Privacy Policy
1. Who we are
Droqify is an intelligent document processing platform operated by SKIFIN IT SERVICES LLP, a limited liability partnership with its office at Galaxy Business Park, Sector 62, Noida, Uttar Pradesh 201301, India ("SKIFIN", "we", "us"). This policy covers droqify.com (the "Site"), the Droqify web application and API (the "Service"), and related communications.
Privacy contact: contact@skifin.com. Grievance officer and data protection contact: see section 17.
We are preparing for, and aligned with, India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (notified 13 November 2025). The core duties under that regime apply from 13 May 2027. Until then we do not claim to be compliant with it; we operate in line with the Information Technology Act, 2000 (section 43A) and the SPDI Rules, 2011, and, where relevant, the GDPR, UK GDPR, CCPA/CPRA, the UAE PDPL and HIPAA, as described below.
2. Our two roles
2.1 SKIFIN as controller
SKIFIN decides why and how personal data is used (is the "controller", "data fiduciary" or "business") for: website visitors; the contact form and email verification code; account, billing and contact details of customer personnel; security and audit metadata about use of the Service; and product telemetry. This policy describes that processing.
2.2 SKIFIN as processor
For the content our customers submit to the Service ("Customer Data": documents, extracted fields, summaries, chat sessions, corrections, and tenant schemas), SKIFIN acts only on the customer's instructions as processor (a "service provider" under the CCPA, a "data processor" under the DPDP Act and the UAE PDPL). The customer is the controller. That processing is governed by the customer's agreement with us, our Terms of Service, and a Data Processing Agreement (available on request; incorporated on signature) and, for HIPAA-regulated workloads on eligible plans, a signed Business Associate Agreement. If you are an individual whose data appears in a customer's documents, please contact that customer; we will assist them in responding to you.
2.3 Global Schema Contribution (opt-in)
A customer administrator may enable "Global Schema Contribution". It is off by default. When on, a sanitised schema structure (field names, types and descriptions, not documents or extracted values) is copied to a SKIFIN-operated store so that other tenants can reuse it. For that structure only, SKIFIN acts as an independent controller.
3. Data we collect, by source
3.1 Site visitors
- Contact form: name, company, business email, industry, enquiry type and message.
- Email verification code: to prevent abuse we email a 6-digit code to the address you enter and verify it with a signed, 10-minute token. The submitting IP address is included in the lead notification we receive.
- Server logs: IP address, browser type, referring URL and timestamps, kept for security and abuse prevention (30 days).
The Site uses no analytics, advertising pixels or tracking cookies.
3.2 Service users (customer personnel)
- Account data: email address, display name, role and group memberships, hashed password, optional Google sign-in identifier and profile picture URL, two-factor settings (if enabled), and terms-acceptance records.
- Security and audit metadata: audit events record user ID, action, resource identifier, client IP address, user agent and timestamp for sign-ins, lockouts, user, role, group and two-factor changes, and data access, modification and deletion. Audit events do not contain document content.
- Product telemetry: performance and error telemetry collected with Azure Application Insights and OpenTelemetry; PHI-masking filters are applied to logs.
- Billing and contact details: billing contacts, plan, usage (page counts) and invoice data. See 3.4 for online payments.
3.3 Customer Data (as processor)
Documents uploaded or received through the API, derived text, extracted fields, summaries, embeddings, chat sessions, user corrections, and tenant schemas and settings. These may contain personal data of any kind, including sensitive data, as determined by the customer. Customers must not submit regulated health data without a Business Associate Agreement (see Acceptable Use Policy).
3.4 Payments and billing
When you pay online, the payment is processed by Razorpay (Razorpay Software Private Limited and its group companies), our payment gateway. You enter your card, UPI or bank details directly on Razorpay's checkout. We do not receive or store your card number, expiry date, CVV or UPI credentials. Razorpay processes them under its own terms and privacy policy, and acts as an independent controller of payment-instrument data.
- What we send to Razorpay: the amount and currency, our invoice number, the billing contact's name and email address, and an order reference.
- What Razorpay sends back to us: a payment reference, the amount, the payment method type (for example card or UPI), the status of the payment, and refund status. We do not receive full card numbers.
- What we keep: invoices and credit notes (including your legal name, billing address, GSTIN where you give one, amounts and tax), payment references and payment receipts. Tax law requires us to keep GST records for 8 years.
4. Purposes and lawful bases
| Purpose | Data | Lawful basis (GDPR/UK GDPR); DPDP equivalent |
|---|---|---|
| Answer enquiries and demo requests; verify email | Contact form, OTP, IP | Legitimate interests; DPDP: consent / legitimate use (voluntary provision) |
| Provide and operate the Service; authentication; support | Account data | Contract |
| Transactional email (invites, password reset, welcome) | Account data | Contract |
| Security, abuse prevention, incident response, audit trail | Audit metadata, IP, user agent, logs | Legitimate interests; legal obligation (e.g. CERT-In Directions 2022) |
| Product reliability and improvement (telemetry) | Telemetry | Legitimate interests |
| Billing, online payment collection, receipts, tax (including GST) and accounting | Billing records, payment references | Contract; legal obligation |
| Processing Customer Data | Customer Data | Customer's instructions (SKIFIN as processor) |
| Reusing schema structures across tenants | Sanitised schema structure | Customer's opt-in consent; legitimate interests |
We do not sell personal data, and we do not "share" it for cross-context behavioural advertising.
5. AI processing
- Models used: Azure OpenAI (GPT-4.1 and gpt-4o-mini for extraction, classification, summaries and chat; text-embedding-3-small for search embeddings); a Mistral document-OCR model deployed on Azure AI Foundry in the deployment's Azure region (it is not Mistral AI's own API); Azure AI Foundry agents in SKIFIN's Azure subscription; and, only where a customer enables them, Azure Document Intelligence or Content Understanding.
- No training on Customer Data: SKIFIN does not train or fine-tune any model on Customer Data. We use Azure OpenAI under Microsoft's enterprise data terms; our AI models are hosted on Microsoft Azure, where prompts and outputs are processed within Azure and are not used by Microsoft to train its models. Microsoft's standard Azure abuse monitoring applies unless an exemption has been approved for a deployment; stricter handling can be agreed per customer.
- In-tenant learning: corrections that users make may be reused as few-shot examples for later extractions within the same tenant only.
- Accuracy: AI outputs, including extractions, summaries and chat answers, can be incomplete or wrong. Human-in-the-loop review is available and customers remain responsible for verifying outputs before relying on them. Chat responses are AI-generated and are identified as such in the application, consistent with EU AI Act Article 50 transparency.
- Global Schema Contribution: opt-in only; see section 2.3.
6. Sharing and subprocessors
We share personal data only with service providers that help us run Droqify, listed on our Subprocessors page (currently Microsoft Azure, Postmark, Google for optional sign-in, and Langfuse only for customers who consent to AI trace export), and where required by law or to protect rights and safety. We give customers 30 days' notice of subprocessor changes, offer an email subscription to notices, and a right to object, as described on that page. Webhooks, log sinks and integrations that a customer configures send data to destinations the customer chooses; those destinations are not our subprocessors. We may disclose data in a merger or restructuring, subject to this policy.
7. Where data is stored, by plan
- Starter and Professional: a shared SKIFIN-operated Azure host with a logically separate database and storage containers per tenant (Professional can have a dedicated Cosmos DB account). Starter and Professional are available now.
- Private (bring your own cloud): deployed in the customer's own Azure subscription; Customer Data stays in that subscription, other than model calls described in section 5 and telemetry settings agreed with the customer.
- Enterprise: a managed dedicated environment operated by SKIFIN.
- Demo environment: hosted in Azure Central India with Microsoft-managed keys, for synthetic data only. See the trial and demo terms.
Data regions for production tenants: chosen per customer requirements and stated in the Order Form. Encryption at rest uses Microsoft-managed keys by default; customer-managed keys are available on Private and Enterprise.
8. International transfers
SKIFIN is based in India; Customer Data and account data are processed in the Azure region of the tenant's deployment, and some subprocessors (for example Postmark, in the United States) process data outside India. Where GDPR or UK GDPR applies, we rely on the EU Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum, incorporated in our DPA. Under the DPDP Act, transfers are permitted except to countries the Government of India may restrict by notification. EU/UK representative (Art. 27): we do not currently market to customers in the EU or UK; if that changes, we will appoint a representative and name it here.
9. Retention
Default periods are shown below. Customer-specific retention (including for Customer Data and logs) may be agreed in the customer contract and then takes precedence. The full schedule is maintained internally and available on request.
| Data | Retention |
|---|---|
| Documents, extractions, summaries | Until the customer deletes them, or 30 days after termination; then deleted, with a deletion attestation on request |
| Chat sessions | 30 days |
| Processing jobs | 7 days |
| Process logs | 30 days by default; configurable 1 to 365 days (we recommend 180 days for India tenants, per CERT-In); a write-once copy is kept up to 90 days |
| Audit logs | 7 years, in write-once storage (retention policy not yet locked) |
| Account data | Life of the account plus 90 days |
| Contact-form leads | 12 months |
| Site server logs | 30 days |
| Billing and tax records | 8 years |
| Backups | About 7 days (Cosmos DB periodic backup; worst-case recovery point 4 hours). Deleted data may persist in backups until they expire. |
| Key Vault secrets | Soft-delete retention 90 days |
10. Security
Measures we operate include: TLS in transit; encryption at rest; per-tenant database isolation on the shared host; role-based access control with least privilege, a grant-subset guard and last-admin protection; single-use 72-hour email invite links; session revocation; account lockout after 10 failed sign-ins in 15 minutes (15-minute lock); rate limiting; optional TOTP two-factor authentication with single-use recovery codes (opt-in per user); audit events for user, role, group, two-factor and lockout changes; PHI masking in logs; and secrets in Azure Key Vault. See Security & Trust for status of audits and certifications. No system is perfectly secure.
11. Your rights and how to exercise them
Send requests to contact@skifin.com with the subject "Privacy / Data Request". We may verify your identity first. For Customer Data, we will forward your request to the customer.
- India (DPDP Act, when in force; SPDI Rules now): access to a summary of your data, correction, erasure, grievance redressal, nomination of another person to exercise rights, and a complaint to the Data Protection Board of India after exhausting our grievance process.
- EU/UK (GDPR/UK GDPR): access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and a complaint to your supervisory authority. We respond within one month.
- California and other US states (CCPA/CPRA and state laws): know, access, delete, correct, and opt out of sale or sharing (we do neither); no discrimination for exercising rights. We respond within 45 days, extendable once by 45 days.
- UAE (PDPL): access, correction, erasure, restriction, portability and objection, as provided by the law.
12. Cookies and browser storage
- Site (droqify.com): stores only your preferences in browser localStorage: your theme choice (key
app-theme) and the region you choose or dismiss in the region selector (keydroqify-locale). No advertising cookies. No analytics. - Application: stores access and refresh tokens, a "remember me" flag, and theme and interface preferences in browser localStorage, and sets a
refresh_tokenHttpOnly cookie valid for 7 or 30 days. These are strictly necessary to keep you signed in. - Google sign-in: if a tenant enables it, the sign-in page loads Google's script from accounts.google.com, and Google may set its own cookies when you choose to sign in with Google.
Because we use only strictly necessary storage and preferences you set yourself, and no tracking cookies, we do not show a cookie banner. You can clear this storage in your browser; you will then be signed out.
13. Children
Droqify is a business service for users aged 18 or over. We do not knowingly collect children's data for our own purposes. If a customer's documents contain children's data, the customer is responsible for the legal basis and any parental consent.
14. Automated decision-making
The Service uses AI to extract and classify document content. SKIFIN does not make decisions about individuals that produce legal or similarly significant effects. Customers who use extractions in such decisions are responsible for human review and legal compliance.
15. Personal data breaches
We maintain an incident response process. For Customer Data we notify the affected customer without undue delay, targeting within 48 hours of confirming a breach, so that customers can meet their own deadlines (72 hours to a GDPR supervisory authority; intimation to the Data Protection Board and affected individuals under the DPDP Rules; up to 60 days under HIPAA, only where a Business Associate Agreement is in force). For deployments in India, covered incidents are reported to CERT-In within 6 hours of becoming aware, as the CERT-In Directions 2022 require. We notify individuals directly for breaches of data for which we are controller, as the law requires.
16. Changes to this policy
We will post updates here and, for material changes, notify account administrators by email at least 14 days before they take effect. The version and update date are at the top of this page.
17. Grievance officer and contact
In accordance with the IT Act and the SPDI Rules, our Grievance Officer and data protection contact can be reached at SKIFIN IT SERVICES LLP, Galaxy Business Park, Sector 62, Noida, Uttar Pradesh 201301, India. Email: grievances@skifin.com. We aim to resolve grievances within one month of receipt.