Legal documents

Privacy policy

This policy informs users of docult.com, app.docult.com and the Docult Chrome extension about how personal data is collected, used and protected, in accordance with the GDPR.

Data controller

Docult (Dikio SASU), 6 rue de Saint-PĂ©tersbourg, 75008 Paris, France — SIRET 921 491 775 00018. Contact: contact@docult.com. Data Protection Officer (DPO): Gary Haas — dpo@docult.com.

Data collected

  • User account: name, email address, company name, password (hashed).
  • Documents: files (PDF, Word, Excel, images, text) submitted for pseudonymisation or reversible redaction.
  • Technical data: IP address, browser type, pages visited, security logs.
  • Payment: banking details processed by Stripe (Docult does not store card numbers).

Docult Chrome extension

The “Docult — Occultation navigateur” extension (Chrome Web Store) processes the following data solely to provide redaction services synced with your Docult account:

  • Local Chrome storage (chrome.storage.local): authentication tokens, minimal user profile (name, email), “remember email” preference, workflow session state. This data stays on your device until logout or uninstall.
  • Documents: files you upload in the popup or side panel are sent over HTTPS to Docult servers (api.legalfab.agency) for analysis, redaction or de-redaction. They are not sold or used to train AI models.
  • Supported AI chat sites (Claude, ChatGPT, Copilot, Mistral, Grok): the extension injects a Docult UI to attach redacted documents. It does not extract your conversation content; it interacts with the page only for file attachment features you trigger.
  • No resale: Docult does not sell or rent data processed via the extension to advertising third parties.

Processing purposes

  • Account creation and management, contract performance (terms of use/sale).
  • Document pseudonymisation and reversible redaction.
  • Billing and customer support.
  • Security, fraud prevention and service improvement.

Retention periods

  • Account data: until account closure + 1 year (archiving).
  • Documents: until deleted by the user or account closure.
  • Payment data: 5 years (legal requirement).
  • Technical logs: 1 year.

Sub-processors and transfers

Docult uses sub-processors bound by data protection agreements: OVHcloud (hosting, France), Stripe (payments, United States — standard contractual clauses), and analytics providers where applicable. Transfers outside the EU rely on EU-approved SCCs. A copy can be requested at dpo@docult.com.

Security

TLS encryption in transit, restricted data access, encrypted backups. In the event of a breach likely to result in high risk, Docult will notify the CNIL and affected individuals within legal time limits.

Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection. To exercise them: dpo@docult.com or Docult — DPO, 6 rue de Saint-PĂ©tersbourg, 75008 Paris, France. Response within 1 month. Complaint to the CNIL: www.cnil.fr.

For site cookies, see our cookie policy.

Last updated: June 2026