DocuCommit
Legal · 01

Privacy policy

Last updated: 2026-06-22

1. Who we are

The data controller for docucommit.se and demo.docucommit.se (together, the Service) is:

Ali Zreim
Malmö, Sweden
Email: kontakt@docucommit.se

References to "we", "us" or "our" in this policy mean the entity above. References to "you" mean any visitor to the Service.

2. What data we collect

2.1 Marketing site (docucommit.se)

The marketing site is a static website. It sets a single strictly-necessary cookie to remember your cookie choice, and loads Google Analytics only if you opt in via the consent banner. It uses no tracking pixels, fingerprinting, or other third-party scripts. See our cookie policy for the full list and how to change your choice. When you visit, our hosting provider (One.com Group AB) processes standard HTTP request data (IP address, user agent, requested URL, and timestamp) in server logs for the purpose of operating and securing the site.

2.2 Contact email

When you email kontakt@docucommit.se, we receive and store the contents of your message, your email address, and any other information you choose to share. We use this only to respond to you and to keep a record of the correspondence.

2.3 Live demo (demo.docucommit.se)

The demo is a public, read-only browse of a sample DocuCommit library. Account registration and login are disabled. It does not set cookies, no session cookie, no analytics, no advertising or tracking cookies of any kind.

When you visit, our demo hosting provider (Railway Corp., serving from europe-west4, Netherlands) processes standard HTTP request data (IP address, user agent, requested URL, and timestamp) in server logs for the purpose of operating and securing the demo.

2.4 DocuCommit software (desktop editor and self-hosted server)

The DocuCommit desktop editor and the self-hosted server run on infrastructure you control. Document content, filenames, drafts, and usage analytics never leave your machine. The only data that crosses the network is the licensing call: each install performs a license check on launch and a heartbeat against our licensing backend.

The licensing backend processes the following fields:

  • Activation ID: a UUID identifying your seat.
  • Hardware fingerprint: a SHA-256 hash derived from stable machine identifiers. We deliberately exclude MAC address, IP address, hostname, and any plaintext machine label from the inputs.
  • Operating system and version.
  • DocuCommit app version.
  • IP address: HMAC-hashed before storage. We do not store the raw IP.

If the software cannot reach the licensing backend, it continues to work offline for up to 30 days before requiring a successful check.

2.5 Purchases and free trials

When you start a free trial or buy a subscription, we process the email address you provide and your subscription details (tier, status, billing period). Payments are handled by our payment processor, Stripe; your full card number is processed by Stripe and never reaches our systems. For free trials, we also store the hardware fingerprint described in 2.4 to enforce one trial per device. Records of your licence and subscription are kept in our licensing backend.

3. Legal basis (GDPR Article 6)

  • Legitimate interest (Art. 6(1)(f)): operating, securing, and improving the Service, and responding to messages you send us.
  • Consent (Art. 6(1)(a)): where you actively choose to share data with us, e.g. by emailing us or signing up to be notified when the product ships.
  • Contract (Art. 6(1)(b)): where data processing is necessary to provide a service you have requested: running a demo session you initiated, or providing and billing a subscription or free trial you signed up for.
  • Legal obligation (Art. 6(1)(c)): retaining billing and invoice records to meet Swedish accounting and tax law.

4. How long we keep your data

  • Server access logs: up to 90 days.
  • Licensing-backend network logs: up to 90 days.
  • Activation and heartbeat records: up to 24 months after the associated subscription ends.
  • Email correspondence: as long as needed to handle your enquiry, and afterwards for up to 24 months for our records, unless you ask us to delete it sooner.
  • Demo session data: deleted on session expiry or periodic reset.
  • Billing and invoice records: retained for 7 years to meet Swedish accounting law (Bokföringslagen).

5. Sub-processors

We share personal data with the following processors:

  • One.com Group AB (Denmark / EU): web hosting and email infrastructure for docucommit.se.
  • Railway Corp. (USA, with application data hosted in the EU, region europe-west4, Netherlands): application hosting for demo.docucommit.se. Transfers to Railway Corp. as a US-based controller are covered by Standard Contractual Clauses under GDPR Chapter V.
  • Supabase Inc. (USA, with application data hosted in the EU, region eu-north-1, Sweden): licensing backend for the DocuCommit desktop editor (activation and heartbeat). Transfers to Supabase Inc. as a US-based controller are covered by Standard Contractual Clauses under GDPR Chapter V.
  • Cloudflare, Inc. (USA, global edge network): storage and delivery of DocuCommit software release artifacts via authenticated download links; receives the client IP address incident to a download request. Transfers to Cloudflare, Inc. are covered by Standard Contractual Clauses under GDPR Chapter V.
  • Stripe Payments Europe, Ltd. (Ireland / EU, with Stripe, Inc. in the USA): payment processing and subscription billing. Card details are handled by Stripe and never reach our systems. Transfers to Stripe, Inc. are covered by Standard Contractual Clauses under GDPR Chapter V.
  • Let's Encrypt (Internet Security Research Group, USA): TLS certificate issuance. Receives the domain name but no visitor data.

We do not sell personal data. Where data is transferred outside the EU/EEA, the transfer is covered by an adequacy decision or appropriate safeguards under GDPR Chapter V.

6. Your rights

Under GDPR, you have the right to:

  • Access the personal data we hold about you (Art. 15);
  • Have inaccurate data corrected (Art. 16);
  • Have your data erased where applicable (Art. 17);
  • Restrict processing (Art. 18);
  • Receive your data in a portable format (Art. 20);
  • Object to processing based on legitimate interest (Art. 21);
  • Withdraw consent at any time, without affecting prior processing.

To exercise any of these rights, email privacy@docucommit.se. We will respond within 30 days.

If you believe we have mishandled your data, you may lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

7. Changes

We may update this policy from time to time. The "last updated" date at the top of this page indicates when it last changed. We encourage you to review it periodically.

We use a strictly-necessary cookie to run the site, and — with your permission — Google Analytics to understand how it's used. Choose what you're happy with. See our cookie policy for details.