Privacy Policy

Last updated: February 16, 2026

This privacy policy is GDPR compliant and explains how we collect, use, and protect your personal data.

1. Data Controller

Cloonar Technologies GmbH
Address: Vienna, Austria
Email: legal@docfast.dev
Data Protection Contact: privacy@docfast.dev

2. Data We Collect

2.1 Account Information

Email address - Required for account creation and API key delivery
API key - Automatically generated unique identifier

2.2 API Usage Data

Request logs - API endpoint accessed, timestamp, response status
Usage metrics - Number of API calls, data volume processed
IP address - For rate limiting and abuse prevention

2.3 Payment Information

Stripe Customer ID - For Pro subscription billing
Payment metadata - Subscription status, billing period

      No PDF content stored: We process your HTML/Markdown input to generate PDFs, but do not store the content or resulting PDFs on our servers.
    

3. Legal Basis for Processing

Contract fulfillment (Art. 6(1)(b) GDPR) - Account creation, API service provision
Legitimate interest (Art. 6(1)(f) GDPR) - Service monitoring, abuse prevention, performance optimization
Legal obligation (Art. 6(1)(c) GDPR) - Tax records, payment processing compliance

4. Data Retention

Account data: Retained while account is active + 30 days after deletion request
API usage logs: 90 days for operational monitoring
Payment records: 7 years for tax compliance (Austrian law)
PDF processing data: Not stored (processed in memory only)

5. Third-Party Processors

5.1 Stripe (Payment Processing)

Purpose: Payment processing for Pro subscriptions
Data: Email, payment information
Location: EU (GDPR compliant)
Privacy Policy: https://stripe.com/privacy

5.2 Hetzner (Hosting)

Purpose: Server hosting and infrastructure
Data: All data processed by DocFast
Location: Germany (Nuremberg)
Privacy Policy: https://www.hetzner.com/legal/privacy-policy

      EU Data Residency: All your data is processed and stored exclusively within the European Union.
    

6. Your Rights Under GDPR

Right of access - Request information about your personal data
Right to rectification - Correct inaccurate data (e.g., email changes)
Right to erasure - Delete your account and associated data
Right to data portability - Receive your data in machine-readable format
Right to object - Object to processing based on legitimate interest
Right to lodge a complaint - Contact your data protection authority

To exercise your rights: Email privacy@docfast.dev

7. Cookies and Tracking

DocFast uses minimal technical cookies:

Session cookies - For login state (if applicable)
No tracking cookies - We do not use analytics, advertising, or third-party tracking

8. Data Security

Encryption: All data transmission via HTTPS/TLS
Access control: Limited employee access with logging
Infrastructure: EU-based servers with enterprise security
API keys: Securely hashed and stored

9. International Transfers

Your personal data does not leave the European Union. Our infrastructure is hosted exclusively by Hetzner in Germany.

10. Contact for Data Protection

For questions about data processing or to exercise your rights:

Email: privacy@docfast.dev
Subject: Include "GDPR" in the subject line for priority handling

11. Changes to This Policy

We will notify users of material changes via email. Continued use of the service constitutes acceptance of updated terms.