Privacy policy

Who we are

DocBunker (docbunker.app) is published by SL LABS (see the legal notice). The data controller for account data is SL LABS (Stan Leon), 2 impasse Henri Bille, 34500 Béziers, France. For any question about this policy or your data, write to contact@docbunker.app. No data protection officer has been appointed, as none is required.

Two roles to tell apart

The professional (the person who creates a client folder) is the data controller for the documents, comments and information about their clients that they upload to DocBunker. DocBunker then acts as a processor: it hosts and protects this data on the professional’s behalf and does not use it for its own purposes. A data processing agreement (GDPR article 28) is available on request.

DocBunker is the data controller for the data needed to run the professional’s account (e-mail address, sign-in, security).

Data we process

• Professional: e-mail address (sign-in identifier), one-time sign-in code (stored as a hash, valid for 10 minutes), sign-in session (technical cookie, 30 days).
• Referrals: personal referral code, and the link between the referrer and the referral who signed up with their link (no cookie: the code travels with the sign-in request). The referrer sees the referral’s address masked (“j***@example.com”) and the status of the referral.
• Client folders: title, uploaded documents, comments, names entered by the professional or their client.
• Client: no account. Access is through a private link. The client may enter a name when commenting.
• Client notifications (optional): when turned on, the client’s e-mail address, entered by the professional (who answers for their client’s agreement) or confirmed by the client themselves. It is only used to send a recap when new documents are added (never a file name); every e-mail has an unsubscribe link. The address is deleted with the folder.
• Contact form and support: name, e-mail address and message, only to answer your request.
• Activity log: opening of the folder, upload, download, deletion, comment and management actions, with the date. It is visible to the professional. No IP address or browser fingerprint is recorded in it.
• Security: files are scanned by a rule engine before they become available. To limit abuse, temporary counters tied to the IP address are kept for a few hours to a few days.

For subscriptions we also process your billing name and address, your VAT number if any, and the status of your subscription. Card details are entered with Stripe: they do not pass through DocBunker and are never stored by us.

Legal bases

• Running the account and providing the service (sign-in, folders, file scanning, referral programme): performance of the contract, GDPR article 6(1)(b).
• Security, abuse prevention, rate limits and technical logs: legitimate interest in running a secure service, article 6(1)(f).
• Billing and keeping invoices: legal obligation, article 6(1)(c).
• Contact and support: pre-contractual steps and performance of the contract (b), or legitimate interest in answering (f).
• Notifications to a folder’s client: the client’s consent (a), given through the confirmation e-mail and withdrawable at any time with effect for the future (unsubscribe link in every e-mail). When the professional enters the address themselves, they are responsible for their client’s agreement; we then act as their processor.

Providing your e-mail address is necessary to use the service: without it there is no account. There is no automated decision-making including profiling within the meaning of article 22 GDPR; the automatic file scan blocks files using malware rules and takes no decision about people.

Cookies

DocBunker only uses a technical session cookie for the signed-in professional, and a language preference cookie. There is no advertising and no audience measurement tool, so no consent banner is needed.

Hosting and processors

The service is hosted by Cloudflare. The database and file storage are configured in the European Union jurisdiction. E-mails (sign-in codes, notifications) are sent through Cloudflare Email Sending. Payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland). Cloudflare also processes technical data (IP addresses, request logs) to deliver and protect the service, under its own terms. Cloudflare and Stripe are US companies: any transfer of data outside the European Union relies on the European Commission’s standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.

Security

Encrypted connections (HTTPS), secret client links that expire and can be revoked, file scanning before sharing, quarantine then deletion of files judged dangerous, activity log reserved for the professional. No measure guarantees absolute security: the scan detects known threats, not every threat.

Retention

• A folder, its documents, comments and log are kept until the professional deletes them. Expiry or deactivation of the client link blocks the client’s access but does not delete the folder.
• Deleting a folder also deletes its stored files.
• Sign-in codes expire after 10 minutes, sessions after 30 days. A file upload that is interrupted and never completed is deleted within 24 hours.
• Invoices and accounting records related to subscriptions are kept for the legal period (10 years).

Your rights

You may request access, rectification, erasure, restriction or portability of your data, or object to a processing based on legitimate interests, and withdraw a consent at any time with effect for the future (GDPR article 7(3)). If you are a professional’s client, contact them first, then us: we will help them respond. You also have the right to lodge a complaint with any data protection authority, in particular where you live or work, or with the CNIL, which is competent for us (cnil.fr).

Changes

This policy may change as the service evolves. The date above shows the latest update.