Privacy Policy

Effective date: February 28, 2026

1. Introduction

This Privacy Policy describes how AlberaMarc ("we", "us", "our") collects, uses, and protects your information when you use the DocForge API ("the Service") at docforge-api.vercel.app.

We are committed to protecting your privacy. This policy explains what data we collect, why we collect it, and your rights regarding that data.

2. Information We Collect

2.1 Document Content

When you use the API, you submit documents for format conversion. This content is processed entirely in memory and is not stored, logged, or retained after the response is returned. We have no mechanism to access, retrieve, or review your document content after processing.

2.2 Account Information

If you subscribe to a paid tier, we collect:

• Email address — for account identification, billing communications, and service notices
• Payment information — processed and stored by Stripe (our payment processor); we do not store your full card number or bank details

2.3 API Usage Metrics

We collect aggregate usage data to enforce rate limits and monitor service health:

• Number of API requests per day (per API key or IP address)
• Endpoint accessed (e.g., /api/md-to-html)
• Response status codes and latency
• Request timestamps

This data does not include the content of your documents.

2.4 Automatically Collected Information

When you visit our website or use the API, our hosting provider (Vercel) may automatically collect:

• IP address
• Browser type and version (for website visits)
• User-Agent header (for API requests)

3. How We Use Your Information

We use the collected information to:

• Provide and maintain the Service
• Enforce rate limits and prevent abuse
• Process billing and manage subscriptions
• Send service-related communications (outage notices, billing issues, security alerts)
• Monitor and improve service performance and reliability

We do not use your information for advertising, profiling, or selling to third parties.

4. Data Retention

• Document content: Not retained. Processed in memory only and discarded immediately after the response is sent.
• API usage metrics: Retained for up to 90 days for rate limiting and operational monitoring, then deleted.
• Account and billing data: Retained for the duration of your account plus 12 months after cancellation, as required for financial record-keeping.
• Server logs: Retained by Vercel per their data retention policies (typically up to 30 days).

5. Third-Party Services

The Service relies on the following third-party providers, each with their own privacy policies:

• Stripe (stripe.com/privacy) — payment processing for paid tiers. Stripe processes and stores your payment information directly.
• Supabase (supabase.com/privacy) — authentication and account management.
• Vercel (vercel.com/legal/privacy-policy) — hosting and serverless function execution. Vercel processes your API requests.

We do not share your data with any other third parties except as required by law.

6. Cookies

The DocForge API website and service use minimal cookies:

• Essential cookies: Session management for authenticated users (paid tiers). These are strictly necessary for the Service to function and cannot be disabled.
• No tracking cookies: We do not use analytics cookies, advertising trackers, or any third-party tracking pixels.
• No cookie consent banner: Because we only use essential cookies, no consent banner is required under most regulations.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

7.1 Under GDPR (EU/EEA Residents)

• Right of access — request a copy of your personal data
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data
• Right to restriction — request limitation of processing
• Right to data portability — receive your data in a structured format
• Right to object — object to processing of your personal data

7.2 Under CCPA (California Residents)

• Right to know — request disclosure of what personal information we collect
• Right to delete — request deletion of your personal information
• Right to opt-out — we do not sell personal information, so this right is automatically satisfied
• Right to non-discrimination — exercising your rights will not affect your service quality or pricing

To exercise any of these rights, contact us using the information in Section 10 below. We will respond to requests within 30 days.

8. Data Security

We implement reasonable technical and organizational measures to protect your information, including:

• All data transmitted to and from the API is encrypted via TLS (HTTPS)
• API keys are hashed and stored securely
• Access to infrastructure and databases is restricted and logged

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.

9. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that we have collected such information, we will delete it promptly.

10. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

GitHub Issues

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.