Privacy Policy

Effective date: 10/16/2026

1. Data Controller

The controller of your personal data is:
Piotr Kulbacki
Business name: Piotr Kulbacki Web Development
Address: Bendastr. 11, 12051 Berlin
Email: kontakt@dokiero.com
Further provider details are in the legal notice (Impressum).

6. Purposes and legal bases

We process personal data only for specified purposes:

  • User account (registration, login, settings) — Art. 6(1)(b) GDPR (contract).
  • Document analysis and letter generation — Art. 6(1)(b) GDPR (contract).
  • Payments and invoices — Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal obligation).
  • Contact form — Art. 6(1)(b) GDPR (pre-contractual request) or Art. 6(1)(f) GDPR (responding to enquiries).
  • Session cookies required to stay logged in — Art. 6(1)(b) and Art. 6(1)(f) GDPR.
  • Legal obligations (e.g. accounting) — Art. 6(1)(c) GDPR.
  • Advertising measurement and visit statistics (ChatGPT Ads / OpenAI Pixel, Google Analytics 4) — Art. 6(1)(a) GDPR (consent).
  • Occasional product notes (an important change or a short question) — Art. 6(1)(a) GDPR (consent). Only if you agree in the app. You can withdraw consent in Settings or by the link in the email. Deadline reminders you turn on yourself are separate.
  • Cookieless visit and performance statistics (Vercel Web Analytics, Speed Insights) — Art. 6(1)(f) GDPR (legitimate interest: operating and improving the service).
  • Registration source (the campaign or website that brought you to Dokiero; dk_attr cookie) — Art. 6(1)(f) GDPR (legitimate interest: assessing the effectiveness of our marketing).

7. Special categories of data

Official letters that you upload may incidentally contain special categories of personal data (Art. 9 GDPR), such as health information. We do not request such data as a separate category. Processing happens only to provide the service you ordered. By uploading a document you give explicit consent to that processing (Art. 9(2)(a) GDPR). You can delete documents and your account at any time.

2. Data Retention Period

We apply a strict data retention policy:

A. Source Files (Your photos/scans)

Files uploaded by you for analysis are processed in operational memory solely for the purpose of performing the service (OCR and data extraction). They are deleted immediately after generating the analysis result and are not archived or stored on our servers anywhere.

B. Analysis Results (Generated PDF/Word)

We store only documents generated by the system (PDF reports and editable Word letters) to enable you to download them in the "History" tab. The storage time depends on your package:

  • Standard Package: 30 days from the date of analysis.
  • Pro Package: 90 days from the date of analysis.
  • Extended validity (Option): According to the purchased period (e.g. archiving for 5 years).

After these deadlines, generated files are permanently and automatically deleted.

C. Profile Data and Signature Pattern

If you complete your data (name, surname, address) in the settings and upload a signature pattern file, this data is stored in our database until you delete it yourself or delete the account. They serve solely to automatically populate generated letters.

D. Inactive Accounts

We reserve the right to permanently delete the account and all associated data if the User does not log in to the service for a period of 24 months (2 years).

3. Data Recipients (Processors)

To provide the service we use trusted technology providers. Your data may be processed by:

  • OpenAI, L.L.C. (USA) – text analysis and translation. According to the Enterprise/API policy, data sent via API is not used to train OpenAI models.
  • Supabase, Inc. (USA/EU) – database, files and signature templates (hosting).
  • Stripe Payments Europe, Ltd. (Ireland) – online payments. Stripe acts as an independent controller for payment card data; the Service Provider does not receive your full card number.
  • Vercel Inc. (USA/EU) – hosting and delivery of the application, plus cookieless visit and performance statistics (Vercel Web Analytics, Speed Insights).
  • Brevo (Sendinblue, France/EU) – transactional email.
  • Cloudflare, Inc. (USA/EU) – Turnstile bot protection on the contact form.
  • Anthropic, PBC (USA) – selected AI processing, under the provider’s API terms.
  • Google Ireland Limited (Ireland) / Google LLC (USA) – visit statistics (Google Analytics 4), only after you consent in the cookie banner.

8. International transfers

Some providers (in particular OpenAI, Anthropic, Google, Supabase, Vercel and Cloudflare) may process data in the United States or other countries outside the EEA. Where required, transfers are based on the European Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as applicable to the provider.

4. Your Rights

According to GDPR, you have the right to:

  • Access your data (via Dashboard).
  • Rectify data (edit in Settings).
  • Download data (ability to download processed letters).
  • Delete data ("Right to be forgotten") – you can delete individual documents from history or the entire account in the application settings at any time. Deletion is permanent.
  • Restriction of processing.
  • Objection to processing based on legitimate interests.
  • Data portability where processing is based on a contract or consent.
  • Lodge a complaint with a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

Use of Google account data (Google OAuth)

Our application uses Google Sign-In. We access only your email address, first and last name, and profile picture to create an account, identify the user, and authorize access to the application. This data is stored securely and is not shared with third parties. We do not access your Google Drive, private emails, or any other data beyond the basic profile.

5. Cookies

The service uses necessary technical cookies (session) required for logging in and maintaining the User session. After you accept in the cookie banner, we also use Google Analytics 4 (Google) for visit statistics and to measure which channels bring users to us, and the ChatGPT Ads measurement pixel (OpenAI) to measure the effectiveness of our advertising campaigns. These tools are loaded only with your consent; if you decline, they do not run. You can change or withdraw your consent at any time by clicking “Cookie settings” in the page footer. Independently of the banner, we set our own dk_attr cookie (up to 90 days) that remembers which campaign or website brought you to Dokiero (e.g. utm parameters from a link). If you create an account, we store this source with the account and delete the cookie.

9. Data protection officer and complaints

No data protection officer has been appointed, as this is not legally required for this service. You may contact the controller at kontakt@dokiero.com or lodge a complaint with the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

← Back to home page