Docuoria

Legal

Privacy Policy

Last updated 2026-October-17. Published verbatim from PRIVACY.txt in the Docuoria repository.

1. Introduction

Sidub Inc. ("Company," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website (https://sidub.ca), when you use Monaiq (https://monaiq.com), our licensing and commerce platform, and when you use our software and services, including Docuoria (collectively the "Services"). Monaiq is operated by Sidub Inc.

By using our Services, you agree to the terms of this Privacy Policy.

2. Hosting Modes

Docuoria runs in one of these hosting modes. What leaves your machine follows the mode:

  • The Docuoria service (the cloud host Sidub Inc. operates): a document you or your flow uploads is processed on Sidub infrastructure and deleted within 48 hours of upload, or on request. Templates and account ledgers are kept in your organisation's account. Signing in sends your email address to the identity provider. Section 3 states it.
  • On your machine, with the project folder as the template store (docuoria serve, the local host): documents and ledgers stay in the project's .docuoria/ folder, and templates stay there until you run docuoria store push. Docuoria sends from the machine: the licence use Section 4.1 lists; your email address, sent to the identity provider's device sign-in, when you run docuoria login, docuoria account, or docuoria account keys create, and the machine's host name, which labels its seat, when you run docuoria login; the templates, when you run docuoria store push; the machine credential, when you run docuoria license status or docuoria logout; and the version request of docuoria doctor. The local host runs no HTTP retrieval step, so a template's retrieval address is never contacted. The AI tool that starts the local host sends what it sends under its own provider's terms.
  • On your machine, with your organisation's account as the template store (the default of docuoria init): documents and ledgers stay in the project's .docuoria/ folder. Templates go to your organisation's account at the Docuoria service. The rest of what Docuoria sends is as in the folder mode above.
  • Single-tenant: processed in your organisation's own deployment; an uploaded document is deleted within 48 hours of upload, or on request.
  • Self-hosted: documents never leave your organisation's own subscription.

Sections 3 and 4 are also published on the Docuoria service's privacy page.

3. Privacy: the Docuoria service

This part of the Sidub Inc. Privacy Policy covers Docuoria when an application connects to the Docuoria service, the cloud host Sidub Inc. operates: claude.ai, ChatGPT, Cowork, a developer tool on the connector, Power Automate, or n8n. Docuoria run on your own machine is covered in Privacy: Docuoria on your machine.

3.1 What leaves your machine

  • A document reaches the service only when you or your flow uploads it: attached in a chat and uploaded by the AI's code execution sandbox, or posted by a flow.
  • The rows extracted from a document return to the application that asked for them.
  • Signing in sends your email address to the identity provider, which confirms it with a one-time passcode.

3.2 What the service stores, and for how long

  • Uploaded documents: 24 hours, then refused and deleted; the storage lifecycle rule removes the bytes within the following day, so an uploaded document is gone within 48 hours. Deleting a document removes it at once.
  • Authoring drafts and batch jobs: 24 hours.
  • Upload tickets: 10 minutes. A ticket can add PDFs to your organisation's account and read nothing.
  • Download links for large results: 10 minutes.
  • Invitation emails: queued for delivery for up to 24 hours.
  • Templates and account ledgers: until your organisation deletes them, or 90 days after it last had a live seat.
  • Your account: your email address, your directory identifier, the version of the terms you accepted and when, your organisation, and its members and roles.
  • Sign-in: an access token lasts 1 hour; a refresh token lasts 30 days and is replaced at each use. Connection keys, refresh tokens, and upload tickets are stored only as hashes; seat credentials are stored encrypted.
  • An organisation with no live seat is read-only for 90 days: its templates and ledgers stay readable, and its owners are emailed 14 days before the end. Then the organisation and everything in it is deleted, as an owner's delete would.
  • When an owner deletes the organisation, its stores are removed and every seat credential and machine is revoked.

3.3 Logs

Logs carry sizes, ids, timings, outcomes, and error codes. They never carry document text, file names, codes, tokens, or template content.

3.4 AI and prompt injection

Docuoria runs no AI model; no document is read by a model or used for any purpose but the call that uploaded it. Prompt injection is a concern of the AI platform you connect, and that platform owns injection defence. Docuoria treats tool results and document text as data, never instructions; an AI that follows injected text acts only within your own organisation's account. A stored template is replaced when the caller asks; Docuoria's guidance directs the AI to run a regression check first.

3.5 Other hosting modes

  • Single-tenant: documents are processed in your organisation's own deployment and deleted within 48 hours of upload, or on request.
  • Self-hosted: documents never leave your organisation's own subscription.

4. Privacy: Docuoria on your machine

This part of the Sidub Inc. Privacy Policy covers Docuoria run on your own machine by docuoria serve, the local server a developer tool starts. The Docuoria service is covered in Privacy: the Docuoria service.

4.1 What leaves your machine

  • Documents never leave your machine. The local server reads them by path and extracts on the machine.
  • Templates go to your organisation's account when the project's store is the account, the store docuoria init chooses by default. With the project folder as the store, templates stay in the project's .docuoria/ folder until docuoria store push copies them to the account. Ledgers stay in the project's .docuoria/ folder with either store.
  • Licence use: the licence identifier, which features were used, how many units, and when, aggregated and sent periodically and when the server exits. It never includes document contents, file names, extracted values, or templates.
  • docuoria login sends your email address to the identity provider, which confirms it with a one-time passcode, and the machine's host name to the service, which labels the machine's seat with it.
  • docuoria doctor asks the service for its version.
  • The commands that reach the service send what they name: docuoria store push the templates, docuoria license status and docuoria logout the machine credential, and docuoria account and docuoria account keys create your email address to the identity provider's device sign-in.

4.2 What stays on your machine

  • A seat credential labelled with the machine's name, stored by docuoria login and revoked by docuoria logout or from the account. Treat it like a password.
  • The project's .docuoria/ folder: templates when the folder is the store, ledgers, authoring drafts and batch jobs for 24 hours, and the server's logs.

4.3 Logs

Logs go to standard error and to .docuoria/logs/ on the machine; standard output carries the protocol only. Logs carry sizes, ids, timings, outcomes, and error codes. They never carry document text, file names, codes, tokens, or template content.

4.4 AI and prompt injection

Docuoria runs no AI model. Prompt injection is a concern of the AI tool you connect, and that tool owns injection defence. Docuoria treats tool results and document text as data, never instructions; an AI that follows injected text acts only within your own project and organisation's account. A stored template is replaced when the caller asks; Docuoria's guidance directs the AI to run a regression check first.

5. Information We Collect

We may collect personal information from you in various ways, including:

  • Account Registration: When you register for an account, we collect information such as your name, address, email, phone number, and marketing preferences.
  • License Purchases: When you purchase a licence, payment is processed by a third-party payment processor. We do not collect or store your full payment card details. We receive transaction details such as the offering purchased, the amount and currency, the status of the transaction, and an identifier for it.
  • Authentication: When you sign in, authentication is performed on our behalf by a third-party identity provider. We receive an identifier for your account and the email address associated with it.
  • Software Usage and Metered Consumption: Software you use transmits data to Monaiq to validate your licence and to report metered use of licensed features: your licence identifier, which features were used, how many units were consumed, and when. Usage is aggregated before it is sent. We use it to apply the limits of your plan, to bill usage-based charges where they apply, and for troubleshooting and support. It does not include the contents of the documents or files you process, their file names, the values extracted from them, or the templates used to extract them.
  • Documents you upload to the Docuoria service, as Section 3 states.
  • Website Interaction: We may collect information through cookies and similar technologies when you interact with our website.

6. Use of Your Information

We use your personal information for the following purposes:

  • Provision of Services: To provide, maintain, and improve our Services, including account management and license purchases.
  • Communication: To communicate with you about your account, transactions, updates, and promotional materials (with your consent).
  • Analytics and Improvements: To analyze usage patterns and improve our Services.
  • Compliance and Enforcement: To enforce our agreements, comply with legal obligations, and protect our rights and interests.

7. Disclosure of Your Information

We do not share your personal information with third parties except as follows:

  • Service Providers: With trusted third-party service providers who assist us in operating our Services, including payment processing, identity and authentication, and cloud hosting and infrastructure. These providers process information on our behalf and are bound by obligations to protect it.
  • Legal Compliance: When required by law, legal process, or governmental request.
  • Protection of Rights: To protect and defend the rights or property of Sidub Inc., users, or the public.
  • Business Transfers: In connection with a merger, sale, or transfer of assets.

8. Data Storage and Security

We implement reasonable security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is completely secure.

Some Services store a licence credential on your own computer so that the software can operate without contacting our servers on every use. That credential authorises your licence and should be treated like a password: keep it confidential, and use the software's licence-removal or logout command to delete it from any machine you no longer control.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access: Request access to your personal information.
  • Correction: Request correction of inaccurate or incomplete information.
  • Deletion: Request deletion of your personal information, subject to certain exceptions.
  • Withdrawal of Consent: Withdraw consent where processing is based on consent.

To exercise your rights, please contact us at support@sidub.net or call 1-226-666-2111.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. You can manage your cookie preferences through your browser settings. For more details, please refer to our Cookies Policy at https://sidub.ca/cookies.

11. International Data Transfers

Your personal information may be transferred to and processed in countries other than your country of residence, including Canada and the United States. We take appropriate measures to ensure that your information is protected in accordance with this Privacy Policy and applicable laws.

12. Children's Privacy

Our Services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us to have it removed.

13. Retention of Data

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. Documents and the records made while processing them are kept for the periods Sections 3 and 4 state.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Changes will be effective upon posting the revised policy on our website with an updated "Last Updated" date. Your continued use of the Services signifies your acceptance of the changes.

15. Governing Law

This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein.

16. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Questions and requests

Write to support@sidub.net for a question about this policy, to exercise a right over your personal information, or to have a document removed before its retention ends. Sidub Inc.'s full Privacy Policy is at https://docuoria.com/privacy.