Privacy Policy
Last updated: June 2026
Doctorine ("we", "us") operates a developer-documentation and API-portal platform. We are committed to protecting your personal data and to the principle of EU data residency by construction: customer content and personal data are stored and processed within the European Union (Cloudflare EU, Neon EU, Cloudflare R2 EU). This policy explains what we collect, why, and the rights you have under the GDPR.
Who is the data controller
Doctorine is the controller for account and usage data. For the content our customers publish through the platform, the customer is the controller and Doctorine is the processor, governed by our Data Processing Agreement.
What we collect
- Account data — your name, email, and organization, provided via our authentication provider (WorkOS) when you sign up.
- Content — the documentation, API specifications, and project data you create or import.
- Usage & telemetry — pages served, API calls, and error diagnostics, used to operate, secure, and improve the service.
- Billing data — handled by our payment processor; we do not store full card numbers.
Why we process it (lawful bases)
- Contract — to provide the service you signed up for.
- Legitimate interests — security, abuse prevention, and product improvement, balanced against your rights.
- Consent — where required (e.g. optional analytics), withdrawable at any time.
- Legal obligation — to comply with tax and accounting law.
Sub-processors
We use a small set of carefully selected sub-processors, including Cloudflare (edge & storage, EU), Neon (database, EU), and WorkOS (authentication, US — the documented exception, covered by appropriate transfer safeguards). A current list is available on request.
Data retention & deletion
We retain personal data only as long as needed for the purposes above or as required by law. You can request export or erasure of your data at any time; verified erasure requests are honoured, including crypto-shredding of encryption keys where applicable.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to lodge a complaint with your supervisory authority. To exercise any right, contact us at privacy@doctorine.xyz.
Security
We enforce tenant isolation at the database layer (row-level security), encrypt data in transit and at rest, and follow least-privilege access controls. No method of transmission or storage is perfectly secure, but we design defensively and respond promptly to incidents.
Changes
We will post any material change to this policy here and update the date above. Continued use after a change constitutes acceptance.