Privacy Policy
Last updated: August 17, 2026
This Privacy Policy explains how Docora, a product operated by SpectrumX Technologies (Private) Limited ("Docora," "we," "us," "our"), collects, uses, and protects your information when you use our Service.
1. Information We Collect
Account information: Name, email address, company name, and other details you provide when creating your account.
Content you create: Proposals, contracts, invoices, and client information (names, emails, and other details) that you enter into the Service.
Payment-related information:
- If you connect your own Stripe account, we store your Stripe API key and webhook signing secret, encrypted at rest. We do not have access to your Stripe account password or your clients' card details — these are handled entirely by Stripe.
- If you provide bank transfer details for your clients to pay you, we store those details encrypted at rest (both your saved defaults and any copy snapshotted onto an invoice at send time).
- Your own Docora subscription payment is handled by Paddle.com; we do not store your card details for Docora subscription billing.
Usage information: Basic technical information such as log data and device/browser information, used for security and troubleshooting.
2. How We Use Your Information
We use your information to:
- Provide and operate the Service (generating proposals, sending invoices, processing your requests).
- Communicate with you about your account, updates, or support requests.
- Improve and maintain the security of the Service.
- Comply with legal obligations.
3. Third Parties We Share Data With
We share data with the following third-party service providers, solely as necessary to operate the Service:
| Provider | Purpose |
|---|---|
| OpenAI, Google (Gemini) | AI-assisted generation of proposal and contract content |
| Stripe | Payment processing (if you connect your own account) |
| Paddle | Docora's own subscription billing |
| Vercel (or equivalent hosting/storage provider) | Application hosting and file storage (e.g. uploaded logos) |
| Email delivery provider | Sending transactional emails (e.g. proposal notifications) |
| Google Analytics | Website and product usage analytics |
We do not sell your personal information to third parties.
4. How We Protect Your Information
- Stripe credentials (Restricted API keys and webhook signing secrets) are encrypted at rest with AES-256-GCM. In the product UI and APIs they are shown only as a short masked reference (e.g. last 4 characters), never in full.
- Bank transfer details (account numbers / IBAN and related fields) are encrypted at rest with the same AES-256-GCM scheme. They are decrypted server-side only when needed: for you to edit them in Settings or on a draft invoice, and for your client to see payment instructions on a public invoice (or PDF) when bank transfer is the selected method.
- Account passwords are stored as one-way hashes (not reversible encryption).
- Access to production systems and data is restricted to authorized personnel.
- We use industry-standard security practices, but no system can be guaranteed 100% secure. You are responsible for keeping your own account credentials confidential.
5. Data Retention
We retain your account and content data for as long as your account is active. If you close your account, we will delete or anonymize your data within a reasonable period, except where we are required to retain it for legal, tax, or accounting purposes.
6. Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data.
- Object to or restrict certain processing of your data.
To exercise these rights, contact us at support@docora.io.
7. Cookies
We use essential cookies necessary for the Service to function (e.g. keeping you logged in, remembering your theme preference). We also use Google Analytics (gtag.js) to understand how visitors use the Service. Google may set analytics cookies and process usage data according to its own policies.
8. International Data Transfers
Because we use third-party service providers located in various countries (including the United States), your data may be transferred to and processed in countries other than your own. We take steps to ensure these providers handle data responsibly.
9. Children's Privacy
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to you before they take effect.
11. Contact Us
Questions about this Privacy Policy or your data can be directed to:
SpectrumX Technologies (Private) Limited Karachi, Pakistan