This policy explains what information DociToci handles, why, who else receives it, how long it is kept and how to have it deleted. It covers the website docitoci.com and the DociToci service, including its connection to the WhatsApp Business Platform.
1.Who we are
DociToci is software that lets a company's staff ask questions of the company's own documents, email and WhatsApp chats. DociToci is based at Office # 01, 184-C Airline Society, Lahore, Punjab, Pakistan. You can reach us about anything in this policy at hello@docitoci.com or on +92 331 4430 965.
2.Our two roles
- Our website and our own contacts. When you visit docitoci.com or write to us, we decide what happens to that information.
- Inside the DociToci service. A business (our customer) connects its own files, mailboxes and WhatsApp numbers. That business decides what is connected, which of its people can read what, and how long it is kept. We handle that data only to run the service for the business and on its instructions. If you deal with such a business, its own privacy notice applies to you as well.
DociToci runs either on a server the business operates itself, or on a server we operate for the business. When the business runs its own server, its data stays there and does not reach us, unless the business gives us access to help with support.
3.Information from this website
- Server logs. Our website host, Netlify, records the IP address, browser and pages requested, to deliver the site and keep it secure.
- Fonts. The pages load fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address.
- No tracking. docitoci.com itself sets no cookies and uses no analytics or advertising trackers.
- Videos. The tutorial videos in our guide are hosted on YouTube. A video is loaded from YouTube (youtube-nocookie.com) only when you click to play it; YouTube then receives your IP address, and Google's privacy policy applies to what it collects.
- Email. If you write to hello@docitoci.com, we keep your message and address to reply to you and to arrange a demo.
4.Information in the DociToci service
- Accounts: name, work email address, role and company, the password (stored only as a one-way hash) and sign-in sessions.
- Content the business connects or uploads: documents and the text read from them, emails from connected mailboxes (with senders, recipients, dates and attachments), and WhatsApp messages (see section 5).
- What people do in the service: questions asked in Chat and their answers, feedback on answers, replies drafted and messages sent, and an audit log of actions with the time, the person and their IP address.
- Connection details: sign-in tokens and mailbox passwords for connected sources, stored encrypted.
- Signing up and paying online: the company name, and the person's name, work email, phone, city and country given on the sign-up form; for each payment, the transfer date, the bank's transaction number and the receipt uploaded. We use them to confirm the email address, start the trial, confirm payments, and send reminders before a trial or a paid period ends.
- Usage counts: how many AI requests each person and company makes, used to apply monthly allowances.
- Dictation: speech is turned into text on the DociToci server, and the recording is not kept.
5.WhatsApp Business Platform data
A business can connect a WhatsApp Business number to DociToci through Meta's WhatsApp Business Platform. DociToci then receives:
- About the business's WhatsApp account: the WhatsApp Business Account ID, the phone number ID, the display number, the verified business name, and the access token Meta issues for that account. The token is stored encrypted.
- About its conversations: the content of messages sent and received on that number (text, and attachments such as images, documents and voice notes); each contact's phone number and WhatsApp profile name; names saved in the business's contacts; the time of each message; whether it was delivered and read; and edits and deletions.
- Earlier chats, only if the business chooses to share its chat history when connecting: Meta then sends one-to-one chats from up to the last 180 days.
Group chats are not received.
How we use it
Only to provide DociToci to that business:
- to show the chats to the people the business has allowed to read them;
- to make the chats searchable and let Chat answer questions from them;
- to list conversations that are waiting for a reply;
- to draft replies for staff to review; and
- to send messages that a member of staff has reviewed and chosen to send. DociToci never sends a WhatsApp message on its own.
We do not sell WhatsApp data, use it for advertising, share it with data brokers, or use it to build profiles of the people who message the business. We do not use it to train AI models.
How long it is kept
- Each notification from Meta is kept as received for 7 days after it has been processed (30 days if processing failed), so that errors can be recovered.
- Messages are kept until the business disconnects the number or deletes them.
- When a number is disconnected, its messages and contact details are deleted straight away. The daily chat documents are kept or moved to the Trash, as the person disconnecting chooses.
6.How AI is used
DociToci uses an AI model to answer questions, draft replies, summarise orders and read dates. The business chooses where that model runs:
- On the DociToci server itself. Nothing leaves the server.
- A paid cloud AI service from Google (Gemini), OpenAI or Anthropic (Claude). The passages needed for each answer or draft are sent to that service to produce it. We use these services only on paid business terms, under which the provider does not train its models on the data. Free tiers are never used for customer data.
Search, reading scans (OCR) and dictation always run on the DociToci server.
AI answers can be wrong. DociToci lists the sources behind every answer so that people can check them.
8.How long we keep information
- Website logs: for as long as Netlify keeps them.
- Emails to us: for as long as we need them to deal with your enquiry or our business relationship.
- Service data: for as long as the business uses DociToci, unless the business deletes it sooner. When a business stops using a server we operate, we delete its data within 30 days.
- Backups on servers we operate are kept for up to 90 days and then overwritten, so deleted data leaves the backups within that time.
9.How we protect it
- All connections use HTTPS.
- Tokens and passwords for connected accounts are encrypted. User passwords are stored only as one-way hashes.
- Each business's data is kept separate from every other business's, and folder access decides who inside the business can read what.
- Off-site backups are encrypted.
- Actions in the service are recorded in the business's audit log.
10.Deleting your data
The Data deletion page explains each way to have data deleted, step by step. In short: people at a business that uses DociToci can disconnect sources and delete documents themselves, and anyone can email hello@docitoci.com with the subject Data deletion request.
11.Your rights
Depending on where you live, you may have the right to ask for a copy of your personal data, to have it corrected, or to have it deleted. Email hello@docitoci.com. If your data is in DociToci because a business connected it, we will pass your request to that business within 7 days and help it respond.
12.Children
DociToci is a service for businesses and institutions. It is not meant for children, and we do not knowingly collect children's personal data through this website.
13.Changes to this policy
When we change this policy, we will publish the new version on this page with a new effective date, and tell businesses that use DociToci about significant changes by email.
14.Contact
DociToci
Office # 01, 184-C Airline Society, Lahore, Punjab, Pakistan
Email: hello@docitoci.com
Phone: +92 331 4430 965