Privacy policy

We are the controller for the personal data we collect about users of DocuCollect and this website.

The data controller is Benoit Ammermann, an individual based in Barcelona, Spain. Postal address: Pg Marítim 19, 08005 Barcelona, Spain. Privacy contact: contact@vivflow.com or the form at docucollect.app/contact. See our legal notice for full operator details. "vivflow" is a trading name and domain, not a separate legal entity.

Account and profile data: email address, display name when provided, role (company user, client, or admin), and company association for company users.

Service data: forms, checklist items, comments, invitation and reminder emails, and audit records needed to operate the product securely.

Client submissions: files and text values that clients upload or enter to complete a checklist. These are processed on behalf of the inviting company as part of providing the service.

Technical data: session cookies required for authentication, and standard server logs (for example IP address and user agent) used for security and reliability.

Support messages: name, email, and message content you send via our contact form or email.

We do not collect or store payment card details. Payment data is collected by Paddle as described below.

Provide and secure the service (contract / legitimate interests): authentication, document collection workflows, tenant isolation, and abuse prevention.

Communicate about the service (contract / legitimate interests): magic-link invitations, sign-in links, and client reminder emails when a company requests them.

Respond to support requests (legitimate interests / contract): messages you send via the contact form, in-app help, or email.

Comply with legal obligations when applicable.

Service providers / processors that help us run DocuCollect: Supabase (database, file storage, and authentication in the EU, eu-central-1), Brevo (transactional email), and Vercel (application hosting). Processors act only on instructions needed to deliver the service and are bound by appropriate data-processing terms.

Merchant of Record — Paddle.com: for sale of the Service, subscription management and payments, tax compliance, and invoicing. Paddle acts as an independent controller for payment-related personal data. Card details are processed by Paddle, not by DocuCollect. See Paddle's privacy policy at paddle.com/legal/privacy.

Professional advisers (legal, accounting, auditors) where needed, and authorities where required by law or to protect rights and safety.

We retain account and service data while your account or company workspace is active and for a reasonable period afterward as needed for security, billing disputes, or legal requirements. Data is deleted or anonymized when it is no longer needed for those purposes.

Companies control the client forms and submissions in their workspace. When a company deletes data or closes access where the product allows it, we process that request in the application.

We apply appropriate technical and organizational measures, including encryption in transit (HTTPS/TLS), encryption at rest on managed infrastructure, tenant isolation via database row-level security, and access controls tied to authenticated sessions. More detail is on our Security page at docucollect.app/security.

Application data, uploaded files, and authentication for DocuCollect are hosted in the European Union (Supabase, eu-central-1). We do not choose infrastructure providers that store production tenant data outside the EU.

Some processors (for example Vercel edge delivery, or Paddle as Merchant of Record) may process limited personal data outside the EEA. Where that happens, transfers rely on appropriate safeguards such as an adequacy decision or standard contractual clauses (SCCs).

Depending on your situation, you may have the right to access, rectify, erase, restrict, or object to certain processing, the right to data portability, and the right to withdraw consent where processing is based on consent. To exercise these rights, use docucollect.app/contact or email contact@vivflow.com. We aim to respond within one month (extendible as allowed by law).

If you are a client invited by a company, some requests may need to be handled with that company, because they decide which documents to collect and how long to keep them for their professional purposes.

You may lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

DocuCollect uses essential cookies and similar storage for signed-in sessions and locale preference. We do not use advertising cookies on the marketing site. Preference controls for non-essential cookies, when present, are offered via our consent banner.