Terms of Use & Privacy Policy

Docify (“we”, “us”, “our”) is a multi-tenant SaaS platform that enables organizations to generate PDF documents from structured form data and verify the integrity of signed or scanned copies returned by counterparties. Docify is operated by Docify (docify.com.vn) and serves customers primarily in Vietnam, Singapore, and Australia.

By accessing or using the Docify platform, you agree to these Terms of Use and Privacy Policy. If you do not agree, please do not use the platform.

Docify provides the following services to registered organizations (tenants):

• Creation and management of HTML document templates.
• Dynamic PDF generation from structured form submissions, rendered via Browserless.io (managed Chromium).
• Document tracking using unique serial numbers and QR codes.
• Automated document integrity verification using Optical Character Recognition (OCR) technology provided by Google Cloud Vision API.
• Multi-user organization management with role-based access control.
• Public invite links enabling external parties to submit signed documents for review.

We collect and process the following categories of personal and organizational data:

• Account data: email address, organization name, role within the organization.
• Form submission data: any personal data fields defined by the tenant organization in their templates (e.g., names, identification numbers, financial figures, dates, addresses, phone numbers).
• Generated documents: PDF files produced from template and form data, stored in Supabase Storage.
• Uploaded documents: scanned or signed PDF/image files uploaded for verification, stored temporarily for OCR processing.
• Verification data: OCR-extracted text, field comparison results, and confidence scores.
• Usage data: verification counts, storage consumption, and access logs for billing and quota management purposes.
• Communication data: email addresses used to send OTP verification codes and review outcome notifications via Brevo.

We use the data described above for the following purposes:

• Providing, operating, and improving the Docify platform.
• Generating and storing PDF documents on behalf of tenant organizations.
• Performing document integrity verification by comparing text extracted from original and returned documents.
• Sending transactional emails (OTP codes, invite links, review outcomes).
• Enforcing subscription plan limits and tracking usage metrics.
• Diagnosing technical issues and maintaining platform security.

We do not sell, rent, or trade personal data to third parties for marketing purposes.

For users and data subjects located in the European Union or European Economic Area, Docify processes personal data in accordance with Regulation (EU) 2016/679 (GDPR).

Legal Bases for Processing

• Contract performance (Art. 6(1)(b)): processing necessary to provide the services you have contracted for.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, platform security, and service improvement.
• Consent (Art. 6(1)(a)): where explicitly obtained, such as for optional marketing communications.
• Legal obligation (Art. 6(1)(c)): where required by applicable law.

Your Rights Under GDPR

You have the right to:

• Access personal data we hold about you (Art. 15).
• Rectify inaccurate personal data (Art. 16).
• Request erasure of personal data (“right to be forgotten”) (Art. 17).
• Restrict processing in certain circumstances (Art. 18).
• Data portability in a structured, machine-readable format (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Lodge a complaint with your national data protection supervisory authority.

International Transfers

Some of our sub-processors (Google Cloud, Supabase, Brevo, Vercel) may process data outside the EU. Where this occurs, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) or the processor's EU–US Data Privacy Framework certification.

Docify complies with Singapore's Personal Data Protection Act 2012 (No. 26 of 2012), as amended, including the 2020 amendments.

Collection and Purpose

We collect personal data only for the purposes disclosed in these terms and only to the extent necessary for those purposes. We notify individuals of the purposes at or before the time of collection.

Consent

We obtain consent before collecting, using, or disclosing personal data, except where the PDPA permits collection without consent (e.g., for contractual necessity or business improvement purposes under the legitimate interests exception introduced in the 2020 amendments).

Access and Correction

Individuals may request access to their personal data or request corrections to inaccurate data by contacting us at the address below. We will respond within 30 calendar days.

Data Breach Notification

In the event of a data breach that is likely to result in significant harm, we will notify the Personal Data Protection Commission (PDPC) and affected individuals within 3 business days of becoming aware of the breach, as required by the Notifiable Data Breaches framework.

Transfer Limitation

When transferring personal data outside Singapore, we ensure the recipient country provides a comparable level of data protection or that contractual protections are in place.

For users located in the United States, the following laws may apply depending on your state of residence.

California — CCPA / CPRA

California residents have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). These include:

• The right to know what personal information is collected, used, shared, or sold.
• The right to delete personal information held by businesses.
• The right to opt-out of the sale or sharing of personal information. Docify does not sell or share personal information for cross-context behavioral advertising.
• The right to correct inaccurate personal information.
• The right to limit use and disclosure of sensitive personal information.
• The right to non-discrimination for exercising your privacy rights.

To exercise these rights, contact us at the address provided below. We will respond within 45 calendar days, with a possible 45-day extension where reasonably necessary.

Other US State Privacy Laws

We recognize and will honor equivalent rights under privacy laws in other states including, but not limited to: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and Oregon (OCPA). Residents of these states may submit data rights requests using the contact information below.

Children's Privacy (COPPA)

Docify does not knowingly collect personal data from individuals under 13 years of age. If we become aware that a child under 13 has provided us with personal data without verifiable parental consent, we will delete it promptly.

Docify respects and complies with Vietnam's data protection framework, including the Law on Cybersecurity 2018 (No. 24/2018/QH14) and Decree No. 13/2023/NĐ-CP on Personal Data Protection (“PDPD”), effective from July 2023.

Categories of Personal Data

Under Decree 13/2023, personal data is classified as Basic Personal Data and Sensitive Personal Data. Docify may process basic personal data (names, email addresses, identification numbers, contact information) in the course of providing its services. Where sensitive personal data (financial data, health data, or other sensitive categories) is included in tenant-defined form fields, the tenant organization bears responsibility as the data controller for obtaining appropriate consent.

Consent and Purpose Limitation

Personal data is processed only for purposes that have been disclosed to the data subject, with their consent, or on another lawful basis under the Decree. Data subjects have the right to withdraw consent at any time.

Rights of Data Subjects

Under Decree 13/2023, Vietnamese data subjects have the right to:

• Know the purposes, scope, and manner in which their personal data is processed.
• Consent to or refuse the processing of their personal data.
• Access, correct, or delete their personal data.
• Restrict processing of their personal data.
• Object to processing and request portability of their data.
• Receive compensation for damages caused by violations of the personal data protection regulations.
• Lodge a complaint with the Ministry of Public Security's Department of Cybersecurity and Hi-tech Crime Prevention (A05).

Cross-Border Data Transfer

Where personal data of Vietnamese data subjects is transferred outside Vietnam (e.g., to Supabase, Google Cloud, or other sub-processors), Docify complies with the cross-border transfer requirements under Article 25 of Decree 13/2023, including submission of the required impact assessment dossier to the Ministry of Public Security where applicable.

Data Localization

Docify acknowledges the data localization requirements under Article 26 of the Law on Cybersecurity 2018 for certain categories of data generated by Vietnamese users. We are actively monitoring regulatory guidance and will implement appropriate localization measures as required by applicable regulations and directives issued by competent authorities.

We use the following third-party services to operate the platform. Each is bound by data processing agreements and their own privacy policies:

Google Cloud Vision API processes document data synchronously in memory. Google does not store, train on, or retain API request data. Processing is covered under the Google Cloud Data Processing Addendum (DPA).

We retain personal data for as long as necessary to provide our services and meet our legal obligations:

• Account data: retained for the lifetime of the organization account, plus 90 days following account deletion.
• Generated documents and uploads: retained according to the tenant organization's subscription and storage quota. Organizations may delete documents at any time.
• Verification results: retained for 24 months from the date of verification, or until the organization account is deleted.
• Usage metrics: retained for 24 months for billing and auditing purposes.
• Email communication logs: retained by Brevo per their data retention policy (typically 30 days for transactional email logs).

We implement industry-standard security measures to protect personal data:

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted by Supabase using AES-256.
• Multi-tenant data isolation is enforced using Supabase Row Level Security (RLS) policies on every database table.
• Authentication uses Supabase Auth with PKCE flow.
• Service role keys are never exposed to client-side code.

No method of transmission or storage is 100% secure. In the event of a data breach, we will notify affected parties as required by applicable law.

Docify uses only functional cookies necessary for authentication session management (Supabase Auth session cookies). We do not use advertising cookies, cross-site tracking, or analytics SDKs that profile individual users.

Tenant organizations (the businesses that register and use Docify) act as the data controller for the personal data of their end users and external parties who fill in forms or submit documents via invite links. As a data controller, the tenant organization is responsible for:

• Obtaining valid legal consent from data subjects whose personal data is collected via Docify templates and forms.
• Disclosing to their data subjects that a third-party OCR processing service (Google Cloud Vision API) is used for document verification.
• Ensuring their use of Docify complies with applicable data protection laws in their jurisdiction.
• Providing data subjects with access to their rights (access, correction, erasure) in relation to data submitted through the tenant's Docify forms.

Docify acts as the data processor on behalf of tenant organizations in relation to end-user personal data.

The document verification service uses Optical Character Recognition (OCR) technology and automated text comparison algorithms (“AI-assisted verification”) to analyse submitted documents. These are automated processes and may produce inaccurate, incomplete, or misleading results due to factors including but not limited to: poor scan quality, unusual fonts or formatting, handwritten annotations, stamps, image compression artefacts, or document layout variations.

Verification results provided by Docify are indicative only and do not constitute a legal determination of document authenticity, integrity, or validity. A PASS result does not guarantee that a document is unmodified, and a FAIL or REVIEW_REQUIRED result does not guarantee that tampering has occurred.

Docify (docify.com.vn), its operators, directors, employees, and agents expressly disclaim all liability for:

• Decisions made by tenant organizations or their users based on automated verification results.
• False positive outcomes (a tampered document incorrectly assessed as PASS).
• False negative outcomes (an unmodified document incorrectly assessed as FAIL).
• Any loss, damage, liability, claim, or expense of any kind arising from or related to reliance on automated verification results.

Tenant organizations and their users are solely responsible for independently verifying the authenticity and integrity of documents and for conducting appropriate due diligence — including professional legal, financial, or compliance review — before taking any legal, financial, or operational action based on a document.

The use of Docify does not replace and should not be construed as a substitute for professional advice or independent verification.

We may update these Terms of Use and Privacy Policy from time to time. When we make material changes, we will notify registered organization owners by email and update the “Last updated” date at the top of this page. Continued use of the platform after the effective date of changes constitutes acceptance of the updated policy.

For privacy-related requests, data subject rights exercises, or complaints, please contact us at:

We aim to respond to all data rights requests within 30 calendar days. For complex requests, we may extend this period by a further 30 days and will inform you of the extension.