Legal

Privacy Policy

Last updated October 9, 2026

1. Introduction

Welcome to GettingDocs ("we," "our," or "us"). We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our document collection service.

By using GettingDocs, you confirm your acceptance of this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our service.

2. Information We Collect

2.1 Personal Information

When you register for an account, we collect:

  • Email address
  • Company / agency name
  • Password (encrypted using bcrypt)
  • Payment information (processed securely through Stripe)

2.2 Client Data

When you add clients to campaigns, we collect:

  • Client names
  • Phone numbers (for WhatsApp communication)
  • Email addresses (optional)
  • Document metadata (filenames, upload dates)

2.3 Document Storage

When clients upload documents:

  • Documents are temporarily stored on our secure servers
  • Documents are uploaded to YOUR Google Drive (if connected)
  • We retain metadata (filename, upload date, file size) for billing and service purposes
  • Document content is not analyzed or accessed by our staff

2.4 Authentication Data

If you use Google OAuth to connect Google Drive, we receive authorization tokens to access your Drive on your behalf. We do not have access to your Google password.

The same applies to any applicant tracking system (ATS) or CRM you choose to connect: we receive and store an access token or API key scoped to the permissions you grant, and never your password for that system. You can revoke it at any time, either from your settings or from within the ATS itself.

3. How We Use Your Information

3.1 Service Delivery

  • Facilitate WhatsApp communication with your clients
  • Process and organize client documents
  • Upload documents to your Google Drive
  • Manage your account and subscription
  • Track usage against your plan limits
  • Provide customer support

3.2 Communication

  • Send transactional emails (campaign updates, document receipts)
  • Send important service updates and security notices
  • Send notification alerts (if you've enabled email notifications)

4. Data Storage and Security

4.1 Security Measures

We implement industry-standard security measures:

  • All data transmitted via HTTPS encryption
  • Passwords hashed using bcrypt
  • Database hosted on secure Railway infrastructure
  • Regular security audits and updates
  • Access controls and authentication tokens

4.2 Payment Security

  • Payment processing handled by Stripe (PCI DSS compliant)
  • We never store your full credit card details
  • Only Stripe customer IDs are retained

4.3 Document Security

  • Documents sent over WhatsApp are received via Twilio infrastructure
  • Documents sent by email are received via Resend, including any attachments
  • Every file is screened before it is filed or shown to an AI model: programs, scripts and password-protected or empty files are refused, and the rest are virus-scanned on our own infrastructure (see the Security page)
  • Files pass through our servers in memory on their way to your ATS or Google Drive. A file waiting for its virus scan is held in our database until it has been scanned and filed
  • Google Drive integration uses OAuth 2.0 for secure access
  • No third-party access to your documents without explicit permission

5. Data Retention

5.1 Account Data

  • Account information retained while your account is active
  • You can delete your account at any time via Settings
  • Deletion removes your data from our live systems immediately; a copy may remain in our backups for up to 1 month (see 5.4)

5.2 Campaign and Message History

  • Campaign data retained for the duration of your subscription
  • Message history retained for audit and compliance purposes
  • Data automatically deleted upon account deletion

5.3 Documents

  • Documents stored in your ATS, or in YOUR Google Drive (under your control)
  • A file held for its virus scan is deleted once it has been scanned and filed, or after 30 days if filing it never succeeds
  • A file refused by screening is not kept. We keep a record of the refusal: the file's name, size and a fingerprint (hash) of it, and the reason it was refused
  • Document metadata retained for billing and service purposes

5.4 Backups

We maintain backups of our database to protect against data loss from technical failure or error. This means that when data is deleted from our live systems - including when you delete your account, clients or documents yourself from the Settings page - a copy may continue to exist in our backups for a limited period afterwards, until it is naturally removed as part of our normal backup rotation.

  • We use continuous point-in-time recovery, which allows us to restore the database to a recent point in time in the event of an error or failure
  • We also maintain scheduled backups on a daily basis (retained for 6 days) and a weekly basis (retained for 1 month)
  • Backups are encrypted and stored on the same infrastructure as our live database, provided by our hosting subprocessor (Railway)
  • Backup data is not accessed or used for any purpose other than restoring service in the event of data loss or error

6. Data Sharing

We do not sell, trade, or rent your personal information to third parties.

We share data with trusted service providers:

  • Stripe: Payment processing. Card details are entered on Stripe's own checkout and never reach our servers; we retain only a Stripe customer ID.
  • Twilio: WhatsApp messaging. Candidate phone numbers, message content and any documents they send over WhatsApp pass through Twilio.
  • Resend: Email sending and receiving. Chase emails are sent from your own verified domain via Resend, and candidate replies are received through it. This means candidate email addresses, the contents of those replies and any attached documents are processed and retained by Resend under their retention terms.
  • Brevo: Transactional email to you as the account holder - notifications, alerts and contact form messages.
  • Google Drive: Document storage, in a Drive you own and control.
  • Anthropic (Claude AI): Message generation, reply classification and document checks. Candidate message text, filenames and the document types still outstanding are sent to classify replies. If the document check is turned on (it is by default), the document file itself is also sent so it can be checked for legibility and correct type; it can be switched off per account in Settings. Anthropic does not use this data for training and deletes it after 30 days.
  • Railway: Hosting, database, and backup / disaster recovery. This covers all candidate and account data held in our database, including the encrypted backups described in section 5.4.

6.1 Applicant Tracking Systems and CRMs

We integrate with the applicant tracking system or CRM your team already uses. Today we support Recruit CRM, Crelate, Zoho Recruit and JobAdder. These integrations are optional and off by default - nothing is sent to an ATS unless you connect one, and connecting one does nothing until you also create a rule and switch it on.

When you connect one, you authorise us to call that provider's API on your behalf. For Recruit CRM and Crelate you supply an API key; for Zoho Recruit and JobAdder you sign in with that provider and approve the access we request, and we receive an access token rather than your password. We store keys and tokens encrypted and never display them again. You can revoke access at any time, from your settings here or from within the ATS itself.

In that provider's system we read and process candidate records - names, contact details, the record fields your rule refers to, and the documents already attached to the record - so we know who to chase, for which documents, and what they have already provided. We write the collected documents themselves, uploaded as attachments to the candidate's own record, and notes on that record: a note when a candidate has provided everything (if you leave that option enabled), and a note when a file a candidate sent was blocked by our security checks. We do not create, edit or delete candidate records, and we do not change their status or hiring stage.

JobAdder. If you connect JobAdder, we read and process the candidate data held in your JobAdder account: candidate records and their contact details, candidate statuses and custom fields, the attachments already on each record, and your JobAdder users and folders so your rules can refer to them. We may also register a webhook with JobAdder so changes to candidates reach us promptly. We write collected documents as attachments, and the notes described above, to the candidate's JobAdder record. The access we request is limited to these purposes.

Anything we send to your ATS is governed by that provider's privacy policy and by your agreement with them, not by this one. Disconnecting the integration stops all further transfer; it does not delete data the provider already holds, which you would need to remove from within that system.

7. Your Rights (GDPR Compliance)

You have the right to:

  • Access and download your personal data
  • Update or correct your account information
  • Request deletion of specific data (documents, clients, campaigns)
  • Request complete account deletion
  • Unsubscribe from email notifications at any time
  • Lodge a complaint with a data protection authority

All deletion requests can be performed directly in the Settings page under the "Danger Zone" section. This removes your data from our live systems immediately.

A copy may remain in our backups for up to 1 month, after which it is automatically and permanently removed as part of our standard backup rotation. Backups are not used for any purpose during this period other than disaster recovery. See section 5.4 for details.

8. Cookies and Tracking

We use essential cookies for authentication, security, and service functionality. We do not use tracking cookies or sell your data to advertisers.

9. Children's Privacy

GettingDocs is a business service not intended for users under 18 years of age. We do not knowingly collect personal information from children.

10. International Data Transfers

Your data may be transferred to and processed in countries outside of your residence. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

GettingDocs - Committed to protecting your privacy