Privacy Policy

Docuplate (Docuplate) is operated from Australia and provides a visual PDF template builder and document generation API. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Privacy enquiries and access requests: [email protected]

This policy applies to:

• Our marketing website and web application
• Authenticated product features (templates, builder, PDF generation, API keys, billing)
• Our public PDF generation API when called with a valid API key

It does not govern third-party websites, payment flows hosted by Stripe, or your own systems that call our API. If you use the service to process personal information about your customers, you remain responsible for your own privacy compliance (see section 5).

We may collect the following kinds of personal information:

Identity and contact: name and email address.

Account security: password (stored as a one-way hash, never in plain text).

Product content: templates you create (blocks, layout, theme, sample JSON), imported PDFs, generated PDF files, and related metadata. This may include personal information you or your users place in templates or JSON payloads.

API keys: a label you provide, a short public prefix, a hashed secret, creation and last-used timestamps, and active/revoked status. Full API key secrets are shown only once at creation.

Billing: subscription plan, Stripe customer and subscription identifiers, and billing status. Payment card details are processed by Stripe; we do not store full card numbers on our servers.

Usage and technical data: IP address, browser type, pages viewed, API request logs, error reports, and product analytics events (when enabled).

Communications: messages you send to support and our responses.

Where reasonable, we collect personal information directly from you. Some information is generated automatically when you use the service.

We use personal information to:

• Provide, operate, and improve the service
• Authenticate users and API requests
• Render and store PDFs you request
• Process subscriptions and enforce plan limits
• Monitor security, abuse, and reliability
• Respond to support and legal requests
• Send service-related notices (e.g. billing, security, or policy updates)

We disclose personal information to service providers who help us operate the service, including hosting, database, CDN, payment processing (Stripe), analytics (PostHog, when enabled), and AI providers (when you use AI features). These providers may be located outside Australia. We take reasonable steps to ensure overseas recipients handle information in line with APP 8.

We may also disclose information where required or authorised by Australian law, or to protect rights, safety, and service integrity.

We do not sell your personal information.

If you use AI-assisted features (template generation, import assistance, audits), relevant template and JSON content may be sent to our AI provider (e.g. OpenAI), which may process data outside Australia. Only submit personal information you are authorised to collect and use.

If you use Docuplate to generate documents containing personal information about third parties, you are responsible for complying with the Privacy Act and other applicable law, including providing notices and obtaining consents where required.

Essential storage: we store your authentication token and UI preferences (such as theme) in your browser to keep you signed in and remember settings.

Analytics: when configured, we use PostHog to collect usage analytics (page views and product events). Logged-in users may be identified by account ID and email for product analytics only.

You can clear site data in your browser settings. Blocking essential storage will prevent the app from functioning correctly.

We implement reasonable technical and organisational measures to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.

If we become aware of an eligible data breach under the Notifiable Data Breaches (NDB) scheme, we will assess the incident and, where required, notify affected individuals and the Office of the Australian Information Commissioner (OAIC).

We retain account and template data while your account is active. Generated PDFs and logs may be retained for operational, billing, and security purposes for a limited period. You may delete templates and revoke API keys in the app. Account deletion requests can be sent to [email protected]. Some records may be retained where required under Australian tax, accounting, or fraud-prevention obligations.

Under the APPs, you may request access to the personal information we hold about you and ask us to correct inaccurate, out-of-date, incomplete, irrelevant, or misleading information. Contact [email protected]. We will respond within a reasonable period and in line with the Privacy Act.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). We ask that you contact us first so we can try to resolve your concern.

Our service providers may store or process personal information in the United States or other countries. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient complies with the APPs (or we otherwise comply with APP 8). By using the service, you acknowledge that some disclosures to overseas recipients are reasonably necessary to provide the service.

The service is not directed to children under 15. We do not knowingly collect personal information from children without appropriate parental or guardian consent.

We may update this Privacy Policy from time to time. We will post the revised version with an updated date. Material changes may be communicated by email or in-app notice where appropriate.