Privacy policy
Last updated: 12 October 2026
hck.innovations ("we", "us") runs Docuflat at docuflat.com. This policy explains what personal data we collect, why, who we share it with and the choices you have. We follow India's Digital Personal Data Protection Act, 2023 (DPDP Act). For this policy we are the "data fiduciary" and you are the "data principal".
Your documents stay on your device
Files you convert are processed inside your own browser. They are not uploaded to our servers, and we never see their contents. When you use OCR for a language other than English, your browser downloads that language's data from a public content delivery network (jsDelivr); your documents are not sent there.
What we collect
- Account details: your name, email address and a securely hashed password, or your Google account ID if you sign in with Google.
- Billing details: your state, and optionally your GSTIN and business name, to issue GST invoices. Card, UPI and bank details are handled by Razorpay and never reach us.
- Usage counts: how many files and OCR pages you convert each day, and file sizes, to apply plan limits. For visitors without an account we use a cookie and the IP address for this. We never record file names or contents.
- Product analytics: with Google Analytics we record actions such as starting or finishing a conversion (with the file type, for example "pdf", and the number of OCR pages), reaching a daily limit, signing up, logging in, confirming an email, opening the payment window and completing a purchase (plan and amount). We don't send names, email addresses, file names or document contents to Google Analytics.
- Technical data: IP address, browser type and error details in server logs, kept for security and to fix problems.
How we use it
- To run your account, apply limits and provide Pro features.
- To process payments (Razorpay) and keep accounting records and GST invoices (Zoho Books).
- To send essential emails: email confirmation, password resets, payment receipts, invoices and notices about your plan.
- To send a few helpful emails after you sign up: a welcome email with tips, one reminder if you haven't confirmed your email, and a note if you reach the free daily limit (at most once a month). Every such email has an unsubscribe link, and unsubscribing doesn't affect essential emails.
- To understand how people use Docuflat, so we can improve it (analytics), and to show ads on free pages.
- To prevent abuse and keep the service secure.
Cookies and similar storage
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
df_sess | Docuflat | Keeps you logged in and protects forms (essential) | Until you close the browser |
df_gid | Docuflat | Counts daily usage for visitors without an account (essential) | 1 year |
df_langs (local storage) | Docuflat | Remembers the OCR languages you picked, on your device only | Until you clear it |
_ga, _ga_* | Google Analytics | Distinguishes visitors and sessions for usage statistics | Up to 2 years |
__gads, __gpi, __eoi and similar | Google AdSense | Shows and measures ads, limits how often you see the same ad | Up to 13 months |
FCCDCF, FCNEC | Google (consent message) | Remembers your consent choices where a consent message is shown | Up to 13 months |
Pro users don't see ads, so AdSense cookies aren't set for them while logged in. You can block or delete cookies in your browser settings; essential cookies are needed for logging in and for usage limits.
Advertising and analytics
Free pages show ads from Google AdSense. Google and its partners may use cookies to show ads based on your visits to this and other websites. You can turn off personalised ads at adssettings.google.com, and learn how Google uses data at policies.google.com/technologies/partner-sites. To stop Google Analytics from recording your visits on any site, you can install Google's Analytics opt-out add-on. Visitors from the European Economic Area, the UK and Switzerland are shown Google's consent message, which asks before personalised ads are shown.
Sharing
We share data only with service providers that help us run Docuflat, under their own privacy and security terms:
- our web host (servers and email delivery);
- Razorpay (payments);
- Zoho (accounting and GST invoices);
- Google (sign-in with Google, Analytics and AdSense);
- jsDelivr (delivers OCR language files to your browser).
We also disclose data to authorities where Indian law requires it. We don't sell personal data. Some of these providers store data outside India.
How long we keep data
- Account data: while your account is open. When you delete your account, we remove your name, email address, password and billing details from your account record straight away.
- Payment and invoice records: as long as GST and tax law requires (in India, 72 months from the due date of the relevant annual return), linked to an anonymised account after deletion.
- Database backups: kept for 14 days, then deleted automatically, so deleted data disappears from backups within 14 days.
- Daily usage counts for visitors without an account: 90 days.
- Our error logs: 90 days. Our web host keeps its own access logs for a limited period.
- Google Analytics data: 14 months, after which Google deletes it.
Your rights
Under the DPDP Act you can:
- get a summary of the personal data we hold about you and who we've shared it with;
- correct, complete or update your data (most of it from your account page);
- erase your data, by deleting your account from your account page or by writing to us;
- withdraw consent for optional processing, such as tips emails, at any time (withdrawing doesn't affect processing already done);
- nominate another person to exercise these rights if you die or become unable to;
- have your grievances addressed by us, and if you're not satisfied, complain to the Data Protection Board of India.
To use any of these rights, email support@docuflat.com from your account's email address.
Children
Docuflat accounts are for people aged 18 or over. If you're under 18, use Docuflat only with the consent and supervision of a parent or guardian. If we learn that an account belongs to a child without that consent, we'll delete it.
Security
We use HTTPS everywhere, hash passwords, limit login attempts and keep backups outside the public web folder. No system is perfectly secure; if a breach affects your personal data, we'll inform you and the Data Protection Board as the law requires.
Changes to this policy
We'll update the date at the top when this policy changes, and email account holders about significant changes.
Grievance officer
For any privacy concern or request, write to the grievance officer at support@docuflat.com, hck.innovations, 22, Kenderdine Lane, Kolkata, West Bengal 700012, India. We aim to respond within 30 days.