Privacy policy
This policy explains what personal information Documarium holds about you, why we hold it, who else handles it, how long we keep it and what you can ask us to do with it.
The short version
- We hold what we need to run Documarium: your account, your sites and documentation, a short activity log, payment records and server logs.
- We do not sell your information, share it for advertising or train anything on it. Documarium sends nothing to any AI company; the AI you talk to is your own.
- A short list of companies helps us run the service, and each one is named below.
- You can download a copy of what we hold, export your documentation and delete your account yourself, at any time.
If something here is unclear, write to privacy@documarium.com and a person will answer.
Who is responsible for your information
Documarium is run by Tonave Services Limited, a company registered in the Republic of Cyprus under number HE 435321, with its registered office at 18 Souliou, Strovolos, 2018, Nicosia, Cyprus. For the information in this policy, we decide why and how it is used, which makes us its controller under data-protection law.
When a customer writes personal information into the pages of their own site, such as a colleague's name in a guide, that customer decides what is published. We store and serve it for them, on their instructions.
What we hold
Your account. Your email address and when the account was made. There is no password: we email you a link instead. If you choose to sign in with Google, we also hold which Google account it is, the email address Google gives us, and when you last used it.
Your sites. Each site's name, web address, plan and when it was made.
Your documentation. Every page you write, and every saved version of it. Versions are kept for as long as the site exists; your plan decides how far back you can look.
Who did what. Each saved version records who saved it, so your team can see it. That record stays after somebody leaves, while their account exists. When an account is deleted, its address is replaced by "A former member".
What happened. A log of events such as a page was saved, a site was published or a limit was reached. It holds no page content, no email addresses and nothing that could be used to sign in.
Messages we sent you. Which message, when, and to which address.
Payments. If you pay us, your plan, the country you gave when you paid, and the dates. We never see or store your card details; the payment company handles them.
Server logs. For each request our servers answer: the internet address it came from, the web address it asked for with any private part taken out, and the time. When we send you an email, the log keeps the part of your address after the @ and a scrambled form of the rest.
Visits to documarium.com. When you visit documarium.com, our server counts the visit. To count each visitor once a day it uses your IP address and browser name, mixed with a random value that is thrown away after two days, so the count cannot be linked back to you; we keep only daily totals, and where visitors came from by site name and campaign tag. Nothing is stored in your browser for this.
Previews made without an account. A preview made with Claude before anyone has an account is shown for 48 hours. If nobody keeps it, its pages are deleted when it stops being shown.
What we do not hold
- Your card details.
- Your conversations with Claude. We only receive what a request asks us to do.
- Anything from your Claude account other than your sign-in and the sites you chose to connect.
- Anything about the people who read a published site (see "Readers of published sites" below).
Why we use it, and on what legal basis
| What we use it for | Legal basis |
|---|---|
| Running your account and sites, serving your documentation, letting your team work on it | Performing our contract with you |
| Billing you, keeping payment and tax records | Performing our contract; meeting our legal obligations |
| Writing to you about your own account, such as sign-in links, receipts and notices | Performing our contract |
| Keeping the service secure, finding faults and dealing with reports of abuse | Our legitimate interest in running a safe, working service |
| Recording who saved each version, the rights you confirmed to what you published, and previews made without an account | Our legitimate interest in showing who did what and in letting you try Documarium before you sign up |
| Keeping a record of the terms you agreed to when you signed in, and of the choices you confirmed when you paid | Our legal obligations, and our legitimate interest in showing what was agreed |
We do not sell your information. We do not share it for advertising. We do not use it to train AI models.
Who else handles it
Each of these companies is here because the product cannot work without it:
| Company | What it does for us | What it sees |
|---|---|---|
| Railway | Runs our servers, our database and our job queue, and keeps our server logs | Everything we store |
| Cloudflare | Stores published pages, serves them to readers and issues the security certificate for your web address | Published pages and the addresses they are served on, and what any website sees of a visit |
| Resend | Sends our emails: sign-in links, invitations, receipts and notices | The address an email goes to, and the message |
| Stripe | Takes payment for a paid plan | Your name, your card and the country you gave |
| Lets you sign in with your Google account, if you choose it | That you are signing in to Documarium, and which Google account you used | |
| Sentry | Records faults in our software, while we have it switched on | Details of a fault, which can include an account number and the address of the page that failed |
The AI assistant you connect to Documarium is yours, not ours. When you use Claude with Documarium, Anthropic handles what you send it under your own agreement with them. We do not send your content to Anthropic or to any other AI company.
If you send us a copyright complaint, we pass it, with how to reach you, to the owner of the site it is about (terms section 13.7).
We give at least 30 days' notice on our sub-processor list before a new company starts to handle personal information for us.
Where your information is
On servers in the European Union and the United States. Our providers move information between their own regions to keep the product working. Where information leaves the European Economic Area or the United Kingdom, we rely on the safeguards that data-protection law provides for such transfers, for example the EU–US Data Privacy Framework or the standard contractual clauses. Ask us at privacy@documarium.com for a copy.
Readers of published sites
A published site sets no cookie. Published pages are served by Cloudflare, which counts the pages it serves; we show that count to the site's owner. Nothing about the people who read a page reaches us, so there is nothing about them for us to keep. A preview and the page our badge links to are different: they come from our own servers, so a visit to one is in our server logs.
Cookies
We set three cookies on Documarium's own screens: two sign you in, and the third remembers which notes you have already read. We set none for advertising or analytics. The cookie policy lists all three.
How long we keep things
| What | How long |
|---|---|
| Your documentation | While the site exists |
| The activity log | 12 months |
| Your account and sites after you ask us to delete them | Your sites stop being shown within a few minutes; everything is removed after 30 days, and we write to you twice before that, at least seven days apart |
| The terms you agreed to when you signed in | Three years after your account is removed |
| The choices you confirmed when you paid | Three years after your plan ends |
| Records we must keep for tax or accounting | As long as the law requires |
| Server logs and backups | Until they age out |
After an account is removed, these things stay: the payment record our payment company keeps as the law requires of it; the tax and accounting records we must keep; the terms you agreed to, for three years; the choices you confirmed when you paid, for three years after your plan ends; your address on our list of people who asked for no more emails, if it is there; the history of other people's sites you worked on, with your address replaced by "A former member"; and server logs and backups, until they age out.
Your rights
You can ask us to:
- see what we hold. Your account page lets you download it: your account, the sites you own or belong to, how you sign in, your links to Claude, the invitations you sent or received, the emails we sent you, your plan and payments, and a log of what you did.
- take your documentation with you. Your site page lets you export it, on every plan, at any time, including while a site is paused and after you stop paying.
- delete your account. Your account page does it. It asks you to type your email address first, because it cannot be undone.
- correct something that is wrong, restrict how we use your information, or object to a use based on our legitimate interests. Write to privacy@documarium.com.
We answer within 30 days. You also have the right to complain to a data-protection authority, in the country where you live or work, in Cyprus, where we are established, or, in the UK, the Information Commissioner's Office.
Automated decisions
We make no decision about you by automated means alone that has a legal or similarly significant effect on you. A person reads every report about content.
Published pages are public
Anything you publish is meant to be read by anyone, so do not put anything private in it. Pages you have not published are shown only to people who have the preview's address, for a limited time, and to your team while they work on the site.
Children
Documarium is for work. It is not for anyone under 18, and we do not knowingly hold information about a child.
If something goes wrong
If information is lost or reached by somebody who should not have it, we tell the people affected and the relevant authority without unnecessary delay, as the law requires.
Changes to this policy
If we change something that matters, we write to account holders before it takes effect. Small corrections are made on this page without a notice.
Contact
Write to privacy@documarium.com, or by post to Tonave Services Limited, 18 Souliou, Strovolos, 2018, Nicosia, Cyprus.
Last updated: 1 November 2026.
1 November 2026: we renamed a copy made without an account a preview, and a kept preview a draft. Nothing else in this policy changed.