This policy explains how Doc247 (“Doc247”, “we”, “us”) handles personal data when you use the website at doc247.xyz, the Doc247 connector for AI assistants such as ChatGPT and Claude (served from mcp.doc247.xyz), and the documents you create with them (together, the “Service”).
1. Who we are
The Service is operated by FortyTwo Eleven Consulting AB, Midsommargränd 4, Stockholm, 12635, Sweden , with org.nr. 559358-1746. We are the controller of the personal data described in this policy. Contact us about privacy at info@doc247.xyz.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, name, password (stored only as a salted hash), account and workspace identifiers, sign-in timestamps. | You, when you sign up or sign in |
| Session and security data | Session cookies, IP address and browser user agent recorded with each session, sign-in links sent by email. | Your browser |
| Connected-app data | Which AI assistants you connected (for example ChatGPT or Claude), the permissions (scopes) you granted, and the access and refresh tokens issued to them. | The OAuth authorization you approve |
| Document contents | Everything in the documents you create: seller and buyer (or supplier) names, addresses, email addresses, phone numbers, tax/VAT identifiers, bank details, line items, prices, discounts, taxes, notes, dates and document numbers, plus the generated PDF files. | Your AI assistant, when it calls a Doc247 tool on your behalf |
| Company profile | Your business name, address, tax identifiers, bank details and other defaults you ask us to save. | Your AI assistant, on your request |
| Usage analytics | Product events such as “tool used”, “document created” and “document downloaded”, with your user ID, the document type and currency, which assistant was used, whether the request succeeded and how long it took. Analytics events do not include document contents such as names, addresses or amounts. | Generated by our servers when you use the Service |
| Website analytics | Pages you view on doc247.xyz, when you leave them, the referring website, campaign (UTM) tags, and browser, device type, operating system, screen size and approximate country derived from your IP address. Website analytics are cookieless: nothing is stored in your browser, your IP address is not stored, and visits are counted with a one-way hash of your IP address and user agent combined with a secret that changes every day, so you cannot be recognised across days. We remove query strings (other than UTM tags) from recorded page addresses. | Your browser, when you visit the website |
| Technical logs | IP address, request URL, timestamps, error messages and performance traces. | Generated by our hosting infrastructure |
| Support correspondence | The content of emails you send us. | You |
What we do not collect. Doc247 does not receive your chat conversations with ChatGPT, Claude or any other assistant. We only receive the information your assistant sends when it calls a Doc247 tool. We do not collect payment card details, and we do not use advertising or cross-site tracking cookies.
Documents often contain personal data about other people (for example your customers’ or suppliers’ contact details). You are responsible for having a lawful basis to include that information; we process it on your behalf only to provide the Service.
3. Why we use it
- To provide the Service: create your account, authenticate you and your connected assistants, calculate, number, render and store your documents, and let you download them. (Legal basis: performance of our contract with you.)
- To keep the Service secure: prevent abuse, rate-limit requests, investigate incidents and debug errors. (Legitimate interests.)
- To understand and improve the Service: measure which features are used, where requests fail and how visitors find and use the website, using the usage and website analytics described above. (Legitimate interests.)
- To communicate with you: send sign-in links, answer support requests and tell you about material changes to the Service or this policy. We do not send marketing email without your consent. (Contract; legitimate interests.)
- To comply with the law: respond to lawful requests and meet our legal obligations. (Legal obligation.)
We do not sell your personal data, we do not use it for advertising, and we do not use your documents to train machine-learning models.
4. Who we share it with
We share personal data only with the following recipients, and only as needed for the purposes above:
- Cloudflare, Inc. (sub-processor): hosts the website and connector, and provides our database, file storage for PDFs, PDF rendering, email delivery for sign-in links, and request logs.
- PostHog, Inc. (sub-processor): product analytics, hosted in PostHog’s EU cloud. Receives the usage and website analytics described in section 2.
- The AI assistant you choose: for example OpenAI (ChatGPT) or Anthropic (Claude). When you connect one, it sends document details to Doc247 and receives the results (such as document numbers, totals, document details you ask for, and download links). These providers are independent controllers; their handling of your conversations and of the results we return is governed by their own privacy policies. You decide which assistants to connect and can disconnect them at any time.
- Anyone you share a download link with: download links are secret, signed URLs; anyone who has one can open that PDF until the link expires.
- Authorities and advisers: where required by law, to protect our rights or users’ safety, or to our professional advisers under confidentiality.
- A successor business: if Doc247 is involved in a merger, acquisition or sale of assets, subject to this policy.
5. International transfers
Cloudflare operates a global network, so your data may be processed outside your country, including in the United States. Where data is transferred out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as offered by our sub-processors.
6. How long we keep it
- Generated PDF files are deleted from storage automatically about 7 days after they are created. If you download a document later, we regenerate the PDF from the stored document data.
- Document data and your company profile are kept until you delete your account, so you can list and download your documents again.
- Account data is kept while your account exists. Sessions expire automatically; connected-app tokens expire or are deleted when you revoke access or delete your account.
- Usage and website analytics are kept for up to 24 months and then deleted or aggregated.
- Technical logs are kept for up to 30 days, unless needed longer to investigate a security incident.
- Support emails are kept for as long as needed to resolve your request and for up to 24 months afterwards.
To delete your account and all associated documents, email info@doc247.xyz from the address you signed up with. We complete deletion within 30 days, except where the law requires us to keep something longer. Residual copies in backups are overwritten in the normal backup cycle.
7. Your choices and rights
- Disconnect an assistant at any time from ChatGPT’s or Claude’s settings. It will no longer be able to create or read documents in your account.
- Review your documents at doc247.xyz/documents.
- Access, correct, export or delete your personal data, object to or restrict processing based on legitimate interests (including analytics), and withdraw consent where we rely on it. To do so, email info@doc247.xyz. We answer within 30 days and may need to verify your identity.
- Complain to your local data-protection authority if you believe we have mishandled your data. We would appreciate the chance to address your concerns first.
If you are a California resident, you have similar rights to know, delete and correct personal information, and not to be discriminated against for exercising them. We do not sell or share personal information for cross-context behavioural advertising.
8. Cookies
The website uses only strictly necessary cookies to keep you signed in and to protect sign-in and authorization flows. We do not use analytics, advertising or third-party tracking cookies on the website. Our website analytics (see section 2) are cookieless: they do not set cookies or use local storage or similar technologies in your browser, and the data is sent to our own domain before being forwarded to PostHog.
9. Security
All traffic is encrypted with TLS. Passwords are hashed, access tokens are short-lived and signed, download links are signed and expire, and each workspace’s documents are isolated from other workspaces. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the relevant authorities as required by law.
10. Children
Doc247 is a business tool and is not directed to children. You must be at least 16 years old (or the age of digital consent in your country) to use it. We do not knowingly collect data from children.
11. Changes to this policy
We may update this policy as the Service evolves. We will post the new version here with a new “Last updated” date and, for material changes, notify you by email or in the Service before they take effect.
12. Contact
Questions, requests or complaints: info@doc247.xyz
Postal address: FortyTwo Eleven Consulting AB, Midsommargränd 4, Stockholm, 12635, Sweden