Privacy Policy

Account information. Email address, name (and optional preferred name), hashed password, plan and billing status, and settings you configure.

Your content. Documents, notes, web pages, media, and other files you upload or sync (including via the Obsidian plugin), plus data we derive from them to power the Service: extracted text, chunks, vector embeddings, search indexes, summaries, generated audio, and knowledge-graph entries.

Chat and query content. The questions you ask, conversations you have with the AI (including via the API and MCP server), and the answers generated, so you can revisit your history and so the Service can maintain context and optional memory features you control.

Usage and billing records. Metered usage (queries, tokens, documents, TTS time, API/MCP calls), plan limits, timestamps, response times, and event logs (such as logins and document actions) kept for security auditing. Payment card details are collected and stored by Stripe, not by us.

Technical data. IP address, browser/device information, and approximate region derived from requests, used for security, rate limiting, and debugging. On the marketing site we also collect analytics events (see Section 7).

• to provide the Service: indexing your content, answering your queries, generating audio, and syncing your integrations;
• to operate accounts, subscriptions, metering, and billing;
• to secure the Service: authentication, abuse and fraud prevention, rate limiting, and audit logging;
• to support you and respond to requests;
• to understand aggregate product usage and improve the Service;
• to comply with legal obligations.

We do not sell your personal data, and we do not use your uploaded content or conversations to train our own or third-party foundation models.

Where GDPR applies, our legal bases are: performance of a contract (providing the Service you signed up for), legitimate interests (security, abuse prevention, product improvement), consent (where required, e.g. marketing-site analytics), and legal obligation (tax and accounting records).

We share data only with service providers (subprocessors) that help us run the Service, under contracts restricting their use of the data, and in the limited other cases below. Our current subprocessors:

Content you query is sent to the AI providers (Anthropic, OpenAI, Google) only as needed to answer your requests. To rank search results by relevance, we send Voyage AI only your query and the passages retrieved for it. Text you convert to audio is sent to ElevenLabs. Google receives content for the supporting steps around an answer — rewriting your query, summarizing, extracting titles and building the knowledge graph — as well as through Gemini models where you select one. If you bring your own API key (BYOK), requests using it are sent to that provider under your own agreement with them.

We may also disclose data if required by law or legal process, to protect the rights, safety, or property of users or the public, or as part of a merger, acquisition, or asset sale (in which case this policy continues to apply to the transferred data).

Our subprocessors are primarily located in the United States. Where data of EU/UK/Swiss users is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework certifications of our providers.

We protect data with measures including encryption in transit (TLS), password hashing, encrypted storage of user API keys, scoped API keys with rate limits, audit logging, and access controls. No system is perfectly secure; if we learn of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

We keep your account data and content for as long as your account is active. When you delete a document, its file, chunks, and embeddings are deleted from the live systems. When you delete your account (Section 8), your account record, documents, conversations, and derived data are deleted from the live systems promptly.

Backups.Our database host takes automated, encrypted backups of the whole database. After you delete content or your account, residual copies can remain in those backups for up to the host’s recovery window (currently 10 days) until the backups themselves age out and are replaced. We do not restore deleted data from a backup to bring it back into the live Service, except as part of recovering from an incident.

Security audit logs. We keep an audit log of security-relevant actions (for example logins, account changes, and document actions). These entries record what happened and when, not the contents of your documents. Audit entries are retained for as long as they are useful for security, fraud prevention, and legal compliance, and — because they exist to record actions including account deletions themselves — they are not deleted when you delete your account. We do not currently apply a fixed automatic expiry to them; if you want an audit entry reviewed or removed, contact us and we will assess the request against our legal obligations.

Subscription consent records. When you go through checkout for a paid plan, we record the auto-renewal consent you gave. Automatic-renewal laws require us to be able to show, later, exactly what you agreed to. A record is written when you start checkout, so one can exist for an attempt you never completed. Each record holds your account ID and the email address on the account at that moment, the plan and billing interval, the price we showed you, the exact wording of the auto-renewal disclosure you ticked (plus a version number and a checksum of that wording), the date and time, the IP address the consent came from together with the proxy chain it arrived through, your browser user-agent, and the Stripe checkout and subscription IDs. It does not contain any of your documents or content.

These records are kept even after you delete your account, because a record of what you agreed to is worth nothing as evidence if it disappears the moment the account does. Under the GDPR we rely on Article 17(3)(b) and (e) — processing necessary to comply with a legal obligation, and for the establishment or defence of legal claims — so this is one of the narrow cases where a deletion request does not reach the data. The obligation runs for three years, or one year after the subscription ends, whichever is longer. We do not currently apply an automatic expiry, so in practice these records are kept for at least that long. If you believe a consent record should be reviewed or removed, contact us and we will assess the request against our legal obligations.

Usage and billing records. Metered usage records are deleted with your account. Billing and tax records held by us or by Stripe are retained for as long as tax and accounting law requires, which is longer than your account lives.

The app (app.doquery.ai) uses only essential storage: authentication tokens and preferences needed for the Service to function. It does not use third-party advertising or analytics cookies.

This marketing site (doquery.ai) uses Google Analytics to understand how visitors find and use the site; Google Analytics sets cookies and receives your IP address and page-view events. The site also records anonymous first-party funnel events (page views, clicks, sign-up-form interactions) tied to a random identifier stored in your browser’s local storage — this identifier is not linked to your app account. You can block these cookies with your browser settings or a content blocker without affecting the app.

You can exercise the following at any time:

• Access and correction — view and edit your profile and content in-app.
• Deletion — delete individual documents and conversations in-app, or delete your entire account from the settings page (Danger Zone), which removes your account, content, and derived data as described in Section 6 and cancels any active subscription. Two narrow categories survive account deletion because we are required to keep them: security audit logs and subscription consent records. Both are described in Section 6.
• Export — request a copy of your data by emailing support@doquery.ai; we will provide it in a common machine-readable format.
• Objection and restriction — contact us to object to or restrict specific processing.

If you are in the EU, UK, or Switzerland, you have the rights of access, rectification, erasure, restriction, data portability, and objection under the GDPR (and equivalent laws), plus the right to withdraw consent at any time where processing is based on consent. We respond to verified requests within one month. You also have the right to lodge a complaint with your local supervisory authority, though we would appreciate the chance to address your concern first.

If you are a California resident, you have the right to know what personal information we collect (Section 1), to access and delete it, to correct it, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA/CPRA, and we do not use sensitive personal information other than to provide the Service. You may exercise your rights in-app or via the contact in Section 12, including through an authorized agent.

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy from time to time; material changes will be announced by email or in-app notice before they take effect, and the “Last updated” date above always reflects the current version.

Privacy questions and requests: support@doquery.ai.