Privacy Notice

Who we are

DocShark is run by ALBEDO OLEKSANDR BUTENKO, a sole proprietorship registered in Poland (NIP 7393989996). Full details are in our Imprint. We are the controller of the personal data described in this notice.

For anything about your data, write to privacy@docshark.io. We have not appointed a data protection officer, as we are not required to.

What this notice covers

This notice covers docshark.io during pre-launch: the marketing pages and the waitlist. There are no accounts, no document uploads and no payments yet. Before any of those become available, we will publish a new version of this notice.

In short

• We collect your email address only if you join the waitlist, and we use it only to tell you about getting access to DocShark.
• We count visits to our website with Plausible, an analytics service based in the EU. It sets no cookies, does not recognise you on another day and does not follow you across other websites. We use no advertising.
• Our website, database, email delivery and visit statistics run in the EU. The one exception is the bot check on the waitlist form, run by Cloudflare, a US company. It is explained below.
• You can leave the waitlist at any time. When you do, we delete your entry. A copy can remain in our database backups for up to 14 days.

The waitlist

What we store

• your email address;
• whether you asked to be invited to the beta;
• a record of your consent: when you gave it, the IP address the form was submitted from, and which version of this notice you agreed to;
• when we sent your welcome email, and when your entry was created and last changed;
• a hashed form of the removal token from your welcome email. The removal link itself exists only in that email.

Giving us your email address is voluntary, but without it you cannot join the waitlist.

Why, and on what legal basis

We use your email address to tell you when you can get access to DocShark — for example, an invitation to a beta or the public launch. We send nothing else, such as newsletters or product news. We send beta invitations only to people who ticked the box asking to be invited to the beta; everyone else hears from us only about the public launch. Right after you sign up, we also send you one email confirming that you are on the list, with a link to remove yourself. The legal basis is your consent (Art. 6(1)(a) GDPR).

We keep the consent record so that we can show you agreed, as Art. 7(1) GDPR requires. The legal basis is our legitimate interest in being able to demonstrate consent (Art. 6(1)(f) GDPR).

How long we keep it

Until you leave the waitlist, ask us to delete your entry, or we close the waitlist, whichever comes first. Deletion is permanent and includes the consent record.

We back up our database every night and keep each backup for 14 days. After your entry is deleted, a copy of it can remain in those backups for up to 14 days. After that, it is gone from them too.

Leaving the waitlist

Use the link in your welcome email. It opens a page where you confirm, and your entry is deleted straight away. You can also write to privacy@docshark.io and we will delete it for you. A copy can remain in our nightly database backups for up to 14 days, and is then gone.

If many sign-ups arrive at once, we hold outgoing email and send it later, so your welcome email and the removal link in it may arrive late. You are on the list in the meantime. If you want to be removed before it arrives, write to privacy@docshark.io.

Who sees it

Lettermint delivers our email, so it processes your address and the content of the welcome email, including the removal link. If a delivery attempt fails, the queued email is kept on our server for up to 7 days and then deleted.

Bot protection on the waitlist form

We use Cloudflare Turnstile to keep automated sign-ups off the waitlist. It is not loaded when you open a page. It loads only once you start interacting with the waitlist form.

When it runs, your browser connects to Cloudflare directly. Turnstile evaluates signals from your browser and connection to tell people from bots. According to Cloudflare, these include your IP address, TLS fingerprint, User-Agent and the website being protected. When you submit the form, our server sends Cloudflare the resulting token together with your IP address to confirm the check. We do not store the signals or the result.

Cloudflare processes these signals on our behalf to run the check. Cloudflare also states that it uses them, as a controller in its own right, to improve Turnstile's bot detection, based on its own legitimate interest. That use is covered by Cloudflare's Turnstile Privacy Addendum, not by this notice.

Our legal basis is our legitimate interest in protecting the waitlist from automated abuse, including people being signed up without their knowledge (Art. 6(1)(f) GDPR).

Cloudflare, Inc. is based in the United States, so this involves a transfer of personal data outside the EU. The transfer relies on the EU–US Data Privacy Framework, under which Cloudflare is certified, and on the Standard Contractual Clauses in Cloudflare's data processing addendum.

When you visit the website

Server logs

Our web server records each request: your IP address, the time, the page requested, the response status and your browser's User-Agent. We use these logs to run the site and to investigate faults and attacks. We delete them after 14 days. Requests to the page where you remove yourself from the waitlist are not written to this log, because their address contains your removal token. The legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

Visit statistics

We use Plausible Analytics to understand how many people visit our website, which pages they read and which links brought them here. Plausible Insights OÜ, Estonia, provides the service on our behalf as our processor.

When you open one of our pages, your browser loads a small script from our own domain and reports the visit back to our own domain. Our server passes the report on to Plausible. Your browser does not connect to Plausible directly. A report contains:

• the address of the page you opened. Query parameters are discarded, except the campaign and referral tags Plausible supports, such as the ?ref=linkedin in a link we posted;
• the website that linked to us, if your browser shares it;
• your browser, operating system and type of device;
• how far you scrolled down the page and how long you spent on it, which the script measures automatically;
• your IP address and User-Agent.

Plausible uses your IP address to look up your country, region and city. It never stores your IP address or User-Agent.

Plausible stores each page visit and event as an individual record, grouped into visits by a daily identifier. That identifier is a hash of your IP address, your User-Agent, our domain and a random value that is replaced and deleted every 24 hours. It cannot link your visits across different days, devices or websites.

When you join the waitlist, we also record that a sign-up happened. We do not send your email address or anything else you typed.

We look only at aggregated statistics in Plausible's dashboard. We do not collect statistics on the page where you remove yourself from the waitlist. The records are kept for up to 3 years, and are deleted when we stop using Plausible.

The legal basis is our legitimate interest in understanding how people find and use our website (Art. 6(1)(f) GDPR).

Application logs

Our application records errors. These logs do not normally contain personal data, but an error that occurs while a sign-up is being processed can include the data involved, such as an email address. They are deleted after 14 days. The legal basis is the same as above.

Rate limiting

To slow down repeated requests, we keep a hashed form of your IP address in temporary memory for at most one hour. The legal basis is the same as above.

Cookies

We set two cookies. Both are our own and both are strictly necessary:

• docshark-session keeps your visit together so that forms work. It expires 120 minutes after your last request.
• XSRF-TOKEN protects forms against cross-site request forgery. It has the same lifetime.

The session data we keep on our server does not include your IP address or User-Agent.

We use no analytics, advertising or tracking cookies. Our visit statistics work without cookies and store nothing on your device. That is why there is no cookie banner: strictly necessary cookies do not need consent under the ePrivacy rules.

If you interact with the waitlist form, Turnstile runs in a frame served from Cloudflare's own domain. By default it issues a one-time token rather than a cookie. Cloudflare's documentation lists challenge cookies that it may set on its own domain for internal diagnostics (cf_chl_rc_i, cf_chl_rc_ni, cf_chl_rc_m). We do not enable Turnstile's pre-clearance option, which is what issues the cf_clearance cookie. Anything Cloudflare stores is set by Cloudflare on its own domain, and we cannot read it. We consider Turnstile strictly necessary for the sign-up you asked for, and it runs only once you start using the form.

Emailing us

Our addresses (privacy@, hello@ and support@docshark.io) are hosted by Proton AG in Switzerland. The European Commission recognises Switzerland as providing adequate data protection. We use what you write only to deal with your message, based on our legitimate interest in answering it (Art. 6(1)(f) GDPR). We delete it 12 months after the matter is closed.

Service providers

• Hetzner Online GmbH, Germany — hosts our website, database, logs and backups.
• Lettermint B.V., Netherlands — sends our email.
• Plausible Insights OÜ, Estonia — provides our visit statistics and stores them in the EU.
• Cloudflare, Inc., United States — runs Turnstile on the waitlist form and the DNS for our domain. DNS lookups are usually made by your internet provider rather than by your device, and your page visits do not pass through Cloudflare.
• Proton AG, Switzerland — receives email sent to us.

We do not sell personal data or share it for advertising. We do not use it for profiling or automated decisions.

Your rights

You have the right to access your data, have it corrected or deleted, restrict its use, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Withdrawing does not affect what we did before.

Right to object: where we rely on legitimate interest, you can object at any time on grounds relating to your particular situation.

To use any of these rights, write to privacy@docshark.io. We answer within one month. We may ask you to confirm the request from the email address concerned.

You can also complain to a supervisory authority. In Poland, that is the President of the Personal Data Protection Office (UODO). You can also complain to the authority where you live or work.

Security

Traffic to the site is encrypted with HTTPS. Access to our servers is restricted to us. Removal tokens are stored only in hashed form.

Children

DocShark is a service for businesses and is not aimed at children. You must be at least 16 to join the waitlist, and we do not knowingly collect data from anyone younger. We do not verify ages. If you believe someone under 16 has joined, write to privacy@docshark.io and we will delete the entry.

Changes to this notice

Your waitlist entry records the version of this notice you agreed to. We keep every version, and you can ask for a copy of any of them at privacy@docshark.io. If we change how we use your data in a way that needs your consent, we will ask for it again.