This policy explains how Vespera Capital Limited, trading as Vespera Digital, handles personal data in connection with Docs In. It covers the practices that use Docs In and their staff, the clients of those practices who upload documents, and the people who ask us about it.
Two roles
For your practice’s account, your staff sign ins and our commercial relationship with you, Vespera Capital Limited, trading as Vespera Digital, is responsible for the data.
For your clients’ names, email addresses and the documents they upload, your practice decides what is requested and why. We process that data on your behalf and only to request, receive, check and hand over the records you have asked for. A data processing agreement is drafted with founding members before access opens.
What we collect
- Your email address, to tell you when founding access opens and to run your account.
- Your pricing choice, if you ask for a founding place, to plan founding places.
- Once in use: your clients’ names, email addresses and the documents they upload, to request, receive, check and hand over the records your practice needs.
- Billing records from Paddle: your Paddle customer reference, the email address Paddle holds for you, your subscription status and any refunds, to show your plan, manage access and handle billing questions.
- Anything you send us when you ask for support.
How we use it
To provide Docs In, including checking each document against its request, to keep accounts secure, to support you and to meet legal obligations. We do not sell personal data, we do not use it for advertising, and we do not use your clients’ documents to train artificial intelligence models.
Who else processes data
- Supabase: database, storage and sign in.
- Sentry: error monitoring.
- PostHog: product analytics, without cookies.
- Paddle: payments, tax and invoicing, as merchant of record.
Each processes data under a contract that requires it to protect the data and use it only to provide its service to us. Documents will be stored encrypted at rest in a database region in the European Union. Before access opens, we will name here the providers that deliver request emails and check uploaded documents. Where data is processed outside the country in which it was collected, we rely on contractual safeguards and the protections the law requires.
How long we keep it
Requests for a founding place are kept until founding access has opened and for 12 months after, then deleted. Uploaded documents are kept for as long as the practice’s account is open and deleted within 30 days of a deletion request. Billing records are kept while your account is open and afterwards, by Paddle and by us, for as long as tax and accounting law requires.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, object to its use or ask us to delete it, subject to the limits the law allows. If you are a client of a practice that uses Docs In, we will pass your request to that practice and help it respond. You may complain to the data protection authority in your country, such as the Information Commissioner’s Office in the United Kingdom or the Office of the Data Protection Commissioner in Kenya.
Children
Docs In is a service for professional practices and is not directed at children.
Contact
Privacy questions and requests reach us at support@vespera-org.com.