Privacy Policy

1. Overview

DocTick ("we," "our," or "us"), available at https://doctick.com, provides a streamlined document collection portal for professionals (such as accountants, mortgage brokers, and legal advisors) to securely request, receive, and organize documents directly into their own Google Drive storage.

We respect your privacy and are committed to protecting your personal data and the confidentiality of files uploaded through our platform.

2. Information We Collect

When you register, sign in, or interact with DocTick, we collect the following categories of information:

• Account Information: When you authenticate via Google Sign-In, we receive your name, email address, profile picture, and Google account identifier to create and manage your account.
• Google Drive Authorization Tokens: OAuth 2.0 access and refresh tokens required to interact with your Google Drive strictly within the permissions you grant.
• Document Request Metadata: Names of clients you create requests for, requested document checklist items, custom instructions, status flags (e.g. pending, uploaded, approved), and audit timestamps.
• Uploaded Document Metadata: File names, file sizes, MIME types, and upload timestamps. Note: Files uploaded by your clients are streamed directly to your designated Google Drive folder and are not permanently stored on DocTick application servers.
• AI Document Review Results (Pro accounts only): For Pro accounts, we generate an automated review of each uploaded document (detected document type, tax year, whether the name appears to match the client, image quality, and any issues found) and store that result with the request. We do not store the document's extracted text.

4. How We Use Your Information

We use the data we collect solely to:

• Authenticate your identity and provide you with access to the DocTick platform.
• Create and manage client document requests and shareable secure upload links.
• Automatically organize client uploads into labeled subfolders within your Google Drive.
• Send transactional email notifications and automated reminders to your clients regarding pending checklists.
• For Pro accounts, automatically review uploaded documents and flag likely problems (wrong document, wrong year, name mismatch, unreadable scan) for the professional to check.
• Process subscription payments.
• Understand how the product is used so we can improve it.
• Provide customer support and resolve technical inquiries.

5. Service Providers

We share data with the following providers only as needed to run DocTick. Google Cloud Vision and Typesafe are used only for Pro accounts with AI Document Review turned on (the default for Pro). A Pro account can turn it off under Settings → AI Document Review, after which uploads go straight to Google Drive and nothing is sent to either service.

• Google Cloud (Firebase, Cloud Firestore): hosting and storage of account and request data.
• Google Cloud Vision (Pro accounts only): when a client uploads a photo or scanned PDF to a Pro account's request, the image is sent to Google Cloud Vision to read its text. It passes through our servers in memory and is not saved by DocTick.
• Typesafe (Pro accounts only): for AI document review, we send Typesafe the document's extracted text, its file name, the client's name, and the requested checklist item. Typesafe returns the review result described in Section 2.
• Resend: delivery of emails, including upload links and reminders sent to your clients (client name, email address, and request details).
• Stripe: payment processing for subscriptions. Card details are handled by Stripe and are never stored by DocTick.
• PostHog: product analytics on our website, dashboard, and client portals (pages viewed and actions taken), and session recordings of our website and dashboard. Client upload portals are never recorded. Dashboard recordings can include what is shown on screen, such as client names and file names. Uploaded files are never sent to PostHog.

6. Data Storage and Security

We implement industry-standard administrative, physical, and technical safeguards to protect your personal information:

• Cloud Infrastructure: DocTick is hosted on Google Cloud Platform (Google Cloud Run & Cloud Firestore) in high-security, ISO 27001 and SOC 2 compliant data centers.
• Encryption: All data transmitted between your browser, our servers, and Google APIs is encrypted using TLS 1.3/HTTPS. Data stored in Cloud Firestore is encrypted at rest using AES-256.
• No File Storage: Files uploaded through client portals go directly from the uploader's browser to your Google Drive. DocTick does not keep copies. For Pro accounts, photos and scanned PDFs are briefly processed in memory for text recognition (see Section 5) and are not saved.

7. Data Retention and Deletion

We retain your account profile and request metadata for as long as your account remains active. You maintain complete control over your data:

• Revoking Google Access: You can revoke DocTick's access to your Google account at any time by visiting Google Account Permissions.
• Account and Data Deletion: You may request complete deletion of your account, request histories, and stored tokens by emailing us at contact@doctick.com. All associated records will be permanently purged within 30 days.

8. Changes to This Policy

We may update this Privacy Policy periodically to reflect enhancements to our service or changes in legal requirements. We will notify registered users of material updates via email or prominent notices on our website.