Privacy Policy

Effective date: 16 October 2026

This Privacy Policy explains how Rustemas Gafurovas (Individual Activity) — a natural person engaged in individual activity (Individuali veikla) under Certificate of Individual Activity No. 966482, Lithuania — (“we”, “us”, “DocuHook”) processes personal data when you use https://docuhook.com and related services.

1. Data controller

Controller: Rustemas Gafurovas (Individual Activity)
Legal form: Individual activity (Individuali veikla)
Certificate of Individual Activity No. 966482
Country: Lithuania
Address: Sodu g. 48, Žujūnai, Vilnius, Lithuania
Email: [email protected]

2. What we process

• Account data — email address, hashed password, email confirmation status, plan, and subscription status.
• Transactional email — we send account confirmation (and similar service) emails to the address you provide.
• API credentials — API key prefixes and hashes (we never store the full key in plain text after creation).
• Usage metrics — monthly PDF/render counts for plan limits.
• Billing data — Stripe customer and subscription IDs. Card details are handled by Stripe; we do not store full card numbers.
• Render / job content — JSON payloads and HTML templates you submit for merging/PDF generation. Async jobs are stored temporarily and deleted after about 24 hours.
• Technical data — session cookie, CSRF token in session, and standard server logs (IP address, user agent, timestamps) for security and abuse prevention.

3. Purposes and legal bases (GDPR Art. 6)

• Contract (Art. 6(1)(b)) — create and manage your account, authenticate API requests, provide the render service, and bill paid plans.
• Legitimate interests (Art. 6(1)(f)) — secure the service, prevent abuse, and keep essential session state. You may object where applicable.
• Legal obligation (Art. 6(1)(c)) — retain billing records where tax or accounting law requires it.

4. Document content you send us

If your templates or JSON contain personal data about your customers or end users, you are the controller of that data and DocuHook acts as your processor for the purpose of merging and returning documents. You must have a lawful basis to send that data to us. We process it only to provide the service, do not sell it, and purge temporary job files on the schedule above.

5. Processors and recipients

• Stripe, Inc. / Stripe Payments Europe — payment processing and billing portal. See Stripe’s privacy policy.
• Hosting provider — application and database hosting in the European Union.
• CDN / font providers — the site may load fonts or scripts from third-party CDNs (e.g. Google Fonts, jsDelivr). Their servers may receive your IP address when your browser requests those assets.

We do not sell personal data or use it for third-party advertising.

6. International transfers

Primary service data is hosted in the European Union. Some processors (notably Stripe and certain CDNs) may process data outside the EEA. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses and the provider’s GDPR measures.

7. Retention

• Account data — until you delete your account, or we close inactive accounts after notice.
• Async render jobs — about 24 hours after completion or failure.
• Usage counters — kept while the account exists for plan enforcement.
• Billing / tax records — as required by applicable law (typically up to 10 years in Lithuania for accounting records).
• Security logs — retained only as long as needed for security and troubleshooting (generally up to 90 days).

8. Your rights

Under the GDPR you may request:

• Access to your personal data
• Rectification of inaccurate data
• Erasure (“right to be forgotten”)
• Restriction of processing
• Data portability
• Objection to processing based on legitimate interests

You can delete your account from the Account page (signed-in users), or email [email protected]. We will respond within one month.

You may lodge a complaint with State Data Protection Inspectorate (VDAI), Lithuania (https://vdai.lrv.lt) or your local supervisory authority in the EEA.

9. Security

We use HTTPS, hashed passwords, hashed API keys, HttpOnly session cookies, and CSRF protection on forms. No method of transmission or storage is perfectly secure; please protect your API keys.

10. Children

DocuHook is a business service and is not directed at children under 16. We do not knowingly collect their data.

11. Changes

We may update this policy. Material changes will be reflected by updating the effective date on this page. Continued use of the service after changes means you acknowledge the updated policy.

12. Contact

Privacy requests: [email protected]
Controller: Rustemas Gafurovas (Individual Activity), Certificate of Individual Activity No. 966482