Privacy Policy

This policy explains how Cyberdune Technologies Private Limited, trading as Docket (“Docket”, “we”, “us”), collects and uses personal data when you visit our website, use the free AI visibility preview, contact us, or use the Docket service. It should be read with our cookie policy, security page, sub-processor list and, for business customers, the data processing addendum.

In this policy:

• Service means the Docket application and its related websites.
• Website means a business or brand you set up in Docket, together with the internet site it publishes to.
• Workspace means the place where a customer’s websites live, and team means the people who have access to that workspace.
• Customer content means everything you or your team put into Docket, or ask Docket to read or produce, for your websites.

Docket is built and operated by Cyberdune Technologies Private Limited, a private limited company incorporated in India. Docket is a product of Cyberdune Technologies Private Limited, not a separate company.

Cyberdune Technologies Private Limited acts in two roles:

• As a controller for account data about you and your team, enquiries sent to us, visitors to our website and users of the free preview, and the security and operational records we keep about the service.
• As a processor for personal data contained in customer content. There, the customer decides what goes in and why, and we act on the customer’s instructions under the data processing addendum. If you are a person named in a customer’s content, please contact that customer first; we will help them respond.

Our EU and UK representative, if one is required, is EU/UK representativeTBC (to be confirmed). Our data protection contact is DPO, if appointedTBC (to be confirmed), and you can always reach us at support@docket.ltd.

Account and Team Data

Your email address, your name if you provide it, your password (stored by our authentication provider as a hash, never in readable form), an optional profile photo, and your role in a workspace (Owner or Member). If you sign in with Google, we receive your name, email address and profile photo from Google. When you invite someone to your team, we store their email address and the invitation, which expires after 14 days. Our authentication provider also records sign-in events, such as the time of sign-in and the IP address used.

Profile photos are kept in a storage area that is publicly readable by link, so that they can be shown in the product. Do not upload a photo you would not want others to see.

Website and Business Information

The details you enter for each website: its name, address, industry, description, brand rules, audience notes, SEO targets, competitors, publishing settings and brand safety rules. When you add a website, Docket reads your homepage and up to four other pages on the same site (up to 12,000 characters of text in total) and copies up to six sentences word for word as voice samples. This is mostly information about a business, but it can include personal data, for example the name of an owner or a member of staff.

Customer Content

Topics, briefs, articles and their saved versions (up to 20 per article), generated images, Vault items (facts, boilerplate, quotes, links, rules and uploaded files up to 20 MB), tracked AI visibility questions and the answers recorded for them, page audits, and any reviews or sources Docket finds about your business. Any of these may contain personal data if you or the public web put it there.

Google Search Console and Google Analytics Data

Only if you connect a Google account to a website. Docket requests these Google permissions and no others: openid, userinfo.email (to show which Google account is connected), webmasters.readonly and analytics.readonly. All are read-only. With them, Docket reads:

• From Search Console: clicks, impressions, click-through rate and average position, by date, page and search query.
• From Google Analytics 4: sessions, total users and engagement rate, sessions by landing page, and per-page views, users, bounce rate, engagement duration and sessions.

These are aggregated reports. Docket does not read conversions or key events and does not receive data about individual visitors to your site. The Google access and refresh tokens are encrypted at rest. Disconnecting Google in Docket asks Google to revoke the token and deletes the stored connection.

Docket’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google data is used only to provide the features you use in Docket (including by sending some of it to our AI provider as described in section 5), and is never used for advertising or sold.

WordPress Credentials

If you connect a WordPress site, we store its address, the WordPress username and an application password you create in WordPress. Application passwords can be revoked in WordPress at any time without changing your main password. The password is encrypted at rest with AES-256-GCM, is not readable by the browser, and is decrypted only on our servers when Docket publishes or checks the connection.

Enquiries and the Free Preview

If you use a contact or demo form, we collect your email address and anything else you choose to give (name, company, website, role, team size and message), whether you agreed to hear from us, the page you came from, the referring page and campaign tags, your browser’s user agent, and a shortened form of your IP address (the last part is removed so it no longer identifies a device). If you use the free preview at /preview, we receive the domain you enter and use your IP address to limit checks to five per hour. The preview does not save results to our database; they are held in server memory for up to six hours.

Usage and Technical Data

An activity log for each website (for example, when an article was generated, published or scheduled, or when a connection changed), counts of AI requests used for spend limits, and server logs, which can include IP addresses, request details and error messages. A few preferences are also kept in your own browser; see the cookie policy.

Payment Data

None. Docket has no online checkout or payment processor. Fees are agreed and invoiced directly under each customer’s agreement, and billing contact details are handled as part of that agreement.

Where the UK GDPR or the EU GDPR applies, we rely on the following lawful bases. Where we process customer content as a processor, the customer is responsible for the lawful basis.

We do not sell personal data, share it for cross-context behavioural advertising, or use it to make decisions that have legal or similarly significant effects on you. We do not currently send marketing email.

Docket uses a third-party AI model provider to generate and check content. You do not need an account with any AI provider: requests are made under Docket’s own account.

To provide the service, Docket sends our AI provider:

• For setup: text read from your site and the details you enter, so it can suggest your brand details, audience, competitors and categories.
• For planning and writing: your website’s details, brand rules, relevant Vault material, recent titles, the addresses of your existing pages, and Search Console queries and page figures, so that topics and articles fit your business.
• For images: descriptions derived from the article, to generate a hero image and up to two body images.
• For research, reviews and AI visibility: questions and search terms derived from your website. These searches run on the public web and return answers and sources.
• For checks and audits: drafts, your website’s details (for the optional fact check) and the text of pages being audited.
• For the free preview: the title, description and first headings of the homepage of the domain entered.

Training. Docket does not train any AI model, and does not use customer content to train one. Our AI provider’s terms state that, by default, it does not use data sent to it by Docket to train its models. It may keep inputs and outputs for a limited period under its own data retention policy, for example to monitor for abuse. See the sub-processor list for details.

Accuracy. AI output can be wrong. Docket drafts; a person decides what is published. Docket never publishes on its own.

We share personal data only with the service providers we use to run Docket, each for a specific purpose. The categories, with what each receives, are on the sub-processor list. In summary:

• Cloud hosting providers: running and delivering the application, including the Google sign-in flow.
• A managed database provider: database, authentication and file storage.
• An AI model provider: AI text, images and web search, as described above.
• A transactional email provider: sending service emails.

You can ask us for the names of these providers at support@docket.ltd.

Fonts are served from Docket’s own servers, so no font provider receives your IP address when a page loads.

At your direction. When you connect Google, Docket reads your data from Google. When you publish, Docket sends the article, images and SEO fields to your WordPress site. Those services are run under your own agreements with them.

Within Docket. Everyone in a workspace can see every website in it. Authorised Docket administrators can read customer data where needed to support you and operate the service.

We may also disclose data if the law requires it, to protect rights and safety, or to a buyer or successor if our business is sold or reorganised, in which case this policy will continue to apply.

Our main database and file storage are hosted in hosting regionTBC (to be confirmed). Some of our providers process data in other countries, including the United States. Where personal data leaves the UK or the European Economic Area for a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful mechanism.

The transfer mechanism for each provider is transfer mechanismsTBC (to be confirmed). You can ask us for the location of each provider and a copy of the relevant safeguards.

• Account, website and customer content: while your account is active. Deleting a website deletes its articles, connections, analytics records and activity log entries. Article versions are limited to the latest 20 per article.
• After an account is closed: deleted within account deletion periodTBC (to be confirmed). To close an account, email support@docket.ltd; account deletion is carried out by our team.
• Backups: deleted data may remain in backups for up to backup retention periodTBC (to be confirmed) before it is overwritten.
• Enquiries: enquiry retention periodTBC (to be confirmed).
• Server logs: log retention periodTBC (to be confirmed).
• Free preview: results are held in server memory for up to six hours and IP addresses for up to an hour; neither is written to our database.
• Generated image links: images stored in Docket are shared by signed links that expire after one year. Images you publish are copied into your own WordPress media library.
• Data held by our AI provider: kept under that provider’s own retention policy.

We may keep data for longer where the law requires it or to deal with a legal claim.

Customer data is isolated per workspace, so a signed-in user can only reach the websites of workspaces they belong to. Credentials are encrypted at rest, Google access is read-only, and data travels over HTTPS. No system is completely secure. The measures we use are described on the security page. If a personal data breach is likely to put you at risk, we will tell you and the relevant regulator as the law requires.

UK and EU

Under the UK GDPR and the EU GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time where we rely on consent. You can object at any time to processing based on legitimate interests. We will reply within one month, which the law allows us to extend in some cases.

You can also complain to a data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk); in the EU, it is the authority where you live or work. We would appreciate the chance to resolve your concern first.

California and Other US States

If the California Consumer Privacy Act (as amended by the CPRA) or a similar state law applies, you have the right to know what personal information we collect, use and disclose, to access it, to have it corrected or deleted, and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information for purposes that would give a right to limit its use. The categories we collect are those described in section 3, from the sources described there, for the purposes in section 4. You may use an authorised agent, and we may need to verify your identity before we act on a request.

How to Use Your Rights

Many details can be changed in the product: edit your account and website settings, remove Vault items, delete a website, or disconnect Google and WordPress. For anything else, email support@docket.ltd.

Docket is a business service and is not directed at children. It must not be used by anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Docket’s own code sets no cookies. It uses your browser’s local storage and session storage to keep you signed in and to remember a few preferences. We do not use analytics or advertising cookies. The cookie policy lists every item.

We will update this policy when our practices change and show the new date at the top. If a change materially affects how we use your personal data, we will tell account holders by email or in the product before it takes effect.

Questions, requests and complaints about privacy: support@docket.ltd.