Privacy Policy

GarnerDocs is document collection software for businesses that collect documents from their clients. This policy calls each of those businesses a firm. A firm uses GarnerDocs to request documents from its clients, review what they upload, and send reminders about anything still missing.

GarnerDocs is provided by Waseem S. M. Abusenjr, trading as GarnerDocs, Alte Landstr. 85, 51373 Leverkusen, Germany. Our legal notice has our full details.

If you have a question about this policy or your personal data, contact us at [email protected].

Data protection law calls whoever decides why and how personal data is used the controller. Whoever handles it on their behalf is a processor.

GarnerDocs is the controller for:

• firm accounts: the people who sign up and their team members
• billing for subscriptions
• signing in and keeping the service secure, including server logs
• messages sent to our support team or our privacy address
• the chat on our public website
• records of who accepted our terms, and our emails about changes to them
• our email provider's list of addresses that bounced or reported spam, which covers all GarnerDocs email (see Keeping emails deliverable)
• analytics on our public website, if you accept it

Each firm is the controller for its clients' information. That covers client names and contact details, the requests it sends, and the files, notes and answers its clients send through upload links.

GarnerDocs is the firm's processor for that information. We handle it only on the firm's instructions and only to provide the service, under our Data Processing Agreement.

The business that sent you this link uses it to collect documents from you. It decides what it asks for and what happens to your documents. You don't need an account.

The business should tell you how it uses your information in its own privacy notice. If it has added one to GarnerDocs, there's a link to it on your upload page and in its emails to you.

Your files, notes and answers go to that business. GarnerDocs, and the service providers we use to run it, handle them only to deliver them to the business and keep them safe. The business may also connect GarnerDocs to its own systems, which then receive them. We don't use your documents for anything else.

If you have questions about how your documents are used or kept, contact the business that sent you the link. It controls your information and can update or delete it. If you write to us instead, we'll pass your request to the business.

Firm accounts:

• your name, work email address and job title, and your password (stored hashed)
• the workspaces you belong to and your role in each
• your two-factor settings, stored encrypted, and your email notification choices
• when you were last active, and a record of what you do in the workspace, such as sending a request or approving a file
• if you connect a Google or Microsoft account to sign in: that account's ID and email address (see Signing in with Google or Microsoft)

Workspaces: the firm's name, logo and brand colour, the contact details and privacy notice address it shows to clients, its settings, and its plan. Payment details are entered on our payment provider's pages and never reach GarnerDocs.

Where you signed up from: when someone creates a workspace by signing up, we record the page of our website they signed up from and the campaign details in the link they followed (its ref and utm_ values), and keep them with the workspace. We use them to learn which pages and campaigns bring new customers. They're never shown in the app and are deleted with the workspace. No cookie is used for this.

Records of agreement: when a firm's owner accepts our terms, or a team member acknowledges our Acceptable use policy, we record their name, email address, firm, the versions and the time. We don't record IP addresses or browser details for this.

Support messages: what you write to us, your name and email address, and the workspace details the message carries. Messages sent from Help & Support are emailed to our team, not stored in GarnerDocs.

Client information, entered by a firm or sent by its clients:

• client names, contact names, email addresses and phone numbers, and the firm's own notes about each client
• the requests a firm sends, its checklists and messages, and when the client first opened the link
• the files, notes and answers clients send, and the firm's review decisions
• whether an email to the client bounced or was reported as spam

What documents can contain: it depends on the firm. Firms use GarnerDocs for tax and accounting records, bank statements, identity documents such as passports, ID cards and driving licences, immigration papers such as visas and residence permits, credit and loan applications, and employment records such as payslips, contracts and right-to-work evidence.

Documents can also contain more sensitive information, even when the firm didn't ask for it. Examples are health details on a medical letter, religion or trade union membership on a payslip, or a criminal record on a police certificate. GarnerDocs stores files and shows them to the firm. Apart from scanning each upload for malware, it doesn't analyse or extract anything from what's inside them, unless the firm turns on automatic document checks.

Automatic document checks: if a firm turns these on, each file a client uploads to it is read by Claude, an AI model made by Anthropic, running on Amazon Bedrock in Amazon's EU regions. The file is compared with what the firm asked for, and possible problems, such as a statement for the wrong year or a missing page, are shown to the firm's team. The team still reviews every file: the check doesn't decide anything about the client. Anthropic can't access the file, and Amazon doesn't keep it after the check, except that Amazon may keep and report an image its automated systems flag as apparent child sexual abuse material. The result is stored with the file and deleted with it.

Website analytics: if you accept analytics cookies on our public website, Google Analytics records the pages you visit, how you got there, your device and browser, and an approximate location worked out from your IP address. Google Analytics doesn't store IP addresses. It only runs on the website, never in the app or on client upload pages, and it doesn't load at all unless you accept it.

Website chat: if you open the chat on our public website, Crisp, the service we use for it, records the messages you send us and any email address you give, the page you're on, your browser and device, and your IP address. If you open the chat but don't send a message, Crisp deletes this after about 30 minutes. The chat only runs on the website, never in the app or on client upload pages.

Technical data: your IP address and browser details when you use GarnerDocs. We use your IP address to limit how many requests can be made each minute, which protects sign-in and upload links. Your session can hold your IP address and browser details while it lasts. Our servers log errors.

Firm users can connect a Google or Microsoft account in Settings → Profile and then use it to sign in to GarnerDocs. It's optional: you can always sign in with your email address and password instead. Clients who upload documents never sign in.

What we receive: when you connect or sign in, Google or Microsoft tells us your account's ID, email address and basic profile, such as your name. From Google we only ask for the openid, email and profile permissions, and from Microsoft for openid, profile and User.Read (your basic profile). We never get your password, and we can't see your email, contacts, calendar, files or anything else in your account.

What we keep and why: only the account ID and the email address. We use the ID to recognise you when you sign in, and we show the email address on your profile so you know which account is connected. We don't store anything else Google or Microsoft sends.

Sharing: we don't share, sell or transfer this information, and we don't use it for advertising, for profiling or to train AI models. It's stored with the rest of your account on our servers in Frankfurt, Germany.

Removing it: disconnect the account in Settings → Profile at any time and we delete its ID and email address straight away. They're also deleted when you delete your GarnerDocs account. You can remove GarnerDocs' access from your Google account at myaccount.google.com/connections.

GarnerDocs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

For client information, we act on the firm's instructions: showing each firm its requests, delivering uploads, sending the request and reminder emails the firm has set up, notifying its team about new uploads and, if the firm turns them on, checking uploads against what it asked for.

For the data we're responsible for, we use it for these purposes:

• Running your account: Creating and running firm accounts and workspaces, signing you in, sending the emails you've chosen, and recording what happens in the workspace.

  Why we may: Our legitimate interests (Art. 6(1)(f) GDPR): providing the service our contract with your firm covers to the people your firm signs up and invites.

  How long we keep it: Your account is kept until you delete it. What you did in a workspace stays in its activity history until the firm deletes the workspace.

• Billing: Taking subscription payments through our payment provider, issuing invoices and keeping accounting records.

  Why we may: It is necessary for our contract with your firm, or to take steps before one (Art. 6(1)(b) GDPR).

  How long we keep it: Invoices and accounting records are kept for 10 years from the end of the year they were made, as German tax law requires (§147 AO).

• Security: Keeping GarnerDocs and the documents in it safe: sessions, two-factor authentication, limits on repeated requests, and server logs for finding faults and misuse.

  Why we may: Our legitimate interests (Art. 6(1)(f) GDPR): keeping GarnerDocs and the documents in it safe, and finding faults and misuse.

  How long we keep it: Server logs are kept for 14 days and failed background jobs for 7 days. Rate limit counters last a minute.

• Support and privacy requests: Answering messages sent to our support team and requests sent to our privacy address.

  Why we may: Our legitimate interests (Art. 6(1)(f) GDPR): answering the people who write to us.

  How long we keep it: Messages are kept in our support mailbox for up to 3 years after the conversation ends.

• Website chat: Answering questions visitors send us through the chat on our public website.

  Why we may: Our legitimate interests (Art. 6(1)(f) GDPR): answering the people who write to us.

  How long we keep it: Chat conversations are kept in Crisp for up to 3 years after the conversation ends. Crisp's cookie lasts 6 months after your last visit.

• Records of agreement: Keeping a record of who accepted which version of our terms, and telling workspace owners about changes.

  Why we may: Our legitimate interests (Art. 6(1)(f) GDPR): being able to show which version of our terms a firm agreed to, and that we told it about changes.

  How long we keep it: Kept while the workspace exists, then for 4 years after it is deleted.

• Keeping emails deliverable: Flagging addresses our email provider can no longer deliver to (see below).

  Why we may: Our legitimate interests (Art. 6(1)(f) GDPR): keeping GarnerDocs email deliverable for every firm.

  How long we keep it: Kept by our email provider until we remove the address, which we do when the person asks us to.

• Website analytics: Measuring how people find and use our public website, so we can improve it. Only for visitors who accept analytics cookies, and never for advertising.

  Why we may: Your consent, which you can withdraw at any time with Cookie settings at the bottom of every page of our website (Art. 6(1)(a) GDPR).

  How long we keep it: Google Analytics keeps the details of your visits for 2 months. Its cookies last up to 2 years, or until you reject analytics or clear them.

We don't sell personal data and we don't use uploaded documents for advertising or to train models. We don't make decisions based solely on automated processing that have legal or similarly significant effects on anyone.

You need to give your name, email address and a password to create an account. Without them, we can't provide one.

If an email to an address bounces permanently, or the person reports it as spam, our email provider may stop delivering to that address from GarnerDocs. That applies to every firm, because all GarnerDocs email is sent the same way.

When an email a firm sent to a client bounces or is reported as spam, GarnerDocs flags that client in that firm's workspace only, so the firm knows why its emails aren't arriving. Other firms aren't told. If another firm later emails the same address and its email can't be delivered either, that firm's client is flagged as bouncing, without saying why. The flag records the address, whether it bounced or was reported as spam, and when. Changing the client's email address clears it.

The flag is part of the service we provide to each firm, as its processor. For the email provider's list of addresses it no longer delivers to, which covers every firm, GarnerDocs is the controller.

Uploaded files are kept in private storage. In GarnerDocs, they're only available to members of the firm that requested them, and to any systems the firm connects. Each request has its own link, shared only with that client.

GarnerDocs is for collecting documents, not archiving them. Each firm keeps its own records in its own systems and chooses how long GarnerDocs keeps uploaded files after a request is completed: 30, 90, 180 or 365 days. The default is 90 days. When that period ends, the files are deleted automatically and the request's client link closes.

The firm's owner is emailed 14 days and 3 days before files are deleted. Until then, the firm can download a request's files as a ZIP or delete them earlier. When a firm deletes its workspace, its files are deleted too.

Retained after files are deleted: the request record stays in the firm's workspace, including the request title, the names of the documents requested, the names of the files uploaded, review decisions and the activity history. The firm can delete it with its workspace.

Backups: copies of deleted files may stay in restricted backups for up to 30 days. They aren't used for anything else and are erased when the backups expire.

Your account: kept while you have it. When you delete your account, it's removed from every workspace. Sessions end 2 hours after your last visit, unless you chose "Keep me signed in".

Only the service providers we need to run GarnerDocs, such as hosting, email delivery, payment processing, the chat on our website and, if you accept it, analytics on our website, under agreements that limit their use of the data to providing those services. We may also disclose information when the law requires it.

Our subprocessors list names each provider, what it does and where.

A firm can also send its data to systems it chooses, such as its own software through webhooks. Those are the firm's recipients, not ours.

GarnerDocs's servers, database, file storage and backups are with Amazon Web Services in Frankfurt, Germany. Uploaded files stay there. If a firm turns on automatic document checks, each file it receives is also processed briefly for the check in one of Amazon's EU regions: Germany, Ireland, France, Italy, Spain or Sweden.

Some of our service providers are based in the United States or work worldwide. Cloudflare passes traffic between your browser and our servers through its nearest data centre. Laravel Forge, which manages our servers, Stripe, Google, which hosts our support mailbox and runs our website analytics, and our email provider's support staff may access data from the United States. Crisp, which runs the chat on our website, is in France and keeps chat conversations in the EU, but some of its own providers are US companies.

Where personal data goes to a country outside the EU without an adequacy decision, we rely on the EU-U.S. Data Privacy Framework for certified US companies, or on the EU Standard Contractual Clauses in the provider's data processing terms. To get a copy of these safeguards, contact us at [email protected].

GarnerDocs sets the cookies it needs to work, such as keeping you signed in and keeping forms secure. On our public website, and only if you accept them, we also use Google Analytics cookies to measure visits. If you open the chat on our website, Crisp sets a cookie that keeps your conversation going. You can change your choice at any time with Cookie settings at the bottom of every page of the website. We don't use advertising cookies.

Our Cookie policy lists each cookie, what it's for and how long it lasts.

You have the right to:

• access your personal data and get a copy of it
• have it corrected or deleted
• restrict how it's used
• receive it in a portable format, and have it sent to someone else
• object to how it's used where we rely on our legitimate interests
• withdraw your consent at any time where we rely on it, without affecting what we did before you withdrew it

To use any of them, contact us at [email protected]. Firm users can update most details in their settings. Clients of a firm should contact that firm first, since it controls their information.

If you're unhappy with how we've handled your personal data, please tell us first at [email protected], so we can put it right.

You can also complain to a data protection supervisory authority, in particular in the country where you live or work, or where you think the problem happened. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (the data protection authority for North Rhine-Westphalia, Germany) at ldi.nrw.de.

If you're in the UK, you can complain to the Information Commissioner's Office at ico.org.uk.

If we make a material change, we'll update this page, its version and the date above, and tell firm owners by email before the change takes effect.