Personal Data Processing Policy
This document sets out the procedures and conditions for processing personal data when using the DocRoost service.
1. General provisions
1.1. This Policy has been drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 ‘On Personal Data’ (the Law) and is published pursuant to Article 18.1(2) of the Law.
1.2. The owner of the DocRoost service (the Provider) is the personal data operator in the cases specified in section 2 of this Policy.
1.3. This Policy covers the processing of personal data when using docroost.com and app.docroost.com (together, the Service).
1.4. Enquiries about personal data processing should be sent to support@docroost.com.
2. Operators and legal grounds for processing
2.1. Roles and legal grounds are allocated as follows:
| Data | Operator | Legal ground |
|---|---|---|
| The account of an organization owner who is an individual entrepreneur; support enquiries | Provider | An agreement to which the data subject is a party (Article 6(1)(5) of the Law) |
| Another user’s account | Provider | The data subject’s consent, given when creating an account (Article 6(1)(1) of the Law) |
| Sign-in sessions, activity log, server logs and website visitor data | Provider | Legitimate interest in ensuring the security of the Service (Article 6(1)(7) of the Law) |
| The organization’s documents, emails and messages; data about recipients of shared links and document requests; search queries | Client organization. The Provider processes the data on its instructions (Article 6(3) of the Law) | Determined by the client organization. Processing instructions are set out in the public offer or a separate agreement |
| Messenger: account identifier | Provider | The data subject’s consent |
| Messenger: messages and files | Client organization. The Provider processes the data on its instructions | Determined by the client organization |
2.2. Requests from personal data subjects concerning data for which the client organization is the operator are handled by that organization. The Provider forwards any such request it receives to the organization and informs the requester.
3. Personal data categories and processing purposes
3.1. Personal data is processed about users of the Service, recipients of shared links and document requests, senders of emails and messages, persons named in documents, website visitors, and persons who contact support.
| Personal data | Processing purposes |
|---|---|
| Account: name, email address, password hash, profile photo if uploaded, role in the organization, and second-factor authentication data. | Signing in to the Service, working in the archive, and sending messages about the operation of the Service. |
| Organization: names and identifying details of legal entities, if entered. | Entering into and performing the agreement; operating the archive. |
| Sign-in sessions: IP address, browser information and time. | Maintaining the session and investigating suspicious sign-ins. |
| Activity log: information about the person and the action performed, time, IP address and browser information. | Ensuring the security of the Service, providing action history to organization administrators, and confirming acceptance of the offer and consent. |
| Recipients of shared links and requests: email address, name if supplied by the sender, and opening and download times. | Providing access to documents by link and email code, requesting documents, and sending reminders about them. |
| Emails and messages: sender address, subject, body and attachments. For messengers: account identifier and message text. | Receiving documents and providing bot responses. |
| Documents: files, extracted text, identified document details and counterparties, and search index. | Storage, recognition, search and answers based on documents. |
| Search queries. Email addresses, phone numbers, numbers of five or more digits, amounts and recognized counterparty names are replaced when recorded. Other words are retained unchanged, so a person’s name entered as an ordinary word may be retained. | Configuring and assessing search quality within the organization. |
| Server logs: IP address, requested URL and browser information, including during website visits. | Operating the website and the Service, protecting against attacks, and diagnosing errors. |
| Support enquiries: email address and message body. | Responding to the enquiry. |
3.2. The Provider does not process special categories of personal data or biometric personal data for its own purposes. Such data may be present in the client organization’s documents and is processed on its instructions. Advertising mailings and third-party visitor tracking tools are not used.
4. Use of data for model training
4.1. An organization’s labels and search information are used to train shared Service models only with its administrator’s permission. Permission is disabled by default and may be withdrawn.
4.2. Documents are transferred to an external artificial intelligence model only with the client organization’s permission.
5. Processing procedures and retention periods
5.1. Processing includes collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer (provision or access), blocking, deletion and destruction of personal data, and is carried out using automated means.
5.2. The following retention periods apply:
| Data | Retention period |
|---|---|
| Account and organization data | Until the account and organization cease to exist. |
| Documents | Until deletion. A deleted document remains in the trash for 30 days and is then permanently deleted. |
| Activity log and in-Service notifications | For the lifetime of the organization; automatic deletion is not provided. |
| Sign-in sessions | 90 days after the session ends. |
| Files that did not become documents: rejected files and files that failed processing | The filename and message text are erased after 90 days. |
| Incoming emails and bot messages | 30 days after processing. Attachments accepted as documents remain in the archive. |
| Information about rejected emails | 30 days. |
| Records of sent emails and messages | 180 days. |
| Search queries and Service performance measurements | 90 days. |
| Server logs | Within a fixed capacity: four 50 MB files for each component, with older records replaced by new ones. |
| Server performance metrics | 30 days. User and document identifiers are not included. |
| Database log archive and nightly database backups | 7 days. |
| Encrypted database backups created every 6 hours | According to the backup storage retention rule. |
5.3. After deletion, data remains in backups until their retention periods expire. When a database is restored from a backup, data belonging to previously deleted organizations is deleted again.
5.4. Personal data is destroyed within 30 days after the processing purpose has been achieved or consent withdrawn, unless otherwise required by law; data in backups is destroyed within the periods specified in clause 5.2 of this Policy.
6. Transfer of personal data to third parties
6.1. Text recognition, search index creation and virus scanning take place on the Provider’s server. The Provider engages the following contractors:
| Contractor and processing location | Data transferred |
|---|---|
| reg.ru, Russia | Hosting the Service server, document files and database backups. |
| SpaceWeb, Russia | Service emails: recipient address, subject and body. Support mailbox. |
| Yandex AI Studio, Russia | Document page text for document-based answers and extracting details, only with the organization’s permission. Requests are sent with data retention disabled on the provider’s side. |
| Telegram, outside Russia | Only if the organization administrator has allowed messengers and the user has connected the bot: user identifier, files and messages sent to the bot. Bot responses include filenames, document excerpts of up to 240 characters, and links. |
| RUVDS, Almaty, Kazakhstan | A relay server between the Service and Telegram through which the same messages and files pass. It also hosts the status page, which does not collect visitor data. |
7. Access to documents
7.1. Documents may be accessed by:
- the organization’s users within their permissions, and recipients of shared links;
- the Service administrator, who has technical access to the server, database and file storage to operate and restore the Service and investigate failures, and access to search queries to analyze search quality;
- reg.ru: document files, the database log archive and nightly database backups are held in its storage and are not encrypted by the Provider, so they are technically accessible to the storage provider. Database backups created every 6 hours are encrypted before transfer;
- the artificial intelligence model provider: only page text and only with the organization’s permission. Permission is disabled by default, is changed by the organization administrator, and every change is logged;
- Telegram and the relay server: data sent or received through the bot if the organization has allowed messengers.
8. Cross-border transfers
8.1. Databases containing accounts and documents are located within the Russian Federation.
8.2. If the organization has allowed messengers and a user has connected the Telegram bot, messages and files are transferred to a relay server in the Republic of Kazakhstan and to Telegram outside the Russian Federation. No such transfer takes place unless the bot is connected.
9. Cookies and browser storage
9.1. The docroost.com website does not use cookies or third-party scripts.
9.2. The app.docroost.com application uses cookies to maintain sessions and access through shared links, and browser storage to save interface preferences.
10. Security measures
10.1. The Provider applies the following measures:
- protecting connections with TLS;
- isolating organizations’ documents at the database level;
- second-factor authentication, which an organization administrator may make mandatory;
- scanning files for viruses before placing them in the archive;
- recording document actions in the activity log.
11. Rights of personal data subjects
11.1. A personal data subject may obtain information about the processing of their data as provided in Article 14(7) of the Law, request its updating, blocking or destruction, withdraw consent, and challenge the operator’s actions before Roskomnadzor or a court.
11.2. Requests should be sent to support@docroost.com. Information is provided within 10 working days after receipt of the request. This period may be extended by no more than 5 working days, with notification of the reasons. Withdrawal of consent does not prevent processing where another legal ground exists under the Law.
12. Final provisions
12.1. A new version of this Policy is published on this page with a date. The Provider notifies organization administrators of changes affecting clients in the manner specified in the public offer.