Privacy
Privacy policy
What does docivault do with my data?
Last updated: 28 August 2026. This is the current policy.
What we hold
Every category of data this covers, and why
An account holds your email address and name. A workspace holds your membership in it, your role, and the other people and contacts in it that you can see. Authentication data covers your password (hashed, never stored in plain text), any passkey credentials you register, and any two-factor authentication factors you set up. A workspace also holds the documents you upload, their file names, categories and which space they sit in, together with comments and reactions left on them. When one of your contacts opens or downloads a document through their portal, that is recorded; workspace activity is recorded too. A complete audit record of every view and download by every kind of user is not built — when it ships, this page changes before it does, not after.
All of it exists for one reason: to run the service you signed up for. Your email identifies your account and lets us reach you about it. Your workspace membership and role decide what you can see. Authentication data exists to keep your account secure.
Where it lives
Who processes it on our behalf, and where it is stored
Every third party that touches your data is listed, with what it does and where it runs, on the subprocessors page. In summary: the database and authentication run on Supabase in Mumbai, India; document files are stored in Cloudflare R2; the application is hosted on Vercel. Data is stored in India today. It is not stored in the EU, and we do not claim otherwise anywhere on this site.
Retention and cookies
How long we keep it, and what a cookie on this site actually does
You can delete your account, or delete an entire workspace, from settings — both are self-service today, with no need to ask us first.
This site and product use two kinds of cookies: an authentication session cookie that keeps you signed in, and a cookie that remembers your light or dark theme preference. There is no analytics cookie, no advertising cookie, and no third-party tracking script anywhere on this site — a fact worth stating plainly rather than assuming you will guess it.
Your rights
What you can ask for, and how
You can ask what data we hold about you, ask us to correct or delete it, or ask any other question about this policy by emailing privacy@docivault.com. We do not claim GDPR compliance or any other certification on this page — this is a plain description of what we actually do, not a compliance statement.