Privacy notice

This Privacy notice applies to the Doculate website, private workspace, document processing, APIs, exports, notification form, and related support services. Anphase Limited, based in Auckland and registered in New Zealand, is the agency responsible for personal information collected through Doculate. We handle it under the Privacy Act 2020.

It does not govern a third-party website, repository, drive, or other service before information is sent to Doculate. Those providers have their own privacy notices. If an organisation gives you access to Doculate, that organisation may separately control information it asks you to submit.

In this notice, personal information means information about an identifiable person. Your Content includes source files, instructions, evidence, annotations, and documents processed for you.

Information you provide

• Access and identity data: an email address or other identity supplied by an authorised authentication layer, and information needed to manage private-preview access.
• Source and document content: uploaded files, pasted text, connected sources, document metadata, images embedded in documents, and any personal information those materials contain.
• Workspace activity: projects, briefs, prompts, attestations, claim boundaries, corrections, approvals, annotations, evidence relationships, document versions, exports, and questions asked over reference material.
• Communications: notification sign-ups, support requests, feedback, and correspondence with us.
• Connector choices: the provider and source you select, plus authorisation data needed to retrieve the selected material. Where possible, provider tokens are handled by the connector service rather than exposed to Doculate's browser code.

Information created through use

• parsed text, located passages, candidate facts, support chains, and search indexes;
• generated drafts, answers, comparisons, changes, and export files;
• version identifiers, checksums, lineage, execution status, and audit events; and
• technical information such as request times, IP address, browser or device information, error details, and security events collected by us or our hosting providers.

We use personal information to:

• receive, store, parse, index, retrieve, compare, version, and export documents;
• extract evidence, display provenance, answer questions, and generate requested material;
• authenticate access, scope workspace records, and enforce permissions;
• operate durable processing, diagnose failures, restore service, and prevent duplicate or corrupted work;
• respond to support, privacy, and security requests;
• send service messages and updates you request;
• protect the Service, investigate misuse, enforce our terms, and comply with law; and
• understand reliability and improve features using operational signals, feedback, and aggregated or de-identified information where practical.

Our main reasons under applicable privacy law are performing our contract with you, our legitimate interests in operating and securing the Service, your consent for optional communications or connections, and compliance with legal obligations. Where we rely on consent, you may withdraw it without affecting earlier lawful processing.

We do not sell Your Content or personal information. We do not use document content for behavioural advertising or cross-context targeted advertising.

Doculate can operate deterministic document features without a generative model, but some deployments enable AI-assisted extraction, drafting, embeddings, or answers. When you use an enabled AI feature, relevant instructions and selected excerpts of Your Content may be sent to the configured AI API provider so it can return the requested result.

We do not use Your Content to train a Doculate foundation model. When provider controls are available, we use business or API configurations that do not permit general model training on submitted content. AI providers may retain limited request data for abuse monitoring or legal compliance under their applicable service terms and enterprise data controls.

Automated processing helps organise evidence and propose content, but it does not make decisions that are intended to produce legal or similarly significant effects about you. You decide whether to accept, reject, revise, or use a result.

We use specialist providers to operate the Service. The exact configuration can differ between local, preview, and production environments. Current provider categories include:

• Application hosting and delivery: hosting, content delivery, background processing, and encrypted environment configuration.
• Managed database storage: structured storage for projects, evidence, provenance, versions, and operational records.
• Private object storage: storage for source files, parsed representations, and generated exports.
• Document conversion, where configured: conversion of selected PDF and DOCX files into structured content.
• AI model providers, where an AI-assisted feature is enabled:optional extraction, embeddings, drafting, and answers over selected content.
• Email delivery, where configured: delivery of notification and service emails.
• File-storage connectors, when you choose to connect them:retrieval of the sources you select from a drive, repository, or similar service you authorise. A connector service may broker that authorisation and transfer rather than exposing it to Doculate's browser code.

These providers process information on our behalf under their service terms, data-protection commitments, and our instructions. We assess new providers in proportion to the information and risk involved and will update this notice when the set of material providers changes. The current named providers within each category are available on request from doculate@anphase.co.nz.

We may disclose information:

• to the service providers described above so they can perform their functions;
• when you direct us to connect, export, download, or otherwise send material;
• to professional advisers bound by confidentiality where reasonably necessary;
• to comply with law, court process, or a lawful government request;
• to investigate fraud, security threats, misuse, or risks to a person's safety or rights; or
• in connection with a genuine financing, reorganisation, sale, or transfer of the Service, subject to appropriate confidentiality and privacy safeguards.

We do not publish Your Content or share it with another Doculate user unless you direct the Service to do so or an organisation controlling the workspace has lawfully configured that access.

Doculate does not currently use advertising cookies or third-party marketing trackers. The Service and its infrastructure may use strictly necessary cookies, headers, or local storage to maintain authentication, remember essential preferences, balance traffic, prevent abuse, and keep a requested workflow functioning.

Hosting providers may collect limited request and performance logs. If we add non-essential product analytics or tracking, we will update this notice and use consent controls where required by law.

Doculate is operated from New Zealand, while some providers process or store information in other countries. Their privacy laws may differ from those where you live.

Where required, we use reasonable safeguards for overseas disclosure, including provider due diligence, contractual data-protection terms, recognised transfer mechanisms, and security controls appropriate to the information. For New Zealand information, we take reasonable steps consistent with Information Privacy Principle 12. For EEA or UK information, safeguards may include adequacy decisions or approved standard contractual clauses.

We retain information for as long as reasonably needed to provide and secure the Service, maintain requested document history, resolve disputes, enforce agreements, and meet legal obligations. Different records have different lifecycles:

• workspace content and version history remain while the workspace is active or until you request deletion;
• notification details remain until you unsubscribe, ask us to delete them, or the update programme ends;
• security, request, and execution logs are retained for a limited period appropriate to troubleshooting, integrity, and abuse prevention; and
• deleted data may remain temporarily in restricted backups or provider recovery systems before being overwritten in the ordinary cycle.

We may retain a minimal record where necessary to comply with law, document a deletion or opt-out, establish or defend legal claims, or protect the Service. Where feasible, retained information is isolated from ordinary use.

Depending on where you live, you may have rights to access, correct, receive a copy of, delete, restrict, or object to processing of personal information, and to withdraw consent. New Zealand's Privacy Act 2020 gives individuals rights to request access to and correction of their personal information.

Send a request to doculate@anphase.co.nz. We may need to verify your identity and authority before acting. We will respond within the period required by applicable law and explain if an exception applies.

You may unsubscribe from optional email using the method in the message or by contacting us. You may also complain to your local regulator. In New Zealand, that is the Office of the Privacy Commissioner at privacy.org.nz.

We use technical and organisational measures designed to protect information against loss, unauthorised access, alteration, and disclosure. These include access controls, encrypted transport, private document storage, protected credentials, authenticated downloads, integrity records, and separation of structured data from document objects.

No internet service can guarantee absolute security. Keep your credentials safe, review what you upload, and contact us promptly if you suspect an issue. Our Security page explains the current controls and responsible disclosure process in more detail.

Children

The Service is not directed to children under 16 and we do not knowingly collect their personal information. If you believe a child has submitted information, contact us so we can assess and remove it where appropriate.

Changes to this notice

We may update this notice as the Service, providers, or law changes. We will post the revised version here and change the date above. For a material change, we will take reasonable steps to provide additional notice.

Contact

For privacy questions, requests, or complaints, email doculate@anphase.co.nz. Doculate is operated by Anphase Limited, based in Auckland, New Zealand.