1. Introduction

AK DONKEYHOST, a registered trade name of Proadco Expert Software | Proadco Limited (HE 68072), with registered office at Arch. Makariou III 137 & Papadiamanti 2, 3021 Limassol, Cyprus ("DonkeyDocs," "we," "us") operates the DonkeyDocs document management platform at docs.donkeyhost.com.

This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Cyprus Law on the Protection of Natural Persons with regard to the Processing of Personal Data (Law 125(I)/2018).

2. Information We Collect

2.1 Account Information

Name, email address, company name (at registration)
Google account information (if using Google Sign-In)
Billing information processed by Stripe (we do not store card numbers)

2.2 Documents You Upload

When you upload documents, we process the file content for AI classification, text extraction, and search indexing. Documents may contain personal data of third parties — in this case, you are the data controller (see Section 8).

2.3 Technical Data

IP address, browser type, operating system
Pages visited, actions taken, timestamps
Error logs and performance data

2.4 Cookies

We use the following categories of cookies:

Essential: Authentication tokens, CSRF protection, session management. These are necessary for the Service to function and cannot be disabled.
Analytics: Google Analytics (GA4) to understand how the Service is used. Only loaded with your explicit consent.

We do not use marketing or advertising cookies. You can manage your cookie preferences at any time using the cookie settings link in the footer.

3. How We Use Your Information

Purpose	Legal Basis (GDPR Art. 6)
Provide and operate the Service	Performance of contract (6(1)(b))
Process payments and billing	Performance of contract (6(1)(b))
AI document classification and search	Performance of contract (6(1)(b))
Send service notifications	Legitimate interest (6(1)(f))
Maintain audit logs	Legitimate interest (6(1)(f))
Analytics (with consent)	Consent (6(1)(a))
Comply with tax and legal obligations	Legal obligation (6(1)(c))

4. Data Storage and Security

All data is stored on Amazon Web Services (AWS) in the EU (eu-central-1). We implement:

AES-256 encryption at rest for all stored documents
TLS 1.3 encryption for all data in transit
ClamAV antivirus scanning on every uploaded file
Role-based access controls and tenant isolation
Regular security audits and monitoring

4.1 Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours per GDPR Article 33, and affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34).

5. Data Retention

Active accounts: Data retained for the duration of your subscription
After account deletion: Documents permanently deleted within 30 days. Account data anonymized.
Audit logs: Anonymized and retained for 7 years per Cyprus tax law
Billing records: Retained for 7 years per Cyprus tax law

6. Your Rights Under GDPR

Under the GDPR, you have the right to:

Access your personal data (Article 15)
Rectification of inaccurate data (Article 16)
Erasure ("right to be forgotten") (Article 17)
Restrict processing (Article 18)
Data portability — receive your data in a structured format (Article 20)
Object to processing based on legitimate interest (Article 21)
Withdraw consent at any time without affecting prior processing (Article 7(3))

To exercise any of these rights, contact us at info@donkeyhost.com. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. For Cyprus: Commissioner for Personal Data Protection, 1 Iasonos Street, 1082 Nicosia — commissioner@dataprotection.gov.cy.

7. Data Processing and Sub-Processors

7.1 Our Role

For your account data, we act as the data controller. For documents you upload containing third-party personal data, we act as the data processor on your behalf.

7.2 Sub-Processors

Sub-Processor	Purpose	Location	Transfer Mechanism
Amazon Web Services	Infrastructure, storage (S3)	EU	N/A (EU)
Stripe	Payment processing	US/EU	EU-US DPF
Google (OAuth)	Authentication	US/EU	EU-US DPF
OpenAI	AI document classification	US	SCCs + DPA
Google (Gemini)	AI document classification	US/EU	EU-US DPF
Anthropic	AI document classification	US	SCCs + DPA
Cloudflare	Turnstile captcha	Global/EU	SCCs
Google Analytics	Usage analytics (consent-gated)	US/EU	EU-US DPF

AI providers process document text solely for classification and metadata extraction. We have data processing agreements with each provider that prohibit use of your data for model training.

8. International Data Transfers

Some of our sub-processors are based outside the EU. Where personal data is transferred to countries without an EU adequacy decision, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, and/or the EU-U.S. Data Privacy Framework (DPF) where applicable.

9. Children's Privacy

DonkeyDocs is a business service. You must be at least 18 years old to create an account. We do not knowingly collect data from anyone under 18. If we become aware that a minor has provided personal data, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated at least 30 days in advance via email or in-app notification. The "Effective" date at the top indicates the latest version.

11. Contact Us

For privacy inquiries or to exercise your GDPR rights:

Email: info@donkeyhost.com
Address: AK DONKEYHOST / Proadco Limited (HE 68072), Arch. Makariou III 137 & Papadiamanti 2, 3021 Limassol, Cyprus
Supervisory Authority: Commissioner for Personal Data Protection of Cyprus, 1 Iasonos Street, 1082 Nicosia, +357 22 818456, commissioner@dataprotection.gov.cy