DocVerita Privacy Policy

Effective Date: July 4, 2026

DocVerita ("DocVerita," "we," "us," or "our") is a Chrome extension and hosted web service operated by Viking Veritas, a California sole proprietorship. This Privacy Policy explains what information we collect, how we use it, when we share it, how long we retain it, and the choices available to users of DocVerita.

DocVerita is currently offered only to users in the United States.

1. Who We Are

DocVerita is a verification tool that checks AI-generated text against documents you provide and returns a claim-by-claim result such as Supported, Partially Supported, Ambiguous, Contradicted, or No Evidence Found.

If you have questions about this Privacy Policy or about DocVerita's privacy practices, you can contact us at: docverita@outlook.com

2. Information We Collect

2.1 Account Information. When you sign in using Google or Microsoft authentication, we create and maintain an account record that may include:

• Your email address.
• A unique identifier from your identity provider (Google or Microsoft), used to recognize your account on future sign-ins.
• Your subscription status, plan tier, monthly usage count, and related account settings.
• Billing identifiers from Stripe, such as customer ID, subscription ID, price ID, cancellation status, and related billing metadata.
• Account creation and last-login timestamps.

We do not receive or store your full payment card number or other full payment credentials. Those are handled by Stripe.

Signing in with Google and signing in with Microsoft are treated as separate accounts, even if the same email address is used for both.

2.2 Text, Documents, Claims, and Verdicts You Submit. When you use DocVerita, you may paste or upload AI-generated text and upload source documents for checking. That content may include:

• The text you submit for review.
• The documents you upload, including PDF, Word, and text files.
• Claims extracted from your submitted text.
• Verdicts, citations, and related verification outputs generated during your session.

On DocVerita's own servers, this content is processed ephemerally and is not stored in the persistent account database in the ordinary course: it exists only in server memory for the duration of your active session, and is automatically and permanently erased after 60 minutes of inactivity (or sooner, if you clear it yourself). Even our internal diagnostic logging (used to catch and investigate rare failures in our AI provider's responses) never writes the actual text of your claims, quotes, or documents to disk — that diagnostic path records only non-reversible structural facts, described further in Section 2.3.

2.3 Technical and Usage Information. We may process limited technical information needed to operate and protect the service, including:

• IP address information used to detect and temporarily block repeated failed sign-in attempts.
• Standard operational logs generated by our hosting providers and infrastructure.
• Limited structural diagnostic information about certain failures, such as non-reversible hashes, lengths, and which validation check failed, but not the readable document or claim text itself.

We do not use cookies, browser fingerprinting, or any third-party analytics or advertising trackers for tracking, analytics, or advertising, in either client application or on our backend. The web application sets one essential, functional cookie to keep you signed in (an HttpOnly, Secure, SameSite=Lax session cookie holding your authentication token, readable only by our own server, never by page scripts or third parties); the browser extension does not use a cookie for this and instead stores its own equivalent token locally, within the browser's own extension storage. Google or Microsoft may separately set their own essential cookies when you choose to sign in through them, governed by their own privacy policies.

2.4 Optional Files You Export Locally. DocVerita allows you to generate certain exports in your browser, such as Verdict Snapshots and embedding-cache sidecar files. These optional exports are created locally and saved to your device at your direction. We do not receive, store, or control those exported files unless you separately choose to upload them back into the service later.

2.5 Feedback You Choose to Submit. If you submit verdict feedback or product feedback, we collect the information you choose to submit in those feedback forms, including any free-text comments you provide.

3. How We Use Information

We use information we collect to:

• Authenticate you and maintain your account.
• Provide the verification service you request.
• Process billing, manage subscriptions, and enforce usage limits.
• Detect, prevent, and investigate abuse, fraud, misuse, or attacks on the service.
• Operate, maintain, improve, troubleshoot, and secure DocVerita.
• Communicate with you about your account or service-related issues, if necessary.
• Collect and review user feedback you voluntarily submit.

We do not use the content of your documents or pasted text to train our own AI models, or any other AI model.

4. Cookies and Similar Technologies

The web application uses a strictly necessary authentication/session cookie to keep signed-in users authenticated securely. The server sets an httpOnly, Secure, SameSite=Lax cookie for the web app, and the token is not exposed to client-side JavaScript. The browser extension does not use this cookie mechanism at all — see Section 2.3 for how it keeps you signed in instead.

We do not use advertising cookies or third-party analytics trackers in DocVerita, and we do not use cookies, or any other means, to build advertising profiles.

5. Third Parties and Service Providers

We share information only as needed to operate DocVerita and only with service providers performing services on our behalf.

5.1 Identity and Billing Providers

• Google and Microsoft provide authentication services used to sign users into DocVerita.
• Stripe processes subscription payments, billing, and related payment-method handling.

5.2 AI and Retrieval Providers

• Anthropic receives claim text and relevant document excerpts needed to perform certain verification steps. Per Anthropic's published Commercial Terms of Service, which govern DocVerita's use of their API, this content is not used to train their models.
• Voyage AI receives document and claim text used to create numerical embeddings for retrieval. Our account is opted out of Voyage's model-training license: content submitted since that opt-out took effect is not used for training and is deleted immediately after processing. This opt-out is not retroactive to anything submitted before it took effect, and Voyage separately collects standard operational/usage metadata about API calls, distinct from the actual content itself, per their own terms.

5.3 Hosting and Infrastructure Providers

• Railway hosts the backend services and supporting infrastructure.
• Postgres is used as the persistent store for account, subscription, and usage data.
• A self-hosted ClamAV service is used to scan uploaded files for malware before processing.

5.4 Waitlist Form Processing. DocVerita uses FormSubmit.co to process waitlist signup form submissions. When you submit the waitlist form, your submission data — including your email address and any optional fields you complete (name, role or profession, and individual or organization type) — is transmitted to and temporarily processed by FormSubmit.co's servers before being delivered to us by email.

• FormSubmit.co retains pending or unconfirmed submissions for up to 30 days according to their stated practices.
• FormSubmit.co uses Google reCAPTCHA for spam prevention. reCAPTCHA traffic is subject to Google's Privacy Policy and Terms of Service.
• FormSubmit.co states it will not disclose collected data to third parties except as needed to provide its service or as required by law.
• FormSubmit.co's privacy practices are described at formsubmit.co/privacy.pdf.

FormSubmit.co does not currently publish a data processing agreement. DocVerita's use of FormSubmit.co is limited to pre-launch waitlist collection. If you have questions about how your waitlist submission is handled, contact us at docverita@outlook.com.

5.5 How Data Flows Through the Service. To explain this plainly:

1. DocVerita's servers: document content, extracted claims, and verdicts are intended to remain ephemeral on our own systems and are not stored in the persistent account database in the ordinary course (see Section 2.2).
2. Anthropic: receives the claim text and relevant document excerpts necessary for certain verification steps.
3. Voyage AI: receives document and claim text necessary to generate embeddings used for retrieval.
4. Stripe, Google, and Microsoft: receive the account or transaction information needed to provide authentication and billing services.
5. ClamAV and hosting infrastructure: process uploaded files and related technical data needed to keep the service secure and operational.
6. FormSubmit.co: receives waitlist form submission data (email address and optional profile fields) and forwards it to us by email. See Section 5.4 above.

We do not sell your personal information.

6. Data Retention

• 6.1 Session Content. Document content, pasted text, extracted claims, and verdicts on our own systems are designed to be removed automatically after a period of inactivity. Session-based content uses in-memory storage with cleanup after inactivity, and is automatically erased after 60 minutes of inactivity. This doesn't apply to a Verdict Snapshot or embedding sidecar you've chosen to export — those files were never on our servers to begin with; they exist only on your own device, for as long as you keep them there (see 2.4).
• 6.2 Account and Billing Data. Account, subscription, and billing-related information are retained for as long as your account is active and for a reasonable period afterward as needed for legitimate business, tax, accounting, fraud-prevention, or legal purposes, unless and until deleted through your account controls or otherwise removed under our retention practices.
• 6.3 Abuse-Prevention Data. IP-address-based abuse-prevention data may be held in memory for a limited period (no longer than 24 hours of inactivity from that address) and may also appear in provider operational logs subject to those providers' own retention practices.
• 6.4 Trial-Abuse Prevention Record. If an account actually used a trial and is later deleted, we may retain a one-way cryptographic hash of the underlying identity-provider identifier solely to prevent that same identity from repeatedly claiming additional trials by deleting and recreating accounts. This is a SHA-256 hash of the provider ID, not an email address, and not something reversible into readable identity data — it is not linked to any other data we hold. If an account never used a trial, no such trial-abuse hash is intended to be retained.
• 6.5 Saved Payment Method During a Trial. Starting a $3 trial saves your payment method with our payment processor, Stripe, for the duration of that trial (active or dormant), so that if you later take the explicit, affirmative action to convert to a paid subscription, we don't need to ask you for payment details again. This never authorizes a further charge on its own — we only ever charge it when you take that explicit conversion action. Like other billing data, this is held by Stripe under its own terms, not directly by us.
• 6.6 Feedback Data. Feedback you choose to submit may be retained so we can review and act on it, operate the product, and maintain records of product feedback.

7. Your Choices and Account Controls

DocVerita provides the following account controls:

• Cancel Subscription: You can stop future billing while keeping your account, and your paid access continues through the end of the current billing period. You can resume before then from the same menu, or resubscribe later.
• Resume Subscription: If cancellation is scheduled for period end, you can resume before the current billing period ends.
• Change Plan: You can change plans through the product's account controls, with upgrades taking effect immediately (charged a prorated amount for the difference) and downgrades taking effect at the next billing period.
• Delete Account: You can permanently delete your account through the product's account controls. Deletion removes the account row and related account data from the persistent users table and immediately cancels any active Stripe subscription. If you've started a trial, the only thing that persists is the one-way cryptographic hash described in Section 6.4; if you never started a trial, nothing persists at all.
• If your $3 trial simply ends without you converting: your account is not deleted and nothing is charged. It goes dormant — the same as before you ever started the trial, except the $3 credit you already paid for remains available. We show you an in-app reminder as your trial nears its end, but taking no action is always safe: converting to a paid subscription always requires you to take an explicit, affirmative action, never something that happens automatically. If you later decide you do want to subscribe, you can do so at any time with the $3 credit still applied, without recreating your account or redoing setup.
• Accessing your data: Since document content is never stored on our systems in the ordinary course, there is nothing to request from us beyond your account record itself, which we can provide on request. If you've downloaded a Verdict Snapshot or embedding sidecar (see 2.4), those files are already your own copy, stored on your own device under your control.

If you have trouble using these controls, you can contact us at docverita@outlook.com.

8. California Privacy Disclosures

8.1 CalOPPA Disclosures. California's Online Privacy Protection Act requires operators of online services collecting personally identifiable information from California consumers to disclose categories of information collected, categories of third parties with whom the information may be shared, the process for reviewing or requesting changes to information if such a process exists, how users are notified of material changes, and the policy's effective date. This Privacy Policy is intended to provide those disclosures for DocVerita.

8.2 Reviewing or Requesting Changes. DocVerita does not currently provide a general self-service profile-editing workflow for all stored account fields. Where account changes or deletion are supported through the product, those controls are available in the account area (see Section 7). You may also contact docverita@outlook.com regarding your account information.

8.3 Material Changes to This Policy. If we make material changes to this Privacy Policy, we will update the effective date and make reasonable efforts to notify active users through the service or by other appropriate means.

8.4 Do Not Track. DocVerita does not track users across third-party websites over time for advertising purposes, and does not use the service to build cross-site behavioral profiles. Because DocVerita does not engage in that kind of cross-site tracking, Do Not Track browser signals do not change the service's behavior.

8.5 CCPA/CPRA Threshold Note. The California Consumer Privacy Act and California Privacy Rights Act apply only to businesses that meet specified statutory thresholds, such as revenue or volume thresholds. This Privacy Policy is not intended as an admission that DocVerita is currently subject to CCPA/CPRA if the applicable statutory thresholds are not met.

9. Security

We use measures designed to protect information and operate the service securely, including encrypted connections (HTTPS) between your browser or extension, our servers, and every third-party service we use, along with authentication controls, abuse-prevention measures, file-type validation, malware scanning, and resource-isolated document processing. No method of transmission, storage, or processing is completely secure, and we cannot guarantee absolute security.

10. Children's Privacy

DocVerita is not directed to children and is not intended for use by anyone under 18.

11. United States Only

DocVerita is currently offered only to users in the United States. If you access the service from outside the United States, you do so at your own initiative and understand that information may be processed and stored in the United States and by service providers used by the service.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date above and, for material changes, make reasonable efforts to notify active users.

13. Contact

Questions about this Privacy Policy may be sent to: docverita@outlook.com