Privacy Policy

1. Overview

This Policy applies to the HolyDocs hosted platform, our marketing websites, the command-line interface, the API, the documentation renderer, and any documentation site you publish through HolyDocs. It does not cover the practices of third-party websites, services, or applications that you may access via links from a HolyDocs documentation site; those are governed by the privacy notices of those third parties.

2. Who We Are

For the purposes of GDPR and similar laws, HolyDocs acts as the data controller of personal information about visitors to our marketing site and about Customer account holders. We act as a data processor for personal information that Customers upload to or generate within their documentation projects, including end-user data on documentation sites with authentication or feedback enabled. The terms governing our role as a processor are set out in our Data Processing Agreement.

3. Data We Collect

3.1 Account Information

When you create an account, we collect your name, email address, password hash (or OAuth identifier for social sign-in), profile photo URL, organization name, and any billing details you provide. If you connect a GitHub or Google account, we receive only the profile fields required to authenticate you (typically your name, email, avatar URL, and a stable user ID); we do not request access to your repositories beyond the scope you explicitly authorize through the HolyDocs GitHub App.

3.2 Customer Content

We process the documentation Content you upload, including text, MDX files, OpenAPI specifications, code samples, images, configuration, and theme assets. Customer Content may contain personal information about your own users or about yourself; we process this Content on your instructions and only as needed to deliver the Service.

3.3 Usage and Telemetry Data

We collect data about how you interact with the Service, including:

• page views in the dashboard, including the routes you visit and timings;
• deployments, build logs, search queries within the dashboard, AI assistant prompts and responses, and editor activity;
• device and browser information (user agent, OS, screen size, language);
• IP address and approximate geographic location (city or region) derived from the IP address;
• error reports and performance traces.

3.4 Documentation Site Analytics

When end users visit a documentation site you publish, we may collect aggregated analytics such as page views, referrer, country, and search queries. We use anonymous visitor identifiers (random UUIDs stored in first-party cookies). We do not build cross-site profiles of visitors, and we respect the Global Privacy Control and the Do Not Track header.

3.5 Payment Data

All payments are processed by Stripe. We do not store full card numbers; Stripe provides us with a tokenized payment method, the last four digits of the card, the card brand, the billing country, and invoice metadata. Stripe’s handling of your payment data is governed by Stripe’s privacy notice.

3.6 Support and Communications

When you contact us through support channels, chat, or email, we keep a record of the conversation, including any attachments and the email address you used. We use RogerIQ for customer support; messages are stored in RogerIQ on our behalf.

3.7 Cookies and Similar Technologies

See section 12 below, and our Cookie Policy, for a full description of the cookies we set and how to manage them.

4. Legal Basis for Processing (GDPR Art. 6)

Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases:

• Performance of a contract — to provide the Service you have subscribed to, process payments, and provide customer support.
• Legitimate interests — to secure the Service, prevent fraud and abuse, debug and improve the product, and conduct aggregated analytics where the processing does not override your interests or fundamental rights.
• Consent — for non-essential cookies, marketing emails to prospects, and any processing not otherwise covered by another lawful basis. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before the withdrawal.
• Legal obligation — to comply with tax, accounting, and other obligations imposed by law.
• Vital interests / public interest — in rare cases where processing is necessary to protect the vital interests of an individual.

5. How We Use Data

We use personal information to:

• provide, operate, and maintain the Service;
• authenticate users, manage accounts, and provide customer support;
• process payments, send invoices, and prevent fraud;
• monitor and improve performance, reliability, and security;
• develop new features, conduct internal analytics, and benchmark aggregated usage;
• communicate with you about product updates, security advisories, and service announcements (these transactional communications are necessary for the Service and cannot be opted out of while your account is active);
• send marketing communications, where we have a lawful basis to do so and you have not opted out;
• comply with legal obligations and respond to lawful requests from authorities.

6. Sharing and Subprocessors

We do not sell your personal information. We share data only with the categories of recipients listed below.

• Subprocessors — vendors that process data on our behalf, such as cloud hosting, payment processing, customer support, and AI inference providers. The current list, including each subprocessor’s location and purpose, is maintained at /subprocessors.
• Authorized members of your workspace — if you are part of an organization, other members of that organization may see your name, email, and activity within the project.
• Legal and regulatory authorities — if we are required to disclose data to comply with applicable law, a valid subpoena, court order, or government request, we will do so. Where lawful, we will notify the affected Customer.
• Successors in a corporate transaction — if HolyDocs is involved in a merger, acquisition, financing, or sale of assets, your data may be transferred to the acquiring entity. We will provide notice and an opportunity to delete your account before any such transfer takes effect, where lawful.

7. International Data Transfers

HolyDocs is operated from the United States and uses cloud infrastructure that may process data globally. When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision from the European Commission (or equivalent UK or Swiss authority), we rely on the European Commission’s Standard Contractual Clauses (SCCs, 2021/914) and equivalent UK addendum or Swiss equivalent, supplemented where necessary by additional safeguards such as encryption in transit and at rest. The SCCs are incorporated by reference into our Data Processing Agreement.

8. Retention

We retain personal information only as long as is necessary for the purposes described in this Policy.

• Account information is retained for the lifetime of your account and for up to 90 days after deletion in our active systems, after which it is purged. Backup copies may persist for up to an additional 35 days before rolling off.
• Customer Content is retained while your account is active. After deletion, Content is purged within 30 days from primary storage, with backups rolling off within an additional 35 days.
• Application logs (including request logs, error reports, and performance traces) are retained for 30 days.
• Analytics data (aggregated dashboard and documentation site usage) is retained for up to 24 months.
• Billing and invoice records are retained for the period required by applicable tax and accounting law (typically seven years in the United States).
• Support communications are retained for up to 36 months for quality and training purposes.

9. Your Rights

Subject to applicable law, you have the following rights regarding your personal information:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete personal data.
• Erasure (“right to be forgotten”) — ask us to delete your personal data, subject to legal retention requirements.
• Restriction — ask us to limit how we use your data while a dispute or request is resolved.
• Portability — receive your data in a structured, machine-readable format, where the processing is automated and based on consent or contract.
• Objection — object to processing based on legitimate interests, including profiling and direct marketing.
• Withdrawal of consent — withdraw any consent you previously gave, without affecting the lawfulness of prior processing.
• Lodge a complaint — complain to a supervisory authority, including the data protection authority of your country of residence.

10. How to Exercise Your Rights

You can exercise many rights directly from your account dashboard: edit your profile, change your email, download your data (Settings → Account → Export), and delete your account. For everything else, email privacy@holydocs.com from the address associated with your account. We will respond within 30 days, and may extend this period by up to 60 additional days for complex requests, with notice to you.

We may need to verify your identity before fulfilling certain requests. We do not charge a fee for fulfilling rights requests unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, as permitted by law.

11. Children’s Privacy

The Service is not directed to children under the age of sixteen (16) and we do not knowingly collect personal information from anyone under that age. If we discover that we have collected personal information from a child under 16 without parental consent, we will delete it promptly. If you believe we may have any such information, please contact us at privacy@holydocs.com.

12. Cookies and Tracking Technologies

We use a small number of cookies and similar technologies, grouped as follows:

• Essential — required for the Service to function, including authentication tokens, CSRF tokens, and session cookies. These cannot be disabled.
• Analytics — help us understand how the Service is used so we can improve it. In jurisdictions that require consent, we will not set analytics cookies until you accept them via the banner.
• Functional — remember preferences such as your theme (light/dark) and last-used provider.
• Marketing — we do not currently use marketing cookies on our marketing site.

Full details, including cookie names and expiries, are available in our Cookie Policy. You can manage cookies in your browser settings and via the cookie banner.

13. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”):

• the right to know what categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it;
• the right to request deletion of personal information;
• the right to correct inaccurate personal information;
• the right to opt out of the sale or sharing of personal information and of cross-context behavioral advertising;
• the right to limit the use of sensitive personal information;
• the right to non-discrimination for exercising any of these rights.

We do not sell or share personal information as those terms are defined under the CCPA, and we have not done so in the prior 12 months. To exercise any of these rights, email privacy@holydocs.com. You may designate an authorized agent to act on your behalf; we will require proof of the designation before acting.

14. Data Security

We maintain administrative, technical, and organizational measures designed to protect personal data from unauthorized access, disclosure, alteration, or destruction. These include encryption in transit (TLS 1.3) and at rest (AES-256), least-privilege access controls, multi-factor authentication for staff, hardened infrastructure on Cloudflare Workers, dependency vulnerability scanning, and audit logging of administrative actions. We are pursuing SOC 2 Type II attestation. See our Security page for details.

No security program is perfect, and we cannot guarantee absolute security. You play a critical role in protecting your data by using a strong, unique password, enabling multi-factor authentication where available, and keeping your authentication tokens and devices secure.

15. Breach Notification

In the event of a confirmed personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and any applicable supervisory authority without undue delay, and, where required by law, within 72 hours of becoming aware of the breach. Notifications will be sent to the email address on file and may also be posted to our status page.

16. AI Processing

Our AI features (assistant, agent, search, summarization, translation) process documentation Content through large-language-model providers via the OpenRouter gateway and direct integrations with providers such as Anthropic. We do not transmit end-user personally identifiable information to AI providers beyond what is contained in the Content the Customer publishes, and our agreements with model providers prohibit them from using your data to train their models. Prompts and responses may be retained for short periods by providers for abuse monitoring, as described in their respective policies. See the Subprocessors page for the current list of AI vendors.

16.1 Prompt Logging

Prompts and responses generated by the AI assistant and agent features are logged within your workspace so you and your authorized collaborators can review past conversations and so we can debug issues you report. Workspace owners can disable prompt logging from Settings → AI; disabling logging may reduce our ability to assist with support requests that depend on reproducing a past AI interaction.

16.2 Automated Decision-Making

HolyDocs does not make decisions about you that produce legal or similarly significant effects based solely on automated processing. AI features are tools that assist humans; they do not, for example, decide whether to suspend an account or approve a refund on their own. Where we use automated systems to flag potential abuse, those decisions are reviewed by a human before any account-impacting action is taken.

16.3 Marketing Communications

Where we send marketing emails (for example, occasional product newsletters), we do so on the basis of consent (for prospects who sign up) or our legitimate interest in contacting existing customers about features relevant to their use of the Service. Every marketing email contains an unsubscribe link, and you can also opt out by emailing privacy@holydocs.com. Unsubscribing does not affect transactional emails (such as billing receipts and security notifications), which are necessary for the Service.

16.4 Profiling

We do not engage in profiling activities that result in legal or similarly significant effects on you. Aggregated, de-identified analytics about how the Service is used (for example, “X% of new users complete onboarding within 24 hours”) are not considered profiling under the GDPR.

17. Changes to This Policy

We may update this Policy from time to time to reflect changes in the Service, the law, or our practices. For material changes, we will notify Customers by email at least 30 days before the change takes effect and post a notice in the dashboard. The “Last updated” date at the top of this Policy indicates when it was last revised.

18. Contact & Data Protection Officer

For privacy-related questions or to exercise any of your rights, contact us at privacy@holydocs.com. Our Data Protection Officer can be reached at dpo@holydocs.com. For EU and UK representative requests in connection with Article 27 of the GDPR or UK GDPR, please email dpo@holydocs.com; we will designate and publish a representative if and when our processing activities trigger that requirement.