Privacy Policy

DullDocs is a trading name of RJS & Partners LLP (OC455066), registered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. This policy explains what information we collect when you use the DullDocs application, why we collect it, and the choices you have. If you have any questions, contact us at privacy@dulldocs.com.

Information we collect

• Account information — your name and email address, used to sign you in and contact you.
• Organisation details — your organisation’s trading/legal name, company number, sites, and team members.
• Evidence documents — the files you upload or import so DullDocs can help you track inspection-readiness. These may contain personal data about staff and, in some settings, children or residents. We treat this as sensitive and apply additional safeguards (see High-sensitivity mode below).
• Usage and technical data — basic logs needed to operate and secure the service.

Connecting Google Drive (and other cloud storage)

If you choose to connect Google Drive, DullDocs requests least-privilege, per-file access (the drive.file scope) by default, for one purpose: to let you import documents you select as compliance evidence. This scope means DullDocs can only see the specific files you choose — not your wider Drive. We:

• only access the files and folders you choose to import;
• never modify, delete, or share your Google Drive files;
• store the extracted text, metadata, and a copy of imported documents inside your DullDocs account;
• store your access/refresh tokens encrypted at rest, and let you disconnect at any time from Settings → Integrations.

Google API Limited Use disclosure

DullDocs’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google Drive is used solely to provide and improve the document-evidence features you see in the app; it is not used for advertising, is not sold, and is not used by us to train AI models.

How we use your information

• To provide the service: classify documents, extract dates, and track requirement status.
• To send you reminders, digests, and account/security emails.
• To take payment and manage your subscription.
• To keep the service secure and to meet our legal obligations.

Document classification and date extraction use an automated AI document-processing provider (OpenAI or Anthropic — see sub-processors below). The content of the documents you upload — which may include special-category or criminal-offence data such as DBS and barred-list results, right-to-work and identity documents, health information, or safeguarding records — is sent to the active provider to provide these features, and is processed only for classification and extraction. Our configuration and provider agreements are intended to prevent customer content being used to train generalised models; we are completing verification of the account-level data-processing terms with each provider and publish the confirmed position on our Trust page.

Service providers (sub-processors)

We rely on a small number of providers to run DullDocs:

• Cloudflare — public website delivery, security and DNS
• Vercel — application hosting (functions run in the EU / Dublin region) and Vercel Blob object storage for uploaded documents and published Ofsted reports
• Render — background processing for Inspector Briefings
• MongoDB Atlas — database (EU region)
• Resend — transactional email
• Stripe — payments
• OpenAI and/or Anthropic (United States) — automated document classification and text/date extraction. Which provider is used depends on our configuration; document content is sent to the active provider for these features only. See our Trust page for exactly what is sent and for the verified position on retention and model-training as we complete confirmation of each provider’s account-level terms.

Ofsted inspector information

If you are an Ofsted inspector, our Inspector Briefings privacy notice explains how we use information from published Ofsted reports, our legitimate interests, retention, and how to object or make a subject access request.

Special category & criminal offence data

To help settings evidence their statutory duties, DullDocs processes special-category data (UK GDPR Article 9 — for example health information) and criminal-offence data (Article 10 — for example DBS and barred-list results, and suitability declarations). We process this on behalf of your organisation (the employer), which determines why it is collected. The lawful bases are your organisation’s legitimate interests and compliance with its legal obligations in the employment and safeguarding context; the special-category and criminal-offence processing relies on the employment and substantial-public-interest conditions in the Data Protection Act 2018 (Schedule 1). Staff completing a suitability declaration are shown a short notice before they submit.

International transfers

Our automated document-processing providers (OpenAI and/or Anthropic) are based in the United States, so document content — which may include the special-category and criminal-offence data described above — may be transferred to the US for classification and extraction. Where personal data is transferred outside the UK, we use appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; we are completing verification of the transfer terms incorporated in each provider’s account-level agreement and will confirm the position here once done.

Acknowledgement & declaration audit trail

When a staff member opens or submits a policy acknowledgement or a suitability declaration through a secure link, we record the outcome together with the date and time, the IP address, and the device/browser used, so the acknowledgement or declaration can be evidenced during an inspection. These records form part of your organisation’s compliance history.

High-sensitivity mode

When enabled for your organisation, DullDocs keeps personal details about children, residents, and staff inside the app and out of outbound emails.

Retention & security

We keep your data while your account is active and as needed to provide the service. When you close your account or ask us to delete your data, we delete or anonymise it within 30 days of a verified request, except for limited records we must retain to meet legal or regulatory obligations (for example, compliance/audit history or financial records). We use encryption in transit and at rest for credentials and apply access controls appropriate to the sensitivity of the data.

Your rights

Under UK GDPR you have rights to access, correct, delete, and port your data, and to object to or restrict certain processing. To exercise any of these, email privacy@dulldocs.com.

Changes

We may update this policy from time to time. We will update the date above and, where appropriate, notify you in the app.