Privacy Policy

This policy explains how Agdir Drift AS handles personal data when you visit our website or use Doki Dok (the “Service”). It applies to account holders, people invited into rooms or asked to sign documents, and visitors to our website.

1. Who is responsible

The data controller for the website and for your Doki Dok account is:

We process personal data in accordance with the General Data Protection Regulation (GDPR), as incorporated into Norwegian law through the EEA Agreement, and the Norwegian Personal Data Act (personopplysningsloven).

Documents you upload are a different matter. When you or your organisation store, share, or send documents through Doki Dok, you decide what those documents contain and why. For any personal data inside them you are the controller and we act as your processor. See GDPR & Data Processing for the terms that apply.

2. What data we collect

Account information

Your name and email address, and your profile picture if you sign in with Google or Microsoft. Sign-in is passwordless (magic links sent by email) or through Google or Microsoft single sign-on. We never store passwords.

Sessions and security logs

When you sign in we store a session record that includes your IP address and browser user agent. We use it to keep you signed in, detect misuse, and let you review active sessions.

Documents and content

Documents, folders, tags, templates, comments, approvals, and document versions you create or upload. Files are encrypted individually (ChaCha20-Poly1305) before they are written to storage.

Inbox email

Each account and room can have its own email address. Messages and attachments sent to these addresses, including the sender’s name and email address, are received by our own mail server and stored in your inbox.

Rooms and collaboration

If you are invited into a room, we process your name and email address, your role in the room, chat messages you send, and room activity such as when you open or download documents. The room owner can see this activity in the room’s activity log and analytics.

Electronic signatures

When you sign or are asked to sign a document, we record your name, email address, the signing method used, timestamps, IP address, and the signed result. Where signing uses an electronic identity (eID) provider, the provider also returns your identity details, which may include your national identity number.

Usage data

Only if you accept statistics cookies, we use PostHog (EU cloud) to collect page views and feature usage so we can improve the Service. See the Cookie Policy.

Payment data

Paid plans are sold through Polar.sh, which acts as merchant of record. Polar handles card details and billing; we receive your subscription status and plan, not your card number.

When you contact us

The contents of your message and your contact details, so we can reply.

3. Purposes and legal basis

4. Who we share data with

We use the sub-processors listed on the GDPR page to run the Service. Each one processes data only to perform its function and under a data processing agreement. We may also disclose data when required by law or to protect our rights, and to a successor if our business is transferred.

Other users see the data you share with them: room members see your name, email, messages, and the documents in that room; people you send documents to for signing see your name and email.

5. Where data is stored

Documents, the database, and backups are stored on Hetzner servers in Germany. Emails are sent through Agdir Email, our own service, which delivers via Amazon SES in Stockholm. Some sub-processors (for example Google, Microsoft, and Polar.sh) may process limited data outside the EEA. Where they do, the transfer is covered by an adequacy decision such as the EU–US Data Privacy Framework, or by the European Commission’s Standard Contractual Clauses.

6. How long we keep data

• Account and content: while your account is active. After you close your account we delete it within 30 days, and it is removed from backups within a further 30 days.
• Audit trails and signed documents: kept as long as the related documents exist, because they are evidence of who did what and when.
• Session records: until the session expires or you sign out.
• Bookkeeping records: five years, as required by the Norwegian Bookkeeping Act (bokføringsloven).
• Analytics: up to 12 months in PostHog.

7. Security

All traffic uses TLS. Files are encrypted at rest with per-file keys, access is restricted to authorised people, and actions on documents and rooms are written to an audit log. See Security for details.

8. Your rights

You have the right to:

• Access — get a copy of the personal data we hold about you
• Rectification — have inaccurate data corrected
• Erasure — have your data deleted, unless we must keep it by law
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — at any time, on the Cookie Policy page, without affecting earlier processing

Email [email protected] to use any of these rights. We answer within one month. If your request concerns a document or room owned by someone else, we will pass it on to them, as they are the controller.

You can complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no, or to the authority in the country where you live or work — in Latvia the Data State Inspectorate, in Lithuania the State Data Protection Inspectorate, and in Estonia the Data Protection Inspectorate.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy. If the changes are material we will tell you by email or in the Service before they take effect. The date at the top shows the latest version.

11. Contact