Cacao Docs Privacy Policy

IMPORTANT PRIVACY INFORMATION

When you access our website we automatically collect from your device cookies, language settings, time zone, type and model of a device, device settings, operating system, Internet service provider, mobile carrier, device identifiers, other unique identifiers (such as IDFA and AAID) and information about your interactions with the website. We need this data to provide our services, analyze how our customers use the website and to measure ads.

For providing services, improving the website and serving ads, we use third-party solutions. As a result, we may process data using solutions developed by Google, Stripe, Hotjar, and other service providers. Therefore, some of the data is stored and processed on the servers of such third parties. This enables us to (1) provide certain services (edit, convert, and otherwise process your PDF documents); (2) analyze different interactions (how often users make purchases, what products our users viewed); (3) serve and measure ads (and show them only to a particular group of users, for example, only to those who have made a purchase).

The content of files you upload to Cacao Docs is processed solely to perform the action you request (such as editing or converting) and is never used for marketing, user profiling, or training artificial-intelligence models. Uploaded files are automatically deleted from our primary servers within 24 hours of upload completion and permanently purged from all systems, including disaster-recovery backups, within 48 hours of upload completion. The retention period begins when your file upload finishes, not when processing completes.

Please read our Privacy Policy below to know more about what we do with data (Section 3), the legal bases we rely on (Section 4), what data privacy rights are available to you (Section 6), and who will be the data controller (Section 1). If any questions remain unanswered, please contact us at support@cacaodocs.com.

1. PERSONAL DATA CONTROLLER

Cacao Docs is the controller of your personal data. Our contact email is support@cacaodocs.com.

2. CATEGORIES OF PERSONAL DATA WE COLLECT

We collect data you give us voluntarily (for example, email address and financial data). We also collect data automatically (for example, cookies and technical information about your device).

2.1. Data you give us

If you decide to create an account on the Service, we will ask you to provide an email address, which will be used to create your profile and send payment-related communications. You may also provide us with your email when you contact our support team or if you wish to receive marketing communications. Other personal data may be contained in the documents you upload to the Website if such documents include personal data. We do not access or review the contents of your uploaded documents for any purpose other than performing the processing action you request.

2.2. Data we collect automatically

We collect data about your referring app or URL (that is, the app or place on the Web where you were when you tapped or clicked on our ad).

We collect data from your device. Examples of such data include: language settings, IP address, time zone, type and model of a device, device settings, operating system, Internet service provider, mobile carrier, and device identifiers.

We record how you interact with our Service. For example, we log what pages you have viewed, the features and content you interact with, how often you use the Website, how long you are on the Website, and your purchases.

Our service providers may collect your Apple Identifier for Advertising ("IDFA"), Identifier for Vendor ("IDFV"), or Google Advertising ID ("AAID") (depending on the operating system of your device) when you access our Website from a mobile device.

When you make payments through the Service, you need to provide financial account data, such as your credit card number, to our third-party service providers. We do not collect or store full credit card number data, though we may receive credit-card-related data and data about the transaction, including: date, time, and amount of the transaction and the type of payment method used.

3. FOR WHAT PURPOSES WE PROCESS YOUR PERSONAL DATA

We process your personal data for the following purposes. For each purpose, the corresponding legal basis (as detailed in Section 4) is indicated:

To provide our Service (including processing, editing, and converting your uploaded documents) — Legal basis: performance of our contract with you (see Section 4.1).
To provide you with customer support — Legal basis: performance of our contract with you and our legitimate interest in maintaining service quality (see Sections 4.1 and 4.2).
To communicate with you regarding your use of our Service — Legal basis: performance of our contract with you (see Section 4.1).
To research and analyze your use of the Service in order to improve it — Legal basis: our legitimate interest in understanding how the Service is used and enhancing user experience (see Section 4.2).
To process your payments — Legal basis: performance of our contract with you and compliance with applicable financial and tax regulations (see Sections 4.1 and 4.3).
To serve and measure advertisements — Legal basis: our legitimate interest in sustaining a commercially viable service (see Section 4.2) and, where required by applicable law, your consent.

For the avoidance of doubt, the content of documents you upload is processed exclusively to carry out the specific action you request (e.g., editing, converting, or compressing a PDF). We do not use uploaded document content for marketing purposes, behavioural profiling, advertisement targeting, or the training of any machine-learning or artificial-intelligence model. Where document processing involves third-party APIs (for example, translation or optical-character-recognition services), each such provider operates under a zero-retention data-processing agreement that contractually prohibits the provider from storing, logging, or using your document content beyond the immediate processing request, thereby ensuring our deletion commitment (24 hours on primary servers, 48 hours maximum including disaster-recovery backups, both measured from upload completion) applies across the entire processing chain.

4. UNDER WHAT LEGAL BASES WE PROCESS YOUR PERSONAL DATA

We process your personal data under the following legal bases:

4.1. Performance of contract — We process personal data where it is necessary to perform our contract with you, including providing the core Service (document processing), managing your account, handling payments, and delivering customer support.
4.2. Legitimate interests — We process personal data for our (or others') legitimate interests, provided such interests are not overridden by your fundamental rights and freedoms. These interests include: improving and optimizing the Service, conducting analytics and research, serving relevant advertisements, and preventing fraud or misuse.
4.3. Legal obligations — We process personal data where necessary to comply with applicable legal obligations, such as financial record-keeping, tax reporting, and responding to lawful requests from public authorities.
4.4. Consent — In certain cases (for example, marketing emails or non-essential cookies, where required by applicable law), we process personal data on the basis of your freely given consent, which you may withdraw at any time.

5. WITH WHOM WE SHARE YOUR PERSONAL DATA

We share information with third parties that help us operate, provide, improve, integrate, customise, support, and market our Service. We may share certain categories of personal data — in particular, for the purposes and with the parties indicated in Section 3 of this Privacy Policy. These third parties include cloud-hosting and infrastructure providers, payment processors, analytics services, and advertising partners. All third-party recipients are contractually obligated to process your personal data only for the purposes specified and in accordance with applicable data-protection law. A complete and up-to-date list of our sub-processors is available at /sub-processors.

6. HOW YOU CAN EXERCISE YOUR PRIVACY RIGHTS

To remain in control of your personal data, you have the following rights:

Accessing, reviewing, updating, or correcting your personal data.
Deleting your personal data ("right to erasure").
Objecting to, or requesting restriction of, the processing of your personal data.
Data portability — You have the right to receive a copy of the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance from us, where technically feasible.
Withdrawing consent — Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the rights listed above, please contact us at support@cacaodocs.com. We will respond to your request within the timeframe required by applicable law.

7. AGE LIMITATION

Our Service is not intended for, and may not be used by, individuals under 16 years of age. If you are under 16, you may not create an account or use the Service.

Users between 16 and 18 years of age (or the age of majority in their jurisdiction, if higher) may use the Service only with the permission and direct supervision of a parent or legal guardian. The parent or guardian must read and agree to these Terms on behalf of the minor and is responsible for the minor's use of the Service.

We do not knowingly collect personal data from anyone under 16. If we learn that we have collected personal data from a person under 16 without verified parental consent, we will delete that information as quickly as possible. Parents who believe we may have information from a child under 16 should contact us immediately at support@cacaodocs.com.

8. INTERNATIONAL DATA TRANSFERS

We may transfer personal data to countries other than the country in which the data was originally collected in order to provide the Service set forth in the Terms and Conditions of Use and for the purposes indicated in this Privacy Policy. Where personal data originating in the European Economic Area (EEA), the United Kingdom, or Switzerland is transferred to a country that has not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, supplementary measures, to ensure that such transfers comply with applicable data-protection legislation. You may request a copy of the applicable SCCs by contacting us at support@cacaodocs.com.

9. CHANGES TO THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time. If we decide to make material changes to this Privacy Policy, you will be notified by available means (such as email or a prominent notice on the Website) and will have an opportunity to review the revised Privacy Policy before it takes effect.

10. CALIFORNIA PRIVACY RIGHTS

This section applies to California residents and supplements the rest of this Privacy Policy with disclosures required under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA").

Right to Know — You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purposes for collecting it, and the categories of third parties with whom we share it.

Right to Delete — You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions permitted by the CCPA (for example, where retention is necessary to complete a transaction or comply with a legal obligation).

Right to Correct — You have the right to request that we correct inaccurate personal information that we maintain about you.

No Sale or Sharing of Personal Information — Cacao Docs does not "sell" or "share" (as those terms are defined under the CCPA) your personal information, and has not done so in the preceding twelve (12) months.

Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights.

California's Shine the Light law additionally gives California residents the right to request, once per calendar year, information about the personal data shared with third parties for their direct marketing purposes. To exercise any of the rights described in this section, please contact us at support@cacaodocs.com.

11. DATA RETENTION

We will store your personal data for as long as it is reasonably necessary for achieving the purposes set forth in this Privacy Policy, including providing the Service to you, complying with our legal obligations, and enforcing our Terms of Use and other agreements.

Uploaded files: Documents you upload for processing are retained on our servers only for the duration necessary to complete your requested action and are automatically deleted from primary servers within 24 hours of upload completion. All copies, including disaster-recovery backups, are permanently destroyed within 48 hours of upload completion.

Account data: If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law (for example, for tax or financial record-keeping purposes).

File deletion process: Files are permanently deleted using secure deletion methods that prevent recovery. Backups created for disaster recovery purposes follow a separate deletion cycle. While files are removed from primary servers within 24 hours of upload completion, file fragments may persist in disaster-recovery backup systems for up to 48 hours from upload completion, at which point all copies are irrevocably destroyed. Under no circumstances will we restore files from backups for any reason after the 24-hour primary retention period expires.

12. HOW "DO NOT TRACK" REQUESTS ARE HANDLED

Except as otherwise stipulated in this Privacy Policy, this Website does not support "Do Not Track" requests. Where we detect a Global Privacy Control (GPC) signal from your browser, we will treat it as a valid opt-out of the sale or sharing of personal data to the extent required by applicable law.

13. CONTACT US

You may contact us at any time for details regarding this Privacy Policy and its previous versions. For any questions concerning your account or your personal data, please contact us at support@cacaodocs.com.

Effective as of: February 16, 2026