatically

• Service and device data: feature and account activity, timestamps, browser or operating-system information, app version, device or push identifiers, and notification delivery status needed to operate and secure the Service.
• Diagnostics: error and diagnostic information when monitoring is configured. Website analytics are optional and only load after consent; the Android app does not include Google Analytics or Microsoft Clarity SDKs.

3. How we use your information

We use your personal information only for the purposes below:

• To provide account management, secure cloud storage and document organisation;
• To send expiry, renewal and task reminders, account notifications and essential service emails;
• To process Smart Inbox and optional Google Drive workflows you choose to use;
• To process payments and manage subscriptions through Stripe or Google Play Billing;
• To respond to your support requests and communicate with you;
• To secure the Service, prevent fraud or abuse, and troubleshoot issues;
• To improve the product through consent-controlled website analytics;
• To comply with legal obligations, court orders, and lawful requests from New Zealand authorities.

We do not sell, rent or trade your personal information. We do not use the contents of your documents to train AI models.

4. Collection, sharing and service providers

When your app or browser sends information to DocStow's server infrastructure so we can provide the Service, that information is collected. Under Google Play's Data Safety definitions, data handled by a service provider acting on DocStow's instructions is not normally treated as data "shared" with a third party. We do not sell, rent or trade personal information.

We use vetted providers to process limited information for us: Supabase and AWS for authentication, database and storage; Stripe and Google Play Billing for payments; Resend for email; OpenAI when you choose AI document extraction; and Google Drive when you connect your account. Google Drive transfers are initiated by you. Google Analytics and Microsoft Clarity are consent-controlled website tools, not advertising tools. They are not loaded by the native Android app.

5. Legal basis for processing (GDPR)

For users in the EU, UK and EEA, our legal bases for processing are contractual necessity (to deliver the Service you signed up for), legitimate interest (to keep the Service secure and improve it), consent (for optional analytics and marketing emails), and legal obligation (where required by law).

6. Where your data is stored

Your documents and account data are stored in Supabase's Sydney (ap-southeast-2) region on encrypted infrastructure operated by Amazon Web Services. We chose an ANZ region for proximity to New Zealand and Australian households. Some sub-processors (see section 9) may process limited data in other regions; these transfers are protected by Standard Contractual Clauses or equivalent safeguards where required.

7. How we protect your data

• Encryption at rest: provider-managed encryption for document storage, database services, and backups.
• Encryption in transit: HTTPS for traffic between your device and DocStow.
• Row Level Security: enforced at the database layer so only you and people you choose to share with can see the items made available to them.
• Access controls: DocStow staff do not access customer documents except where strictly necessary for support and only with your explicit consent.
• Audit logging: privileged actions are logged and retained for incident investigation.

For the full technical picture, see our Security page.

8. How long we keep your data

We retain your personal information for as long as your account is active. If you request account deletion, we delete active account data within 30 days and purge backups within 90 days. We may retain limited billing, tax, fraud-prevention, security or legal records where required or permitted by law. See Delete your account for the full process.

9. Sub-processors

We use a small number of carefully vetted third parties to operate the Service. Each is bound by data processing agreements that require them to protect your data to the same standard we do.

• Supabase Inc. — database, authentication and document storage (Sydney region).
• Amazon Web Services (AWS) — underlying cloud infrastructure (Sydney region).
• Stripe, Inc. — payment processing for paid subscriptions.
• Resend — transactional email delivery (notifications, reminders and password resets) and receipt of files forwarded to a personal Smart Inbox address. For Smart Inbox we retain minimal delivery metadata and attachments, not the email body.
• OpenAI, L.L.C. — used on an opt-in basis for AI-powered document extraction. Data sent for extraction is not used to train OpenAI models under OpenAI's business API terms.
• Google Analytics and Microsoft Clarity — consent-controlled website analytics used to understand public-site and product usability without advertising targeting.
• Vercel Speed Insights — anonymous website performance measurement that helps us monitor Core Web Vitals.
• Sentry — optional error monitoring and diagnostic processing when it is configured for an environment.

10. Cookies

We use a minimal set of first-party cookies strictly necessary to keep you logged in and to protect against cross-site request forgery. We may also use consent-controlled analytics on the public website to understand page performance, navigation, and product usability. We do not use advertising or cross-site ad tracking cookies. You can disable cookies in your browser, but parts of the Service will not work.

11. Your rights

Under the New Zealand Privacy Act 2020, and (where applicable) the GDPR, you have the right to:

• Access the personal information we hold about you;
• Request correction of information that is inaccurate or incomplete;
• Request deletion of your personal information (the "right to be forgotten");
• Export your data in a portable JSON format from your account settings;
• Object to or restrict certain processing;
• Withdraw consent for optional processing such as analytics or marketing emails;
• Lodge a complaint with the Office of the Privacy Commissioner (New Zealand) or your local supervisory authority.

To exercise any of these rights, email privacy@docstow.com. We will respond within 20 working days. You can also change analytics consent from the cookie preferences control in the landing page footer.

For account deletion, use the secure in-app flow or visit Delete your account or manage your data.

12. Children

DocStow is not intended for use by children under 16. We do not knowingly collect personal information directly from children. Parents and guardians may, of course, store documents relating to their children within their own DocStow household.

13. Data breach notification

In the unlikely event of a privacy breach that is likely to cause serious harm, we will notify affected users and the Office of the Privacy Commissioner as required by Part 6 of the Privacy Act 2020, and (where applicable) the relevant supervisory authority under the GDPR.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and post a prominent notice on the Service at least 14 days before the changes take effect.

15. Contact us

Questions, concerns or requests about this Privacy Policy?
Email: privacy@docstow.com
Post: Infadale Solutions, Privacy Officer, Auckland, New Zealand