Privacy Policy

DullDocs (“DullDocs”, “we”, “us”) is a product of EcoHedge Ltd. This policy explains what information we collect when you use the DullDocs application, why we collect it, and the choices you have. If you have any questions, contact us at max@ecohedge.co.uk.

Information we collect

• Account information — your name and email address, used to sign you in and contact you.
• Organisation details — your organisation’s trading/legal name, company number, sites, and team members.
• Evidence documents — the files you upload or import so DullDocs can help you track inspection-readiness. These may contain personal data about staff and, in some settings, children or residents. We treat this as sensitive and apply additional safeguards (see High-sensitivity mode below).
• Usage and technical data — basic logs needed to operate and secure the service.

Connecting Google Drive (and other cloud storage)

If you choose to connect Google Drive, DullDocs requests read-only access (the drive.readonly scope) for one purpose: to let you import documents you select as compliance evidence. We:

• only access the files and folders you choose to import;
• never modify, delete, or share your Google Drive files;
• store the extracted text, metadata, and a copy of imported documents inside your DullDocs account;
• store your access/refresh tokens encrypted at rest, and let you disconnect at any time from Settings → Integrations.

Google API Limited Use disclosure

DullDocs’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google Drive is used solely to provide and improve the document-evidence features you see in the app; it is not used for advertising, is not sold, and is not used to train generalised or third-party AI models.

How we use your information

• To provide the service: classify documents, extract dates, and track requirement status.
• To send you reminders, digests, and account/security emails.
• To take payment and manage your subscription.
• To keep the service secure and to meet our legal obligations.

Document classification and date extraction may use an automated document-processing provider. Content is processed only to provide these user-facing features and is not used to train generalised AI models.

Service providers (sub-processors)

We rely on a small number of providers to run DullDocs:

• Vercel — application hosting
• MongoDB Atlas — database
• Resend — transactional email
• Stripe — payments
• OpenAI — document classification / text extraction

High-sensitivity mode

When enabled for your organisation, DullDocs keeps personal details about children, residents, and staff inside the app and out of outbound emails.

Retention & security

We keep your data for as long as your account is active and as needed to provide the service. You can request deletion of your account and associated data at any time. We use encryption in transit and at rest for credentials and apply access controls appropriate to the sensitivity of the data.

Your rights

Under UK GDPR you have rights to access, correct, delete, and port your data, and to object to or restrict certain processing. To exercise any of these, email max@ecohedge.co.uk.

Changes

We may update this policy from time to time. We will update the date above and, where appropriate, notify you in the app.