Privacy Policy

Effective 17 August 2026 · Last updated 17 August 2026

1. Who we are

DocVerify Pro ("we", "us") operates the web application available at the address from which you accessed this policy.

Data controller: DocVerify Pro, operated as a sole proprietorship registered in Puerto Rico, United States.
Privacy contact: privacy@docverifypro.com

Postal correspondence. DocVerify Pro operates as a sole proprietorship without a public business address. Requests requiring postal correspondence — including data subject access requests under GDPR or CCPA — should be initiated by email to the address above, and a correspondence address will be supplied directly to the requester.

2. How document processing works

DocVerify Pro is a client-side application. All image analysis, correction and file generation is performed by JavaScript executing in your browser, using your device's own processor and memory.

• Documents you select are read into your browser's memory using the standard FileReader interface.
• Image correction — illumination flattening, glare reduction, perspective correction, contrast processing — is performed on an HTML <canvas> element in your browser.
• Output files (PDF, JPEG, PNG, TIFF) are generated in your browser and saved directly by your browser to the location you choose.

2.1 What this means

• We do not store your documents, because we never receive them.
• We do not log your documents, because we never receive them.
• We do not use your documents to train artificial intelligence or machine learning models, because we never receive them.
• We cannot provide your documents to any third party, law enforcement body or litigant, because we never receive them.
• Closing the browser tab discards all processing data. There is no cache to purge and no retention period to wait out.

2.2 Metadata removal

Where you enable the metadata stripping option, camera EXIF data — including GPS coordinates, device serial numbers and timestamps — is discarded during processing and is not written to the output file. This also occurs on your device.

3. Information we do collect

3.1 Payment information

If you purchase a plan, checkout is handled by Stripe, Inc. We do not collect, receive, transmit or store your card number, CVC or expiry date at any point. Stripe collects this directly.

From Stripe we receive: your email address, the plan purchased, the transaction amount and date, the payment status, and the country associated with the payment method. We use this solely to provide the plan you paid for, to issue receipts, and to meet tax and accounting record-keeping obligations.

Legal basis (GDPR): performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for retention of financial records.

Retention: financial records are retained for the period required by applicable tax law, commonly seven years. Your email address is retained for the life of your subscription plus that statutory period.

3.2 Values stored on your device

Two small values are stored in your browser's localStorage:

• dv_licence_token — a signed licence token issued after purchase, so the application recognises your plan on return visits.
• dv_trial_runs — a counter recording that you have used the free trial.

Both live on your device. Clearing your browser storage removes them.

3.3 Licence server

Subscription checks are handled by a licence service we operate on Cloudflare Workers. When you begin checkout, return from Stripe, or download a file, your browser contacts this service.

What it receives: your licence token (or nothing at all, on the free tier), the plan name, and the network request itself.

What it never receives: your documents. No image data, no extracted text, no file contents are transmitted at any point. The service has no upload endpoint.

Anonymous free-tier counting. To limit free downloads without requiring an account, the service stores a SHA-256 hash of your IP address combined with a salt that rotates every day. The result expires after 48 hours, cannot be reversed to your IP, and cannot be correlated across days. It is a rate-limit token, not an identifier, and it is not linked to any other data.

Legal basis (GDPR): performance of a contract (Art. 6(1)(b)) for licence validation; legitimate interests (Art. 6(1)(f)) for abuse prevention on the free tier.

3.4 Website analytics

We run no analytics. This site loads no analytics script, no tag manager, no advertising pixel and no third-party tracker of any kind. We do not know how many people visit a page, which page they came from, or what they did while they were here. You can confirm this in your browser's Network tab: no request is made to any analytics or advertising domain.

We set no cookies. The only values kept on your device are the two listed in section 3.2, both of which are placed by the application itself in localStorage to remember your plan — not to identify or follow you. Because no cookies and no device identifiers are set, no consent banner is required, and you will not see one.

Server logs. The site is hosted on Cloudflare Pages. Like every web host, Cloudflare processes the connection data needed to deliver a page and to protect the site from attack — your IP address, the time of the request, the page requested and your browser's user-agent string. We do not build reports from these logs, do not export them, and do not combine them with anything else. Cloudflare retains them under its own retention schedule.

Legal basis (GDPR): legitimate interests (Art. 6(1)(f)) — delivering the site and preventing abuse.

If we ever add analytics, this section will be rewritten before the change goes live, and the “last updated” date at the top of this page will change. We will not add anything that sets a cookie or tracks you across other sites.

3.6 The payment form

The one third-party script this site can load is Stripe.js, and it loads only if you open the payment panel — never on an ordinary visit, and never while you are working on a document. You can confirm this in your browser’s Network tab: browse, upload and process as much as you like and no request to js.stripe.com appears until you press the subscribe button.

When you do open it, the card fields are rendered by Stripe inside their own frame. Your card number, expiry and CVC go directly from your browser to Stripe. They do not pass through this site, and they do not pass through our licence service — which is why we never hold them and could not disclose them to anyone. Stripe acts as an independent data controller for payment data under its own privacy policy, and as our processor for the billing details described in section 3.1.

Your documents are not part of this. Opening the payment panel does not upload, transmit or expose any document you have processed. Document handling is unchanged by anything in this section.

3.5 Support correspondence

If you email us, we hold that correspondence in order to answer you. Please do not attach documents to support emails. We do not need them and do not want to receive them. If you send one, we will delete it and ask you not to send another.

4. What we never do

• We never sell personal information. We have never sold personal information.
• We never share personal information with advertisers or data brokers.
• We never use your documents for model training.
• We do not build advertising profiles or engage in cross-context behavioural advertising as defined by the CPRA.

5. Sub-processors

No sub-processor receives document content, because no sub-processor is sent document content. Standard Contractual Clauses govern transfers of personal data outside the European Economic Area and the United Kingdom where such transfers occur.

6. Your rights

6.1 Under GDPR (EEA and UK)

You have the right to access, rectify, erase, restrict processing of, and port your personal data, and to object to processing based on legitimate interests. You may withdraw consent at any time where processing is based on consent.

In practice, the personal data we hold about you is limited to your billing record. Requests concerning documents are not applicable, as we hold none.

You may lodge a complaint with your national supervisory authority.

6.2 Under CCPA/CPRA (California)

California residents have the right to know what personal information is collected, to request deletion, to request correction, to opt out of sale or sharing, and to limit the use of sensitive personal information. You will not be discriminated against for exercising these rights.

We do not sell or share personal information as those terms are defined by the CPRA, so no opt-out mechanism is required. We do not collect sensitive personal information as defined by the CPRA.

6.3 Making a request

Email the privacy contact address in Section 1. We will verify your identity by reference to the email address associated with your payment record and respond within 30 days (GDPR) or 45 days (CCPA/CPRA), extendable where permitted by law.

7. Security

Our website is served exclusively over HTTPS using TLS. Payment processing is carried out by Stripe, which maintains PCI DSS Level 1 certification as a service provider.

Because document processing occurs on your device, the security of your documents during processing depends on the security of your own device and browser. We recommend keeping your browser updated and not using shared or public computers for sensitive documents.

8. Children

This service is not directed at children under 16 and we do not knowingly collect personal information from them.

9. Changes to this policy

We will post any changes on this page and update the "last updated" date. Where changes are material we will provide notice by email to active subscribers before the changes take effect.

10. Not legal or immigration advice