Privacy Policy

1. Who this policy covers

This policy describes how the Document Control website operator handles personal data through document-control.com, including account registration, company workspaces, demo inquiries and public file pages.

The operator handles account, service and support information to provide Document Control. Each company decides why and how the customer, supplier, employee and document information it adds to its workspace is used. For that information, contact the company administrator first; the operator assists with requests concerning the service.

2. Information collected

Information comes from you, your company administrator, the records people upload and use of the service. Depending on the features used, it includes:

• Account information: name, email address, password hash, company, department, access permissions and profile picture if provided.
• Workspace information: business and contact details, customer and supplier records, employee and HR records, accounting entries, assets, stock, documents, attachments, versions, comments and approval or acknowledgment activity.
• Service information: subscription selections and payment evidence, and the company name, contact name, email, optional phone number and message submitted with a demo or support request.
• Technical records: connection IP address, access time, visited menu, request status, download counts and activity history, including the time of password changes and old/new email addresses for email changes. Password values are not included in account-change history.

3. Why information is used

Information is used to create and authenticate accounts, provide company workspaces, control access, store and retrieve documents, process approvals, maintain history, handle subscriptions and payments, respond to inquiries and investigate errors or misuse.

Processing is based on providing the requested service or taking steps before a contract, legitimate interests in security and administration, applicable legal obligations, or consent when it is requested, such as consent to contact you about a demo. Required fields support the relevant service; without them we may be unable to create an account or handle a request. Optional fields can be left blank.

Companies should add only information needed for their work and establish an appropriate basis for processing other people’s data, particularly sensitive information in HR records or attachments.

4. Who can see the information

Workspace data is available to company administrators and users within their assigned permissions. The website operator and authorized technical service providers may access information as needed to operate, support or secure the service. Information may also be disclosed when required by applicable law or a valid request from a competent authority.

A public share link allows anyone holding it to view the file information and download the selected version without signing in. A file published in a business public catalog also exposes the business name and the listed file information. The person publishing the file is responsible for checking that its contents can be shared.

Revoking a share link or removing a file from a public catalog prevents further access through that publication, but cannot retrieve copies already downloaded. Separately created share links must be managed separately.

5. Cookies and browser storage

Session cookies maintain sign-in state and protect form submissions. The language cookie remembers a selected language for up to one year. Local storage remembers preferences such as theme and date/time display, while session storage can retain menu position within a tab.

You can clear or block cookies and browser storage in your browser settings. Doing so may sign you out, reset preferences or prevent account features from working. Public policy content remains readable without signing in.

6. How long information is retained

Account and workspace information is retained while needed to provide the service and support the company’s records. Payment records, security logs and evidence of transactions or requests may need to remain for applicable legal obligations, dispute handling or security purposes. The relevant purpose and legal requirements determine the retention period.

Moving a file to Trash retains its contents and versions for recovery. Disabling an account, revoking a public link or hiding a public listing does not by itself erase the underlying records. Contact us to request deletion; we will assess the request, dependencies, company instructions and any required retention, and explain any limits.

7. Protecting information

The service uses HTTPS, password hashing, company and user access controls, and activity records to help protect information. Administrators should review permissions, public links and account access regularly. Users should keep credentials private and avoid uploading unnecessary personal information.

8. Your rights and deletion requests

Subject to applicable law, you may request access to or a copy of your personal data, correction, deletion, restriction, portability or objection to processing, and withdraw consent for processing that relies on consent. You may also complain to the competent personal data protection authority. Withdrawal does not affect processing already carried out lawfully.

For company-managed records, contact your company administrator. For your Document Control account, demo inquiry or another service-related request, use the following steps:

1. Email [email protected] with the subject “Document Control — Privacy request” or “Document Control — Data deletion”.
2. Provide your account email, company name if relevant, the information concerned and the action requested. Do not send passwords, one-time codes or unnecessary sensitive documents.
3. We may ask for information needed to verify your identity or authority, then review the request with the relevant company where needed. We will respond with the outcome, next steps or reasons for any limitation within the period required by applicable law.

Email a privacy request

Thailand Personal Data Protection Committee (PDPC) ↗

9. Facebook / Meta and external services

Document Control provides links to Facebook / Meta, LINE and other external services. Opening those links or sharing a website URL uses the external provider’s service and is subject to its own privacy policy. Website metadata identifies the Document Control app for link previews; the current account sign-in flow uses email and password, not Facebook Login.

Some application pages may request font resources from Google. The provider receives the connection information necessary to deliver those resources. Review an external service’s privacy information before supplying data there.

10. Updates and contact

Changes to this policy will be published on this page with an updated date. Questions about the handling of personal data can be sent to the Document Control website operator at [email protected] or LINE @AutomationSoft.