This Privacy Policy explains how Docktape Technologies (“Docktape Technologies,” “we,” “us,” “our”) collects, uses, discloses, and protects personal data in connection with docdex, the governed knowledge layer for AI assistants, including the docdex website (docdex.ai), the docdex console, and the underlying docdex platform (together, the “Service”).
docdex is a business-to-business (B2B) product. Our customers are organizations (“Customers”) that provision workspaces for their own personnel and, in some cases, external collaborators (“Workspace Users”) with roles such as owner, knowledge manager, member, auditor, or billing admin.
Because docdex serves both roles - a website/product operator and a data processor acting on behalf of Customers - this policy is organized so it is clear, for each category of personal data, whether Docktape Technologies acts as controller (we decide the purposes and means of processing) or processor (we process only on behalf of, and at the instruction of, a Customer, who is the controller). Section 3 explains this distinction; Section 4 applies it to each data category we handle.
This policy is written primarily against the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), reflecting that docdex’s infrastructure is hosted in the EU and that GDPR is the primary legal framework governing our processing. Where other data protection laws apply to a particular Customer or Workspace User, this policy should be read alongside, and does not limit, any rights available under those laws.
The controller responsible for the processing described in this policy (except where Section 4 identifies Docktape Technologies as a processor acting on a Customer’s instructions) is:
Docktape Technologies Kft.
Registered seat: 1115 Budapest, Szentpétery street 14, Hungary
Company registration number: 01-09-395269
Contact: hello@docdex.ai
docdex handles two broad kinds of personal data, and Docktape Technologies’ role differs depending on which kind is at issue:
Processing carried out in our processor capacity is governed by a separate Data Processing Agreement (“DPA”) entered into with each Customer, which sets out our obligations under Article 28 GDPR in detail (including processing instructions, sub-processing, security measures, assistance with data subject rights, and audit rights). The DPA is not published on our public website but is available on request to prospective and current Customers - contact your account representative or hello@docdex.ai. If you are a Workspace User with a question about data your employer or organization has put into docdex, please direct that request to your organization (the controller for that data) in the first instance; we will support your organization in responding as required by the DPA.
What: Name, work email address, and related identity attributes issued through our identity provider (Keycloak, using SSO/OIDC), plus workspace role and membership information (e.g., owner, knowledge manager, member, auditor, billing admin).
Purpose: To create and secure your account, authenticate you, enforce workspace roles and permissions, and operate core account functionality (e.g., billing administration, audit logging).
Role: Docktape Technologies is the controller for this data.
Legal basis: Performance of a contract with you or your organization (Art. 6(1)(b) GDPR), and, where relevant, our legitimate interest in maintaining account security and integrity (Art. 6(1)(f) GDPR).
What: Documents and content that a Customer uploads directly to docdex, or that docdex ingests via connectors to third-party systems the Customer has authorized (e.g., Google Drive, Slack), including the content of those documents and associated metadata (filenames, authorship, timestamps).
Purpose: To provide the core Service - indexing, retrieval, and governed AI-assisted search over the Customer’s own content.
Role: Docktape Technologies is the processor; the Customer is the controller. This data is processed only at the Customer’s instruction and for the purposes set out in the applicable DPA.
Legal basis: Not applicable to Docktape Technologies directly - the Customer, as controller, is responsible for establishing its own legal basis for this data (e.g., its employment relationship with its personnel, or its own legitimate interests) before uploading or connecting it to docdex.
What: OAuth tokens, refresh tokens, and connection metadata (e.g., which third-party account is connected, connector configuration, sync status/timestamps) generated when a Customer authorizes docdex to connect to a third-party system.
Purpose: To establish and maintain the authorized connection needed to sync content under Section 4.2, and to operate and troubleshoot that sync.
Role: Docktape Technologies is the processor, acting at the Customer’s instruction; the Customer is the controller.
Legal basis: Not applicable to Docktape Technologies directly, for the same reason as Section 4.2.
What: Metadata that mirrors and reflects the access permissions Customers have configured in their own source systems (e.g., who can view a given document in Google Drive or Slack) and that docdex uses to filter retrieval results, together with docdex’s own workspace role assignments.
Purpose: This metadata is the technical basis of docdex’s core function: ensuring that when an AI assistant answers a query, the answer is filtered to reflect what the asker is actually permitted to see. Docktape Technologies ingests, stores, and applies this metadata solely to enforce the access rules the Customer has already defined in its own systems - we do not define, alter, or independently decide those rules.
Role: Docktape Technologies is the processor; the Customer is the controller. This metadata is processed at the Customer’s instruction, for the sole purpose of enforcing the Customer’s own pre-existing access rules within the Service.
Legal basis: Not applicable to Docktape Technologies directly, for the same reason as Sections 4.2 and 4.3. We do not currently assert an independent legitimate interest in this data (for example, for cross-tenant security monitoring purposes); if that changes, we will update this policy to name the specific interest being pursued, as required by Art. 13(1)(d) GDPR.
What: Usage and interaction data collected via PostHog, a product analytics tool, hosted on PostHog’s EU instance (eu.i.posthog.com). This may include pages viewed, features used, session duration, device/browser information, and similar behavioral data. This is product analytics only - PostHog is not used for advertising, ad-tracking, or remarketing, and PostHog data is not shared with advertising networks. (For the separate advertising and remarketing cookies docdex.ai uses via Google Tag Manager, see Section 4.7.)
Purpose: To understand how the website and product are used, in order to improve them.
Role: Docktape Technologies is the controller for this data.
Legal basis and consent mechanism: PostHog does not initialize or run at all - no analytics cookie is set, and no analytics event is sent - until a visitor has actively opted in via the cookie consent banner described in Section 5. Once a visitor grants consent to the “analytics” cookie category, the legal basis is that consent (Art. 6(1)(a) GDPR), which the visitor may withdraw at any time as described in Section 5. There is no fallback legal basis under which analytics runs without consent.
What: Name, email address, and message content submitted through a contact form on docdex.ai.
Purpose: To respond to inquiries. Submissions are forwarded to our team via Slack for handling.
Role: Docktape Technologies is the controller for this data.
Legal basis: Our legitimate interest in responding to inquiries directed to us (Art. 6(1)(f) GDPR), or, where the inquiry concerns entering into a contract, pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
What: Cookie and device-based identifiers set via Google Tag Manager (“GTM”), used to serve Google Ads remarketing and conversion tracking. GTM tags in this category are gated behind CookieChimp’s Google Consent Mode v2 integration, operating in Basic Consent Mode. In Basic Consent Mode, the relevant GTM tags do not fire at all - including no cookieless pings and no data of any form sent to Google - until the visitor has given consent via the “marketing” cookie category described in Section 6. If consent is not given, or is withdrawn, no data is sent to Google under this category.
Purpose: To recognize a returning visitor to docdex.ai, subsequently display docdex advertising to that visitor on other sites and platforms within Google’s advertising network, and measure the performance of those advertising campaigns (conversion tracking).
Scope: We do not currently use, and have no plans to use, Google Ads Enhanced Conversions, Customer Match, or audience-expansion / similar-segments targeting. If this changes, this Section 4.7 will be updated in advance of any such use.
Role: For this processing, Docktape Technologies acts as controller.
Legal basis: Consent (Art. 6(1)(a) GDPR) only, obtained through the “marketing” cookie category described in Section 6. No other legal basis (e.g., legitimate interest) is relied upon for this processing, and no GTM tag in this category fires in the absence of that consent.
docdex.ai uses a cookie consent banner powered by CookieChimp, a standard EU cookie-consent management platform. The banner is presented to visitors before any non-essential cookie is set.
Strictly necessary cookies (e.g., session and authentication cookies needed to log you into the console and keep you logged in) do not require consent under applicable ePrivacy rules and are set automatically as needed to operate the Service. These are not part of the consent banner’s opt-in categories.
Analytics cookies (PostHog) are not strictly necessary and require your consent. Consistent with Section 4.5, PostHog is not initialized and no analytics cookie is set until you actively accept the “analytics” category in the CookieChimp banner. If you decline or dismiss the banner without accepting, PostHog does not run.
Marketing cookies (Google Tag Manager / Google Ads). These cookies are set only after a visitor has given consent under the “marketing” category described in Section 6, and are used for the advertising and remarketing purposes described in Section 4.7. Because our Google Consent Mode integration operates in Basic mode, no marketing cookie is set and no data is sent to Google under this category until that consent is given.
You can change your choice for either category at any time via the CookieChimp banner’s own preferences control, which lets you withdraw consent; withdrawing consent stops future collection under that category (it does not retroactively delete data already collected, which is instead subject to the retention and deletion practices described in Section 11).
Where Docktape Technologies acts as controller (Sections 4.1, 4.5, 4.6, 4.7), we rely on one or more of the following legal bases under Art. 6(1) GDPR, as specified for each category above:
Where Docktape Technologies acts as processor (Sections 4.2, 4.3, 4.4), we do not assert an independent legal basis of our own; the Customer, as controller, is responsible for its own legal basis, and we process only on the Customer’s documented instructions under the applicable DPA.
Under Art. 13(2)(e) GDPR, we set out below whether providing each category of data is a statutory or contractual requirement, and the consequence if it is not provided:
Docktape Technologies does not engage in automated decision-making, including profiling, that produces legal effects concerning a data subject or similarly significantly affects a data subject within the meaning of Article 22 GDPR.
In particular, docdex’s permission-based filtering of AI-retrieved content - determining which content a query result may surface to the person asking - is an access-control function, not a decision made about the data subject whose personal data may appear within that content. It does not evaluate, score, or make any determination about a data subject; it only enforces access rules that the Customer has already configured in its own source systems, as described in Section 4.4.
We do not sell personal data. We share personal data only as described in this policy or the applicable DPA, including with:
This independent-controller relationship with Google concerns docdex.ai visitor and cookie data only. It has no relationship to Customer document content processed by the product, which remains governed entirely by the processor / data-processing-agreement framework described in Sections 3-4.4.
Security documentation describing our technical and organizational measures is available on request at hello@docdex.ai; certain sensitive materials (for example, penetration test reports) are made available under NDA given their sensitivity, but a general security overview is not gated in this way.
docdex’s infrastructure is hosted in the EU. Where any sub-processor or service provider is located outside the European Economic Area, we rely on an appropriate transfer mechanism recognized under GDPR (such as the European Commission’s Standard Contractual Clauses) before personal data is transferred there.
In connection with the Google Ads remarketing and conversion tracking described in Section 4.7, personal data (cookie and device-based identifiers) is transferred to Google, a U.S.-headquartered independent controller (Section 9). Docktape Technologies relies on Standard Contractual Clauses and/or any other adequacy or certification mechanism Google itself currently maintains for this transfer, consistent with Art. 46 GDPR.
We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law or the applicable DPA:
Specific retention periods are documented in the applicable DPA or available on request.
We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, or disclosure, appropriate to the risk, including encryption in transit and at rest, access controls, and the permission-enforcement architecture described throughout this policy. No system is completely secure, and we cannot guarantee absolute security.
Subject to applicable law and any applicable exemptions, you have the right to:
To exercise these rights, contact hello@docdex.ai. If your data was provided to docdex by your employer or another organization as part of their use of the Service (Sections 4.2-4.4), we may direct your request to that organization, as they are the controller for that data and best placed to respond, while we provide reasonable assistance under the applicable DPA.
Docktape Technologies has not appointed a Data Protection Officer (DPO). We do not currently believe our core activities require one under Article 37 GDPR: our core activities do not consist of processing that requires regular and systematic monitoring of data subjects on a large scale, nor large-scale processing of special categories of data. We recognize that, as a processor, docdex processes Customer documents at meaningful scale, and we assess the Art. 37 triggers on an ongoing basis as our Customer base and tenant volumes grow - this is not a permanent conclusion, and we will appoint a DPO and update this policy if our assessment changes.
In the meantime, all privacy-related inquiries, including any that would ordinarily go to a DPO, can be directed to hello@docdex.ai.
In the event of a personal data breach, Docktape Technologies will assess the risk to affected individuals and notify the competent supervisory authority without undue delay, and in any event within 72 hours of becoming aware of the breach, where required by Art. 33 GDPR. Where a breach is likely to result in a high risk to individuals, we will also notify affected individuals directly without undue delay, as required by Art. 34 GDPR. Where a breach affects data we process as a processor on behalf of a Customer, we will notify the affected Customer without undue delay under the terms of the applicable DPA, so that the Customer, as controller, can meet its own notification obligations.
docdex is a B2B product intended for use by business personnel and is not directed to, and does not knowingly collect personal data from, children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete it.
If you believe your data protection rights have been violated, you may lodge a complaint with your local data protection supervisory authority, or with:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Hungarian National Authority for Data Protection and Freedom of Information
1055 Budapest, Falk Miksa utca 9-11.
Website: naih.hu
We would also welcome the opportunity to address your concerns directly before you contact a supervisory authority - please reach out to hello@docdex.ai first if you’re comfortable doing so.
We may update this policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the updated policy with a revised effective date, and, where changes are material, provide additional notice as appropriate.
Questions about this policy or our data practices can be directed to:
Docktape Technologies
hello@docdex.ai