Privacy Policy

Who we are

DocMason (docmason.ai) is operated by Cynical Software Ltd, company number SC693356, registered in Scotland. Registered office: 6 Sandilands Grove, Abernethy, PH2 9FX, United Kingdom.

For anything in this policy, including any request about your data, email hello@docmason.ai. We aim to reply within a few working days and must respond to formal requests within one month.

The short version

We collect what the service needs to work and nothing else. We do not sell your data. Your documents are never used to train AI models. Files uploaded without an account are deleted within 24 hours, automatically. You can ask us to delete everything at any time.

Files you upload

Files you upload, such as your logo or a booking photo, are processed to do the thing you asked for.

Files uploaded WITHOUT an account are permanently deleted within 24 hours. A job runs hourly to do this and it is not optional, not a setting, and not something we can turn off for you.

Files in an account are kept so you can get to your documents, and are deleted when you delete them or close your account.

AI processing

We use Google's Gemini models to read documents and draft invoices and quotes. The content you submit is sent to Google to perform that processing.

Your files and data are never used to train AI models, by us or by Google under the terms we use.

AI extracts information; it never does the maths. Totals and VAT are calculated by ordinary deterministic code.

If you have an account

We store your email address, the business details you enter, and the documents and customers you save. We use these only to provide the service.

Our lawful basis is performance of a contract for running the service, and legitimate interests for keeping it secure and working. Where we rely on legitimate interests you can object at any time.

The FullDiary app

The FullDiary app for iPhone and Android is the same account and the same data as the website, signed in with the same email and password. It adds three things. If you allow notifications, the app registers your phone's push token with us and we send new bookings, cancellations and customer messages to it through Expo's push service; a notification carries the booking or message line and nothing more, and the token is removed when you sign out or delete your account. Photos (your logo, a picture of your shop, a customer's photo) come from your photo library only when you choose one; the app does not use the camera, the microphone, your location or your contacts. The app sends product analytics to PostHog, tied to your account so we can see what is used and what is not, and crash reports to Sentry with personal data switched off.

Nothing is bought in the app. Your plan is part of your DocMason account and is shown in the app for information.

Your customers' details

When you put a customer on an invoice or quote, you decide what is collected and why. For that information you are the data controller and we are your processor: we act on your instructions, we do not use it for our own purposes, and we delete it when you do.

The same applies to bookings through FullDiary. When someone books an appointment on your page, the name, email address and phone number they enter are stored against your business so we can hold the booking, send the confirmations and reminders you have configured, and show the appointment in your diary. We do not use booking customers' details for our own marketing, and the emails we send them are about their appointment with you, sent under your business name.

Forms on a FullDiary booking page (a patch test, a consent form, a health questionnaire) are your forms: the answers a customer gives are stored against your business with the booking they were given for, and where a form asks about health the customer sees the purpose and a retention line before they agree with a typed name. Those answers are never used by us for anything else, are excluded from any export other than the PDF you request, and are deleted with the booking record on request. The same is true of the messages a customer exchanges with you, the visit records you keep about them (shared with them only if you choose), and a package they buy through your Stripe account: all stored against your business, used only to run the booking, never for our marketing. A gift voucher bought on your booking page holds the buyer's name and email and, when it is a present, the name and email of the person it is for and the message: stored against your business so the voucher can be sent and spent, and never used by us for anything else.

You are responsible for having a lawful basis to process the details you enter, and for the accuracy of what you send out.

Payments

Subscription payments are handled by Stripe. We never see or store your full card number. We keep a record of which plan you are on and your billing status.

If you turn on Pay by card so your own customers can pay an invoice, the payment goes directly to YOUR Stripe account. DocMason never holds or touches that money, and takes no cut of it. Your customer's card details are handled by Stripe, not by us.

Who else processes your data

We share data only with the providers needed to run the service, each under their own data processing terms: Supabase (database and file storage, EU region), Vercel (application hosting), Google (Gemini AI processing, and Google Maps Platform to find the address a customer or a business types when they press Find address, and to work out the driving distance to a customer's address for a business that charges for travel), Stripe (payments), Resend (sending email), PureSMS (sending text reminders and confirmations to the mobile number a customer gives), Inngest (background jobs such as follow-ups and booking reminders), Expo (delivering the FullDiary app's push notifications), PostHog (product analytics, EU region), Sentry (error monitoring), Cloudflare Turnstile (blocking automated abuse) and Tawk.to (the chat window, so you can message us from any page).

We do not sell your data and we do not share it for advertising.

Where your data is held

Your documents, files and account data are held in the EU. Some providers above are based in the United States, so certain processing happens there under the safeguards in their data processing terms, such as the EU and UK data transfer frameworks and standard contractual clauses.

Cookies and analytics

We set the cookies needed to keep you signed in and to keep the service secure. These are essential and cannot be turned off without breaking sign-in.

We use PostHog for product analytics, hosted in the EU, to understand how the service is used and to find where it is confusing.

We load Google's advertising tag to measure whether our ads work. It is configured to deny advertising and analytics storage by default, which means it sets no advertising cookies unless you tell us otherwise. If we ever add a consent banner, that is the point at which anything more would be switched on, and only if you agree.

We load Tawk.to so you can send us a message from any page. It sets its own cookies to keep a conversation together as you move between pages and to tell whether we are already talking to you. Anything you type in the chat window, and an email address if you give one, goes to us so we can reply. It is not used for advertising.

How long we keep things

Anonymous uploads: deleted within 24 hours. Account documents and customers: until you delete them. Closing your account closes any business only you own and hides it; its records stay, unused, for the six years billing records must be kept. Billing records: kept for as long as UK tax law requires us to, which is currently six years. Error logs and analytics: kept for a limited period by the providers named above and not used to build a profile of you.

Your rights

Under UK GDPR you can ask for a copy of your personal data, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable format. Email hello@docmason.ai and we will do it.

You can delete your account yourself, from Settings in the FullDiary app or from Settings, then Your account, on the website. docmason.ai/delete-account explains what is removed straight away and what the six-year rule keeps. If you are not happy with how we have handled something you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. If a change matters to you, account holders will be told by email rather than left to notice it.