Privacy Policy

The Data Controller is:

Docply is a commercial brand operated by the same Data Controller.

No Data Protection Officer (DPO) has been appointed, as the processing carried out does not meet the criteria of Article 37 GDPR. The Data Controller is directly reachable for any data protection matter at the addresses above.

Some of the third-party providers listed above are based in the United States or process data in the United States.

For all such transfers, we rely on:

• EU-US Data Privacy Framework, where the recipient is certified;
• Standard Contractual Clauses (SCC) approved by the European Commission, where the EU-US Data Privacy Framework is not applicable;
• Additional supplementary measures as appropriate (encryption in transit and at rest, access controls).

Users may request a copy of the safeguards applied by contacting us at info@docply.io.

We retain personal data for the following periods:

• Order data and invoices (name, email, billing address, VAT, order details): 10 years from the date of the transaction, in accordance with Italian tax law (Article 2220 of the Italian Civil Code and Presidential Decree 600/1973).
• Download tokens (Upstash): automatically deleted 7 days after issue.
• Email communications (correspondence with info@docply.io): 2 years from the date of the last interaction, unless a longer retention is required for an active matter (e.g. ongoing customer support, dispute, license verification).
• Aggregated analytics data (Plausible): retained indefinitely in anonymous, aggregated form only. No individual User can be identified from this data.
• Technical logs (Vercel, Cloudflare, server-side): typically retained for short periods (30–90 days) for operational and security purposes, after which they are automatically deleted by the provider.

After the applicable retention period, personal data is deleted or anonymised in accordance with Article 5(1)(e) GDPR.

Under Articles 15–22 GDPR, you have the following rights:

• Right of access — to obtain confirmation of whether we process your personal data, and a copy of such data (Article 15)
• Right to rectification — to correct inaccurate or incomplete data (Article 16)
• Right to erasure ("right to be forgotten") — to request deletion of your data, subject to legal retention obligations (Article 17)
• Right to restriction of processing — to limit how we process your data in specific circumstances (Article 18)
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (Article 20)
• Right to object — to object to processing based on legitimate interest (Article 21)
• Right to withdraw consent — where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7)
• Right not to be subject to automated decision-making — including profiling, which we do not perform (Article 22)

To exercise any of these rights, please contact us at:

We will respond within one month from receipt of the request, in accordance with Article 12(3) GDPR. This period may be extended by two further months where necessary, taking into account the complexity and number of requests.

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement (Article 77 GDPR).

The Italian supervisory authority is:

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, or destruction, in accordance with Article 32 GDPR.

Such measures include:

• HTTPS/TLS encryption for all communications between the User and the Website;
• Encryption at rest on third-party providers' infrastructure;
• Time-limited, single-purpose download links (signed URLs) for Kit delivery;
• Access controls limited to the Data Controller and authorised processors;
• Regular review of providers' security practices;
• Use of providers certified under recognised security frameworks (e.g. SOC 2, ISO 27001) where applicable.

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

The Website and the Kits are intended for professional and business use. We do not knowingly collect personal data from children under 16 years of age (Article 8 GDPR).

If you become aware that a child has provided us with personal data, please contact us at info@docply.io and we will take steps to delete such data.

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or third-party providers.

The "Last updated" date at the top of this Privacy Policy indicates when it was last revised. Material changes will be communicated to existing customers by email and through a prominent notice on the Website.

We encourage Users to review this Privacy Policy periodically.