<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Privacy Policy — DocFast</title>
<meta name="description" content="Privacy policy for DocFast API service - GDPR compliant data protection information.">
<meta property="og:title" content="Privacy Policy — DocFast">
<meta property="og:description" content="Privacy policy for DocFast API service - GDPR compliant data protection information.">
<meta property="og:url" content="https://docfast.dev/privacy">
<link rel="canonical" href="https://docfast.dev/privacy">
<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>⚡</text></svg>">
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet">
<style>
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
:root {
  --bg: #0b0d11; --bg2: #12151c; --fg: #e4e7ed; --muted: #7a8194;
  --accent: #34d399; --accent-hover: #5eead4; --accent-glow: rgba(52,211,153,0.12);
  --card: #151922; --border: #1e2433;
  --radius: 12px; --radius-lg: 16px;
}
body { font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--fg); line-height: 1.65; -webkit-font-smoothing: antialiased; }
a { color: var(--accent); text-decoration: none; transition: color 0.2s; }
a:hover { color: var(--accent-hover); }
.container { max-width: 800px; margin: 0 auto; padding: 0 24px; }
nav { padding: 20px 0; border-bottom: 1px solid var(--border); }
nav .container { display: flex; align-items: center; justify-content: space-between; }
.logo { font-size: 1.25rem; font-weight: 700; letter-spacing: -0.5px; color: var(--fg); display: flex; align-items: center; gap: 8px; text-decoration: none; }
.logo span { color: var(--accent); }
.nav-links { display: flex; gap: 28px; align-items: center; }
.nav-links a { color: var(--muted); font-size: 0.9rem; font-weight: 500; }
.nav-links a:hover { color: var(--fg); }
.content { padding: 60px 0; min-height: 60vh; }
.content h1 { font-size: 2rem; font-weight: 800; margin-bottom: 32px; letter-spacing: -1px; }
.content h2 { font-size: 1.3rem; font-weight: 700; margin: 32px 0 16px; color: var(--fg); }
.content h3 { font-size: 1.1rem; font-weight: 600; margin: 24px 0 12px; color: var(--fg); }
.content p, .content li { color: var(--muted); margin-bottom: 12px; }
.content ul, .content ol { padding-left: 24px; }
.content strong { color: var(--fg); }
footer { padding: 32px 0; border-top: 1px solid var(--border); margin-top: 60px; }
footer .container { display: flex; justify-content: space-between; align-items: center; flex-wrap: wrap; gap: 16px; }
.footer-left { color: var(--muted); font-size: 0.85rem; }
.footer-links { display: flex; gap: 20px; flex-wrap: wrap; }
.footer-links a { color: var(--muted); font-size: 0.85rem; }
.footer-links a:hover { color: var(--fg); }
@media (max-width: 768px) {
  footer .container { flex-direction: column; text-align: center; }
  .nav-links { gap: 16px; }
}
/* Skip to content */
.skip-link { position: absolute; top: -100%; left: 16px; background: var(--accent); color: #0b0d11; padding: 8px 16px; border-radius: 0 0 8px 8px; font-weight: 600; font-size: 0.9rem; z-index: 200; transition: top 0.2s; }
.skip-link:focus { top: 0; }
</style>
</head>
<body>
<a href="#main" class="skip-link">Skip to content</a>

{{> nav}}

<main id="main">
  <div class="container">
    <h1>Privacy Policy</h1>
    <p><em>Last updated: February 16, 2026</em></p>

    <div class="info">
      This privacy policy is GDPR compliant and explains how we collect, use, and protect your personal data.
    </div>

    <h2>1. Data Controller</h2>
    <p><strong>Cloonar Technologies GmbH</strong><br>
    Address: Vienna, Austria<br>
    Email: <a href="mailto:legal@docfast.dev">legal@docfast.dev</a><br>
    Data Protection Contact: <a href="mailto:privacy@docfast.dev">privacy@docfast.dev</a></p>

    <h2>2. Data We Collect</h2>
    
    <h3>2.1 Account Information</h3>
    <ul>
      <li><strong>Email address</strong> - Required for account creation and API key delivery</li>
      <li><strong>API key</strong> - Automatically generated unique identifier</li>
    </ul>

    <h3>2.2 API Usage Data</h3>
    <ul>
      <li><strong>Request logs</strong> - API endpoint accessed, timestamp, response status</li>
      <li><strong>Usage metrics</strong> - Number of API calls, data volume processed</li>
      <li><strong>IP address</strong> - For rate limiting and abuse prevention</li>
    </ul>

    <h3>2.3 Payment Information</h3>
    <ul>
      <li><strong>Stripe Customer ID</strong> - For Pro subscription billing</li>
      <li><strong>Payment metadata</strong> - Subscription status, billing period</li>
    </ul>

    <div class="highlight">
      <strong>No PDF content stored:</strong> We process your HTML/Markdown input to generate PDFs, but do not store the content or resulting PDFs on our servers.
    </div>

    <h2>3. Legal Basis for Processing</h2>
    <ul>
      <li><strong>Contract fulfillment</strong> (Art. 6(1)(b) GDPR) - Account creation, API service provision</li>
      <li><strong>Legitimate interest</strong> (Art. 6(1)(f) GDPR) - Service monitoring, abuse prevention, performance optimization</li>
      <li><strong>Legal obligation</strong> (Art. 6(1)(c) GDPR) - Tax records, payment processing compliance</li>
    </ul>

    <h2>4. Data Retention</h2>
    <ul>
      <li><strong>Account data:</strong> Retained while account is active + 30 days after deletion request</li>
      <li><strong>API usage logs:</strong> 90 days for operational monitoring</li>
      <li><strong>Payment records:</strong> 7 years for tax compliance (Austrian law)</li>
      <li><strong>PDF processing data:</strong> Not stored (processed in memory only)</li>
    </ul>

    <h2>5. Third-Party Processors</h2>
    
    <h3>5.1 Stripe (Payment Processing)</h3>
    <p><strong>Purpose:</strong> Payment processing for Pro subscriptions<br>
    <strong>Data:</strong> Email, payment information<br>
    <strong>Location:</strong> EU (GDPR compliant)<br>
    <strong>Privacy Policy:</strong> <a href="https://stripe.com/privacy" target="_blank" rel="noopener">https://stripe.com/privacy</a></p>

    <h3>5.2 Hetzner (Hosting)</h3>
    <p><strong>Purpose:</strong> Server hosting and infrastructure<br>
    <strong>Data:</strong> All data processed by DocFast<br>
    <strong>Location:</strong> Germany (Nuremberg)<br>
    <strong>Privacy Policy:</strong> <a href="https://www.hetzner.com/legal/privacy-policy" target="_blank" rel="noopener">https://www.hetzner.com/legal/privacy-policy</a></p>

    <div class="highlight">
      <strong>EU Data Residency:</strong> All your data is processed and stored exclusively within the European Union.
    </div>

    <h2>6. Your Rights Under GDPR</h2>
    <ul>
      <li><strong>Right of access</strong> - Request information about your personal data</li>
      <li><strong>Right to rectification</strong> - Correct inaccurate data (e.g., email changes)</li>
      <li><strong>Right to erasure</strong> - Delete your account and associated data</li>
      <li><strong>Right to data portability</strong> - Receive your data in machine-readable format</li>
      <li><strong>Right to object</strong> - Object to processing based on legitimate interest</li>
      <li><strong>Right to lodge a complaint</strong> - Contact your data protection authority</li>
    </ul>

    <p><strong>To exercise your rights:</strong> Email <a href="mailto:privacy@docfast.dev">privacy@docfast.dev</a></p>

    <h2>7. Cookies and Tracking</h2>
    <p>DocFast uses minimal technical cookies:</p>
    <ul>
      <li><strong>Session cookies</strong> - For login state (if applicable)</li>
      <li><strong>No tracking cookies</strong> - We do not use analytics, advertising, or third-party tracking</li>
    </ul>

    <h2>8. Data Security</h2>
    <ul>
      <li><strong>Encryption:</strong> All data transmission via HTTPS/TLS</li>
      <li><strong>Access control:</strong> Limited employee access with logging</li>
      <li><strong>Infrastructure:</strong> EU-based servers with enterprise security</li>
      <li><strong>API keys:</strong> Securely hashed and stored</li>
    </ul>

    <h2>9. International Transfers</h2>
    <p>Your personal data does not leave the European Union. Our infrastructure is hosted exclusively by Hetzner in Germany.</p>

    <h2>10. Contact for Data Protection</h2>
    <p>For questions about data processing or to exercise your rights:</p>
    <p><strong>Email:</strong> <a href="mailto:privacy@docfast.dev">privacy@docfast.dev</a><br>
    <strong>Subject:</strong> Include "GDPR" in the subject line for priority handling</p>

    <h2>11. Changes to This Policy</h2>
    <p>We will notify users of material changes via email. Continued use of the service constitutes acceptance of updated terms.</p>
  </div>
</main>

{{> footer}}

</body>
</html>
