Privacy notice

Who we are

docpilot is a document-automation service operated from the United Kingdom, currently in a closed beta. It turns uploaded PDF documents (purchase orders, invoices and similar) into structured, evidence-linked data that a human reviews and approves. Contact: support@docpilot.example (placeholder address — a real support inbox will replace it before launch).

What we store

• Documents you upload — the original PDF, page images and text derived from it, the fields extracted from it (with the page location each value was read from), validation issues, and the review decisions made on it.
• Account data — your email address, a salted password hash (argon2; we never store the password itself), your role, and your organization's name and settings.
• Audit trail — processing and review events per document, including which signed-in user edited, confirmed or approved what, and when. This trail exists so approvals are accountable; it is part of the document's record.
• Session records — a hash of your session token (the raw token lives only in your browser's cookie).
• Usage metering — per-extraction call counts, page counts and model token counts, kept per organization for cap enforcement and billing transparency.

How processing works, and who else sees your data

Extraction can run entirely locally (local open-source models, or the deterministic demo extractor) — in that mode document content never leaves the server. When API extraction is enabled, the text of your document is sent to Anthropic (our only subprocessor for extraction) to extract fields, under Anthropic's commercial API terms. If your organization brings its own API key (BYOK), those calls are made with your organization's credentials. We do not sell your data, and we do not use your documents to train models.

Learning inside your organization — and how to switch it off

docpilot learns from your reviewers' corrections to improve future extractions: a registry of confirmed values, per-sender field suggestions, evidence-location priors, and a teaching pool of fully verified documents. All of this learning is scoped to your organization — nothing learned from your documents is applied to any other tenant. Organization admins can switch each learning behaviour off (or all of them at once) and purge learned data from the Admin → Learning panel.

Cookies — and why there is no cookie banner

docpilot sets exactly one cookie: docpilot_session, an httpOnly session cookie that keeps you signed in. It is strictly necessary for the service to function, which under UK PECR does not require consent. There are no analytics cookies, no advertising cookies and no third-party cookies of any kind — which is why this site deliberately shows no cookie banner: there is nothing to consent to.

Retention and deletion

• Your organization's admin can set a retention period after which documents are automatically and completely erased (original file, derived images, extracted data, audit events).
• Any single document can be deleted on demand; deletion removes the stored file and every derived record. Aggregate value statistics (e.g. "this supplier VAT number has been seen 14 times") survive a single document's deletion because they are cross-document counts, not document content — this residue is documented, not hidden.
• An organization can be erased entirely — every document, user account, session, setting and learned value — on request or via the API.

Your rights (UK GDPR)

You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to complain to the ICO. During the beta, exercise these rights by emailing support@docpilot.example — the deletion tooling described above is how we honour erasure requests, completely and verifiably.

Where your data lives

The beta runs as a single-instance deployment: your data sits in that instance's own database and file store, encrypted in transit (TLS) when accessed over the public internet. Organization-supplied API keys are stored encrypted at rest.