CopyHawthorn edition / DocControlSystem

Privacy

Effective 11 November 2026.

Yolleg Ltd · Company 10455920 · 71–75 Shelton Street, London, England WC2H 9JQ, United Kingdom · [email protected].

Data and purposes

We process account email, essential session identifiers, one-use sign-in challenges, organisation/site details, authorised staff roles and invitations, exact original PDF/TXT/CSV files, extracted archive search text, retention/hold instructions, revision/review/release history, distribution locations, acknowledgement actor/date, consent, security and billing references. This supports the requested service, access control and accounting obligations. Use business roles and work email addresses; exclude sensitive personnel, identity, health, credentials and restricted technical material.

Storage and protection

Account email/key fields, organisation records, original bytes and filenames are encrypted at rest. This is not end-to-end encryption. Necessary HttpOnly/SameSite session cookies last up to seven days; production HTTPS requires Secure cookies. Authentication and organisation permission are checked on every original request. Controlled-document readers receive released originals; authorised archive members may retrieve retained archive versions. Removed members lose access. Earlier exports and paper copies remain with their holders.

Contract, declaration, outbox and security records may contain contact information outside the encrypted business payload. The app uses self-hosted licensed fonts and generated editorial artwork. There are no advertising trackers, analytics SDKs or cloud AI processing of customer documents. The archive extracts bounded PDF/text content offline to support search; it does not send documents to cloud AI, approve their contents or repair source accessibility. Extracted text and archive metadata are encrypted; search terms are keyed per organisation rather than stored in plaintext.

Providers and retention

Stripe handles hosted payment pages; the app does not store full card details. SendGrid handles sign-in, invitation and transactional messages when configured. The established Labs host stores records and logs. Managed encrypted backups run daily on the established host, with 30-day rotation and weekly isolated restore checks. An hourly operator-Mac off-host copy uses a separate Keychain recovery key and requires that Mac signed in, awake and online. This is not an always-on cloud backup guarantee or a guarantee about a provider’s physical geography. Providers may process internationally under their contractual safeguards.

Organisation records persist until authorised erasure or account deletion, subject to service capacity and availability. Archive holds and unexpired retain-through dates block active-original disposition and whole-workspace erasure. Eligible owner-confirmed disposition leaves version/hash tombstones and the reason; recovery copies expire under the 30-day backup policy. Historical releases and acknowledgements remain attached to their exact revision. Expired sign-in challenges are cleaned up. Billing and contract records may be retained up to six years for accounting and disputes. Keep independent required archives. Private backups include the encryption secret and must be protected separately from public source bundles.

Choices and contact

Export records and exact originals, revoke all device sessions, ask the owner to revoke membership, cancel renewal, or contact [email protected] for erasure, account deletion, access, correction, restriction, objection or portability. Erasure does not cancel billing. No data sales. You may complain to the UK ICO or your local supervisory authority. Protect email recovery and sign-in links.