Privacy Policy

Who we are

Doclight is an AI visibility tracker built and operated by [TODO: legal entity name and registered address] ("Doclight", "we", "us"). We are the controller of the personal data described in this policy, except where we say we process data on a customer's behalf.

Contact for anything in this policy: [email protected].

This policy covers:

• the website and documentation at doclight.app
• the Doclight app at app.doclight.app and the API at api.doclight.app
• the free website scanner at try.doclight.app
• the Doclight SDKs (@doclight/core, @doclight/node, @doclight/express, @doclight/mcp) and the Doclight MCP server

What we collect and why

Your account

When you create an account we collect your email address and a password. The password is stored only as a one-way hash (argon2), never in readable form. We also store an optional referral or invite code you enter, your interface language, a country you may choose to declare, whether your email is verified, and sign-in timestamps and failed sign-in counts used to protect the account.

If sign-in with Google or GitHub is offered and you use it, we receive the account identifier and email address that provider shares with us.

We use this data to create and secure your account, sign you in, and contact you about your account.

What you add to Doclight

The brands, domains, aliases, competitors, questions, markets, languages, alert rules and report schedules you set up are stored in your workspace. If you invite teammates we store their email address and role. If you use the in-app assistant, your conversations are stored so you can return to them.

Measurements and analysis

To measure AI visibility we send the questions you track to AI providers through their official APIs (currently OpenAI, Anthropic, Perplexity and Google) and store the answers, together with the brands, links and sources found in them.

If you add a website, we fetch its public pages to check how readable it is for AI systems. Agent task audits load your site in an automated browser and may store screenshots of the pages visited. Some analysis (content assessments, sentiment and claim review, the assistant) sends page content, stored answers or your messages to an AI provider to produce a result.

Please do not put personal data about other people in your tracked questions or assistant messages.

Payments

Paid plans are sold through Lemon Squeezy, which acts as the merchant of record and processes your payment details under its own privacy policy. We never see or store card numbers. We receive and store your Lemon Squeezy customer and subscription identifiers, plan, subscription status and renewal or cancellation dates, so we can give you the access you paid for.

API keys

When you create an API key we store only a hash of it and a short prefix that identifies it. The full key is shown to you once and cannot be recovered by us. Each request made with a key is checked against its scope and rate limit.

The Doclight SDKs

The SDKs run inside your own website or MCP server and send events to api.doclight.app using an ingest key you create. For visitors to your website and users of your MCP server, you are the controller of this data and we process it on your behalf. [TODO: confirm processor role and whether a data processing agreement is offered]

For website requests, the SDKs send the request path (without query string), HTTP method, status code, duration, the crawler or agent label, the user agent string, the referrer, a timestamp, a session identifier and any metadata you choose to attach. We store only the origin of the referrer (scheme, host and port); its path and query are discarded. Request and response bodies, headers, cookies and query strings are not stored, and the Express middleware does not collect raw IP addresses.

For MCP servers, @doclight/mcp sends the tool name, server name, status, duration, error type and session and trace identifiers. Tool arguments and results are not stored.

Values you supply yourself (session identifiers, metadata, labels) are sent as given. Use short, non-sensitive identifiers, never emails, tokens or customer names. More detail is in the SDK privacy documentation.

The Doclight MCP server

The MCP server runs on your own machine and calls the Doclight API with your API key. Requests it makes, such as listing brands, adding questions or starting a run, are processed the same way as the same actions in the app.

The free scanner

The scanner at try.doclight.app checks a website you enter without an account. [TODO: confirm what the scanner stores (the URL, the results, any email address), for how long, and whether results are publicly viewable by link]

Emails

We send emails needed to run your account (email verification, password resets, security notices) and the alerts and reports you turn on. You can change or pause reports and alerts in the app. If you were on our earlier waitlist, you can unsubscribe from those emails at any time.

If you write to us, we keep the correspondence to answer you and to keep a record of what was agreed.

Security and audit records

We keep an audit log of security-relevant account and workspace actions with the IP address the request came from. These records are kept after an account is deleted, with the link to the account removed, so that the history of actions on shared workspaces stays intact. [TODO: audit log retention period]

Our hosting provider records technical request logs, including IP addresses. [TODO: hosting log retention period]

This website, cookies and analytics

doclight.app does not use analytics, advertising or tracking cookies. It stores your light or dark theme choice in your browser's local storage. Language routing may store your chosen language in a cookie so the site opens in that language. [TODO: confirm whether the language cookie is set in production]

The app stores your sign-in session in your browser's session storage and remembers interface preferences (selected brand, theme, language, sidebar and tutorial state) in local storage. Sign-in with Google or GitHub uses a short-lived cookie to protect the sign-in flow.

The website and the app may use Sentry for error monitoring, which records technical details about errors such as the page, browser and error message. [TODO: confirm Sentry is enabled in production, its data region and retention]

Legal bases

Where the EU or UK GDPR applies, we rely on:

• Contract: to provide your account, workspace, measurements, billing and the emails the service needs.
• Legitimate interests: to keep the service secure, prevent abuse, monitor errors and improve the product. You can object to this processing.
• Legal obligation: to keep records required by law, for example for tax.
• Consent: where the law requires it. You can withdraw consent at any time.

Who we share data with

We do not sell personal data and do not share it for advertising. We share it only with service providers that help us run Doclight, under contracts that limit their use of it:

• Railway: hosting, databases and request logs
• OpenAI, Anthropic, Perplexity and Google: AI APIs used for measurements and analysis
• Lemon Squeezy: payments, subscriptions and tax
• Resend: email delivery [TODO: confirm email provider]
• Sentry: error monitoring [TODO: confirm]
• [TODO: object storage provider for screenshots]

[TODO: complete subprocessor list with each provider's location, and confirm each AI provider's API data use and retention terms]

We may also disclose data when required by law, or to protect our rights, our users or the public.

International transfers

Our service providers may process data outside your country. [TODO: hosting region and the transfer mechanism used, for example Standard Contractual Clauses]

How long we keep data

• Account and workspace data: for as long as your account exists.
• Account deletion: you can delete your account in the app. Deletion is processed promptly and removes your account, workspaces you own, brands, questions, answers and SDK events. We keep a minimal deletion record (an internal account identifier, the account creation date and the deletion date, without your email) so that deleted data is not brought back if we ever restore a backup.
• MCP tool and session events: 90 days, then deleted automatically.
• Website request events from the SDKs: until the brand or account is deleted.
• Backups: [TODO: backup retention period]
• Audit records and hosting logs: see above.
• Billing records: kept by Lemon Squeezy as required by tax law. [TODO: how long we keep billing identifiers after account deletion, if at all]
• Email correspondence: [TODO: retention period]

Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to its processing, and withdraw consent.

• Export: use "Export my data" in the app's settings to download your data.
• Delete: delete your account from the app's settings.
• Anything else: email [email protected]. We will answer within one month. [TODO: confirm response time]

You also have the right to complain to your local data protection authority.

Security

We protect data with encryption in transit (HTTPS), hashed passwords and API keys, workspace roles that limit who can see what, and audit logging. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

Children

Doclight is a business tool and is not directed at children. [TODO: minimum age, for example 16]

Changes to this policy

When we change this policy we update the date at the top of this page. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.

Contact

Questions or requests about privacy: [email protected].

[TODO: legal entity name, registered address and, if required, an EU or UK representative]