Privacy Policy

This Privacy Policy explains how ChaseDocs handles personal data. ChaseDocs is a client document-collection service operated by PT Web Industri Teknologi, a limited liability company incorporated in Indonesia, trading as InPresenceLab (“ChaseDocs”, “we”, “us”).

We built ChaseDocs so that we hold as little of your clients' data as possible. Uploaded documents are routed into your own cloud storage wherever you connect it — we keep a reference, not the file. This policy describes exactly what that means.

1. Two different roles

Our responsibilities depend on whose data it is.

• Your firm's account data — we are the controller. Information about you and your staff (name, email, organisation, billing) is data we decide how to use, and this policy governs it.
• Your clients' documents and answers — you are the controller, we are the processor. When your firm requests documents from its clients, your firm decides what to collect and why. We process that data only to provide the service to you, on your instructions. You are responsible for having a lawful basis to collect it and for telling your own clients how you use it.

2. What we collect

From the firm (our customer)

• Account details: name, email address, and a securely hashed password (we never see your plain password).
• Organisation details: firm name, branding (logo, accent colour), and settings.
• Billing details: subscription plan and status. Card details are handled by our payment provider, Polar — we never receive or store your card number.
• Usage and technical data: IP address, timestamps, and request logs, used for security, abuse prevention, and rate limiting.

From your clients (via the no-login upload link)

• Contact details your firm enters about them (such as name and phone number or email) so we can deliver the request and reminders.
• The documents they upload and the answers they type into the request.
• File metadata: filename, file type, size, a checksum, and upload time.
• Message delivery status (for example, whether a WhatsApp message was delivered or read).

On this marketing website

This website (usechasedocs.com) runs no analytics, no advertising trackers, and no tracking cookies. The only thing stored in your browser is a local preference remembering whether you chose light or dark mode. It never leaves your device and is not linked to you.

3. How your clients' documents are handled

This is the part that matters most, so we will be specific.

• If you connect your own cloud storage (Bring Your Own storage). Uploads are routed directly into your own connected storage — currently Google Drive, into a folder we create called “Collecto Uploads”. ChaseDocs stores only a reference (a pointer to the file), plus metadata and the validation result. We do not keep a copy of the document. The file of record is always yours, in your own account, under your control.
• If you have not connected your own storage. Files are held in an access-restricted ChaseDocs storage bucket as a zero-configuration fallback, and are automatically deleted after a short retention period (14 days by default).
• The AI check. To validate a document, we make a temporary copy in memory, send it to our AI provider for the check, and discard it as soon as the check finishes. It is not written to disk by us and is not retained after processing.
• We never place document contents or personal data on any public or immutable store (including any blockchain).
• We do not sell personal data, and we do not use your clients' documents for advertising.

4. How we use data

• To provide the service: creating requests, delivering upload links, receiving uploads, and showing you results.
• To send request messages and reminders through your chosen channel.
• To run the AI validation check (document type, period, readability, completeness) and suggest a filename.
• To take payment and manage subscriptions.
• To keep the service secure: authentication, rate limiting, abuse prevention, and an audit log of key actions (our audit log deliberately records actions, not document contents).
• To provide support when you contact us.

5. AI processing

Uploaded documents are analysed by Anthropic's Claude models to check whether the document is the right type, covers the right period, is readable, and is complete. Content sent for validation is used solely to produce that result and is not used to train AI models. The result is advisory only — a human at your firm always reviews and decides whether to accept or reject an item.

6. Service providers (subprocessors)

We rely on a small number of providers to run ChaseDocs. Each only receives what it needs:

Provider	Purpose	What it may process
Supabase	Database, authentication, fallback file storage	Account data, request/file metadata, fallback files
Railway	Application hosting	Traffic and application data in transit
Anthropic	AI document validation	A transient copy of an uploaded document
Polar	Payments (merchant of record)	Billing and payment details
Meta (WhatsApp Business Platform)	Message and reminder delivery	Recipient phone number and message content
Google (Drive API)	Bring-Your-Own storage, only if you connect it	Uploaded files, written into your own Drive

When you connect Google Drive, we request the minimum permission needed (drive.file), which lets us access only the files ChaseDocs itself creates — we cannot see the rest of your Drive.

7. How long we keep data

• Files in the ChaseDocs fallback bucket: automatically deleted after the retention period (14 days by default).
• Files in your own connected storage: kept until you delete them. We never delete files from your cloud storage, including when you disconnect.
• Metadata, validation results, and audit records: retained while your account is active, so you have a record of what was requested and reviewed.
• Account and billing records: retained while your account is active and afterwards where we must for legal, tax, or accounting reasons.
• Upload links: expire automatically. We store only a cryptographic hash of each link token, never the link itself.

8. Security

• Encryption in transit (HTTPS) and encryption at rest for stored data.
• Storage credentials for your connected cloud are encrypted before being stored.
• Upload links are single-purpose, expiring, and stored only as a hash.
• Database access is restricted per organisation, so one firm cannot read another's data.
• Rate limiting, file-type restrictions, and security headers to reduce abuse.
• An append-only audit log that records actions without recording document contents.

No system is perfectly secure, but minimising what we hold is our main protection: for firms using their own cloud storage, we simply do not have the documents.

9. Your rights

As an Indonesian company we are subject to Indonesia's Personal Data Protection Law (Law No. 27 of 2022). Depending on where you live — including under Singapore's and Malaysia's Personal Data Protection Acts (PDPA) — you may have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Request deletion of your data.
• Withdraw consent, or object to or restrict certain processing.
• Receive a copy of your data in a portable format.

To exercise any of these, email dev@inpresencelab.com. We will respond within the period required by applicable law.

If you are a client of a firm that uses ChaseDocs (that is, you were asked to upload documents), please contact that firm first — they decide what is collected and why. We will support them in responding to you.

10. International transfers

We operate from Indonesia and our providers may process data in other countries. Where data is transferred across borders, we rely on the safeguards offered by those providers and take reasonable steps to ensure a comparable standard of protection.

11. Children

ChaseDocs is a business tool and is not directed at children. We do not knowingly collect personal data from children. If you believe a child's data has been provided to us, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the product develops. We will change the “last updated” date above, and for significant changes affecting your rights we will notify account holders directly.

13. Contact us

PT Web Industri Teknologi (trading as InPresenceLab)
A limited liability company incorporated in Indonesia
Kediri, Jawa Timur, Indonesia
Privacy questions and data requests: dev@inpresencelab.com