Draft - not yet reviewed by a solicitor.
This describes, as accurately as possible, what DocChaser actually does with data today. It is not legal advice. Before onboarding real customers, this should be reviewed by a qualified solicitor, and the site operator should confirm their own ICO registration (data protection fee) as a UK data controller, and put Standard Contractual Clauses or an equivalent safeguard in place for the international subprocessors listed below.
Last updated: [date].
This policy covers two groups of people: firm users (the accountants and staff who sign up for and use DocChaser directly) and clients(the firm's own clients, whose details a firm adds to DocChaser so we can chase them on the firm's behalf). For a client's data, the firm is the data controller and DocChaser processes it on the firm's instructions - see our Terms of Service.
For firm users: name, email address, hashed password, and role within the firm.
For clients (added by a firm): name, email address, and phone number if provided; the content of messages exchanged during a chase; and any documents uploaded in response to a chase request (which may include financial documents such as bank statements, receipts, or tax records).
We do not collect payment card details directly - subscription payments are handled entirely by Stripe.
We share data with the following third parties, only as needed to provide the service:
Several of these providers are based outside the UK. Where personal data is transferred internationally, we rely on the safeguards required by UK data protection law (such as Standard Contractual Clauses) - [specific mechanism per provider to be confirmed and documented here].
We retain firm and client data for as long as the firm's account is active, so that engagement history and audit trails remain available. [A specific post-cancellation deletion timeline is not yet defined and should be added here.]
Passwords are hashed, never stored in plain text. Uploaded files are validated for type and size and checked against their actual content before being stored. Access to a firm's data within DocChaser is restricted to that firm's own authenticated users. No system is perfectly secure, and we can't guarantee absolute security of information transmitted to us.
Under UK data protection law you have the right to request access to, correction of, or deletion of your personal data, to object to certain processing, and to complain to the Information Commissioner's Office (ICO) if you believe your data has been mishandled. If you are a client of a firm using DocChaser rather than a firm user yourself, please contact that firm directly in the first instance, since they control your data.
We use a single strictly-necessary session cookie to keep firm users logged in. We do not use advertising or analytics tracking cookies.
Questions about this policy, or a data rights request: [contact email].