DocAware Privacy Policy

DocAware is a product of OvercomeRisk, operated by KurtzLieb Technology LLC. This Privacy Policy explains how DocAware collects, uses, processes, stores, and protects information when you use our website, application, and related services.

DocAware helps users understand important documents in plain English. Users may upload contracts, leases, agreements, policies, terms, or other documents to receive summaries, possible risks, key obligations, questionable language, and recommended actions.

DocAware is not a law firm and does not provide legal advice.

1. Information We Collect

We collect only the information needed to provide, operate, improve, secure, and support DocAware.

Account Information

When you create or use an account, we may collect and store:

• Email address
• First name, if provided or required
• Account creation date and update date
• Subscription tier, such as free or pro
• Credit balance
• Whether a free document review has been used
• Redaction preference, including whether PII redaction is enabled
• Risk category preferences
• Subscription status
• Paddle customer ID and subscription ID, if you purchase a paid plan or credits
• User role, such as user or admin
• Credit transaction records, including amount, description, and timestamp

DocAware uses email-based authentication. Users enter their own email address to log in, sign up, or receive account-related messages.

Uploaded Documents

DocAware supports PDF, DOCX, and TXT files up to 10 MB.

Original uploaded files are parsed in the user's browser. The raw document file is not uploaded to DocAware backend storage, database storage, object storage, or disk.

After the document is parsed in the browser, extracted plain text is sent to the server for the purpose of generating one AI-powered document analysis. The extracted text is not stored as original document text.

Very long documents may be reviewed in part. DocAware currently limits extracted text sent for analysis to 180,000 characters. If a document is longer than the current review limit, DocAware may analyze only the first portion of the document and display a notice to the user.

Generated Analyses and Reports

DocAware saves the generated analysis report so users can view past analyses in their account.

The saved analysis may include:

• User ID
• File name
• File type
• Analysis status
• Summary
• Risks
• Obligations
• Recommended actions
• Created date and time

DocAware does not store the original document file or the original full extracted document text. The saved report contains the AI-generated structured analysis.

Users can view their own saved analyses. Database access controls are designed so users can only access their own reports through normal app access.

Administrative and Platform Access

Normal app access is limited by user-level access controls. However, authorized project owners or platform administrators with database or service-role access may technically access stored account data or generated analysis records as part of operating, maintaining, debugging, securing, or supporting the service.

Payment and Subscription Information

DocAware uses Paddle to process paid subscriptions and credit purchases.

When you purchase a subscription or document credits, payment information is entered through Paddle checkout. DocAware does not store full credit card numbers or full payment card details on its own systems.

DocAware may store limited billing-related information needed to manage access, subscriptions, credits, and support, including:

• Paddle customer ID
• Paddle subscription ID
• Product ID
• Price ID
• Subscription status
• Current billing period start and end dates
• Whether cancellation at period end is scheduled
• Payment environment, such as sandbox or live
• Credit transaction history

Paddle may collect and process payment details, billing details, tax information, receipts, invoices, and other payment-related information according to Paddle's own terms and policies.

Communications

If you contact us for support, billing, privacy, legal, or general questions, we may collect the information you provide, including your name, email address, message content, and related account information needed to respond.

Usage, Device, and Technical Information

We may collect basic technical and usage information needed to operate, secure, and improve DocAware, such as:

• Pages or features used
• Upload or analysis activity
• Browser type
• Device type
• IP address
• Session information
• Error logs
• General location inferred from IP address
• Authentication session information

DocAware uses limited first-party analytics to understand how the website is used and to improve the signup experience. These records contain an anonymous visit ID, the name of the event (for example, a page view or a button click), the page path, and campaign parameters (UTM values) from links such as ads. They do not contain your name, email address, document contents, or extracted document text. The anonymous visit ID is stored in your browser's local storage so repeat visits from the same browser can be counted once; it is not linked to your identity in these records.

DocAware uses the Meta (Facebook) Pixel to measure the effectiveness of our advertising and to understand how visitors reach DocAware from ads. The Meta Pixel is a third-party marketing analytics tool provided by Meta Platforms, Inc. It may set or read cookies and similar technologies in your browser, and may share a limited device identifier, browser information, and page activity with Meta. DocAware does not send your name, email address, document contents, or extracted document text to the Meta Pixel. Meta's use of received information is governed by Meta's own terms and privacy policy. You can learn more or manage your privacy choices at facebook.com/privacy/policy.

DocAware does not include Google Analytics, PostHog, Segment, Hotjar, or similar additional third-party marketing analytics tools. If other third-party analytics or marketing tracking tools are added later, this policy will be updated before or when those tools are enabled.

2. How We Use Information

We use information to:

• Provide DocAware's document review service
• Generate plain-English summaries and analysis outputs
• Manage user accounts and authentication
• Save and display user analysis history
• Manage credits, subscriptions, and billing status
• Process paid plans and credit purchases through Paddle
• Provide customer support
• Maintain, troubleshoot, secure, and improve the service
• Prevent fraud, abuse, or misuse
• Comply with legal, tax, accounting, or regulatory obligations
• Communicate important service, account, privacy, security, or billing updates

We do not sell uploaded documents.

We do not use uploaded documents for unrelated marketing purposes.

3. How Documents Are Handled

DocAware is designed to reduce unnecessary document storage.

Original files are parsed in the user's browser. The original file is not uploaded to DocAware backend storage. Only extracted text is sent for the AI analysis request.

The extracted text is used to generate the requested analysis and is not stored as original document text. The generated analysis is saved to the user's account so the user can view it later.

Because very long documents may exceed current processing limits, DocAware may analyze only the first portion of long documents and display a notice to the user.

4. AI Processing

DocAware uses the Lovable AI Gateway with Google Gemini 2.5 Flash to generate document analysis results.

To provide the service, DocAware sends extracted plain text from the document, truncated if necessary, and the file name for one AI analysis request. The original file is not sent as a file to the AI provider.

Provider-side retention, logging, and training behavior are governed by the applicable terms and settings of the Lovable AI Gateway and Google Gemini. DocAware does not make a separate claim that the AI provider does not retain or train on submitted data unless such a setting is confirmed and active.

AI-generated outputs may be incomplete, inaccurate, or fail to identify every issue.

5. Sharing Information

We may share information with service providers that help us operate DocAware, including providers for:

• Hosting and infrastructure
• Database services
• Authentication
• AI document processing
• Payment processing
• Email delivery
• Customer support
• Security and error monitoring

These providers are expected to use information only as needed to provide services to DocAware.

We may also disclose information if required to:

• Comply with law or legal process
• Protect rights, safety, or security
• Investigate fraud, abuse, or misuse
• Enforce our Terms of Use
• Complete a business transfer, merger, acquisition, restructuring, or sale of assets

6. Payments

Payments are processed by Paddle. DocAware does not store full credit card numbers or full payment card details.

For billing questions, contact: billing.docaware@overcomerisk.com

7. Cookies and Local Storage

DocAware uses authentication session cookies, local storage tokens, or similar technologies needed for sign-in and account access. Paddle may set its own cookies or similar technologies in connection with checkout.

DocAware stores an anonymous visit ID in your browser's local storage, along with any campaign (UTM) parameters from the link you arrived through, so first-party usage counts are accurate.

DocAware also uses the Meta (Facebook) Pixel, a third-party marketing analytics tool. The Meta Pixel may set or read advertising and analytics cookies and similar technologies in your browser. See the Usage, Device, and Technical Information section above for what is shared with Meta. If you prefer not to be tracked by the Meta Pixel, you may use your browser's cookie-blocking or do-not-track settings, or Meta's own ad preferences.

8. Data Retention

We retain account information, billing-related records, credit transactions, and generated analyses as reasonably needed to provide the service, maintain account history, support users, comply with legal or accounting obligations, prevent misuse, and operate DocAware.

Generated analysis reports are currently retained unless the user's account is deleted or unless deletion functionality is otherwise made available and used.

Original uploaded files are not retained because they are not uploaded to backend storage.

Anonymous first-party analytics records are retained for as long as they are useful for understanding website usage; no fixed automatic deletion period is currently set. If a set retention period is adopted, this policy will be updated.

9. Security

DocAware uses reasonable administrative, technical, and organizational safeguards designed to protect information. Data is transmitted using HTTPS/TLS. Database storage is managed by Supabase/Lovable Cloud, which provides platform-level encryption at rest.

No online service, system, or transmission method is completely secure. We cannot guarantee absolute security.

For more information, please see our Security page.

10. User Choices and Privacy Requests

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of certain personal information.

To make a privacy request, contact: privacy@overcomerisk.com

We may need to verify your identity before responding.

11. Children's Privacy

DocAware is not intended for children under 13. We do not knowingly collect personal information from children under 13.

If you believe a child has provided personal information to DocAware, contact: privacy@overcomerisk.com

12. International Users

If you access DocAware from outside the United States, you understand that information may be processed in the United States or other locations where our service providers operate.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the Last Updated date and may provide additional notice as appropriate.

14. Contact Us

Privacy questions:
privacy@overcomerisk.com

Support:
support.docaware@overcomerisk.com

Billing:
billing.docaware@overcomerisk.com

Legal / Terms questions:
legal@overcomerisk.com

DocAware by OvercomeRisk
Operated by KurtzLieb Technology LLC
Address available upon request