In short
1. Who we are
DocDiff is operated by Orivant Labs ("we", "us"). For your account, sign-in and contact data, we are the controller (in India, the data fiduciary). For the documents a workspace uploads, we process them on that workspace's behalf, to provide the Service.
Privacy contact and grievance officer: privacy@orivantlabs.com.
2. What we collect
| Data | What it includes |
|---|---|
| Account | Email address, optional display name, your workspaces and roles. |
| Documents and results | Files you upload, the changes found, summaries, and reviewers' decisions. These may contain personal data if your documents do. |
| Sign-in and security | Sign-in codes and session tokens (stored only as secure hashes), the IP address and browser of each sign-in and session, and a log of important account actions. |
| Consent records | Which version of the Terms and this Policy you accepted, and when. |
| Contact messages | Your name, email, company and message, and a keyed hash of your IP address used only to limit spam. |
| Technical logs | Server logs with request details such as IP address and time, used to run and secure the Service. |
We don't use analytics or advertising trackers. See the Cookie Policy.
3. Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide the Service: sign-in, comparisons, workspaces, support | Performance of our contract with you |
| Keep the Service secure: rate limits, abuse prevention, audit history | Our legitimate interest in a safe service |
| Answer contact messages | Our legitimate interest in replying to you, or steps you ask for before a contract |
| Record your acceptance of our terms | Legal obligation and our legitimate interest in proving it |
| Improve accuracy, using changes you mark wrong or report missed | Our legitimate interest; you can ask us not to |
Under India's Digital Personal Data Protection Act, 2023, we process your personal data for these purposes with your consent, which you give when you accept this Policy, or for the legitimate uses the Act allows. You can withdraw consent at any time by closing your account.
4. AI summaries
Summaries are optional. When you ask for one, we send the list of changes (the changed lines and values, and their locations) to Anthropic, whose Claude model writes the summary. We do not send your whole files. Anthropic processes this data under commercial terms that do not allow it to use the data to train its models.
5. Who we share it with
We share personal data only with providers who help us run DocDiff, under contracts that require them to protect it:
| Provider | Purpose |
|---|---|
| Microsoft Azure | Hosting, database, file storage and logs |
| Anthropic | Writing optional summaries from the list of changes |
| Our email delivery provider | Sending sign-in codes, invitations and replies |
| Google Fonts | Serving the fonts the site uses (your browser requests them from Google, which receives your IP address) |
We may also disclose data if the law requires it, or to protect the rights and safety of our users or the public. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
6. Where it is processed
Our servers run on Microsoft Azure. Some providers, such as Anthropic and email services, may process data in other countries, including the United States. Where the law requires it, we use appropriate safeguards for these transfers, such as the European Commission's standard contractual clauses.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While your account is open |
| Documents and results | Until you ask us to delete them, or the account is closed; then deleted within 30 days |
| Sessions | Up to 30 days after your last activity, or until you sign out |
| Security log and consent records | Up to 3 years after the account is closed |
| Contact messages | 24 months after our last reply |
| Server logs | 30 days |
| Backups | Up to 35 days, then overwritten |
8. Security
Data is encrypted in transit (HTTPS) and at rest. Each workspace's data is kept separate, and every request is checked against the signed-in person's role. Sign-in codes, sessions and API keys are stored only as keyed hashes. No method of storage or transfer is perfectly secure, but we work to protect your data and will tell you without undue delay if a breach affects it.
9. Your rights
Wherever you live, you can ask us to:
- see the personal data we hold about you, and get a copy in a common format;
- correct data that is wrong or incomplete;
- delete your data, unless we must keep it by law;
- object to, or ask us to limit, how we use it;
- withdraw consent where we rely on it.
In the EU and UK (GDPR), you can also complain to your local data protection authority. In India (DPDP Act), you can also nominate someone to exercise your rights if you can't, and raise a grievance with our grievance officer, and then with the Data Protection Board of India. In California (CCPA), you have the right to know, delete and correct your personal information, and we will not treat you differently for using these rights. We do not sell or share your personal information.
To use any of these rights, email privacy@orivantlabs.com from the address on your account. We reply within 30 days. If your documents belong to a workspace, we may refer your request to that workspace's owner.
10. Children
DocDiff is for people aged 18 and over. We don't knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
We will update this page when our practices change, and tell you in advance about important changes, by email or in the Service. The date at the top shows the latest version.
12. Contact and complaints
Orivant Labs · privacy@orivantlabs.com · Contact page