Privacy Policy – doc.cheap

Effective date: 2026-11-01 · Version: 1.6 · published at https://doc.cheap/privacy.

1. Who we are

Document Cheap Inc., Midvangur 7, 701 Egilsstaðir, Iceland operates doc.cheap. Write to admin@doc.cheap about anything in this policy.

Iceland is a party to the EEA Agreement, into which the GDPR (EU) 2016/679 is incorporated (EEA Joint Committee Decision No 154/2018), "Member State" there being read to include the EFTA States. We are therefore established inside the EEA, so the representative Art. 27 requires of controllers and processors not established there is not needed. There is no data protection officer; Art. 37 does not require one of us.

2. Two very different roles

We are the controller for your account: the person or company that registers, signs in, holds API keys and pays.

We are a processor, and the customer is the controller, for the documents submitted to the API. If your passport was scanned through doc.cheap by a bank, a rental platform or an employer, that company decides why and for how long and your rights are exercised against them; our duties to them are the Data Processing Policy. Section 4 still tells you exactly what happens to the data inside our systems.

3. Account holders – what we hold, why, and for how long

We also keep a normalised form of your e-mail address – lower-cased, with any +tag cut off and, at providers that ignore them, the dots in the name removed – so that one person holds one free monthly allowance however the address is spelled (Art. 6(1)(f), preventing abuse of the free allowance); it is deleted with the account.

Deleting your account erases, in one transaction, the login, the sessions, the sign-in identities, the API keys, the whole ledger, top-up intents, deposit addresses and every scan row and counter. The administrative audit record survives on purpose and carries no document data.

Comments on the blog

Anyone may comment under an article on the blog, without an account. A comment holds the name you type and the text you write, the article and language it was left under, and the time; we ask for no e-mail address. Every comment is read by a person before anything is shown. Once published, the name, the text, the date and any reply from us are public on that article's page. A comment we do not publish is kept, unpublished, as the record of what was sent.

Your network address is never stored with a comment. It is used only to limit how many comments one address can send in an hour: it is turned into a hash and counted in a counter that deletes itself within the hour.

The basis is Art. 6(1)(f) – running a public discussion under our articles and keeping it free of abuse. A comment is kept until you ask us to remove it: write to admin@doc.cheap with the article, the name and roughly when you sent it.

4. Documents submitted to the API – what actually happens

We do not say "nothing is stored", because that is not true at every setting. What is true:

• The uploaded image is never written to durable storage. It lives in the process's memory for the request and is gone when the request ends. The result returned to the caller contains crops of it; the copy we may keep has every image payload stripped.
• The extracted fields are written down when – and only when – the retention window resolved for that call is above zero. For an identity document these routinely include the holder's name, date and place of birth, sex, nationality, document number and expiry, and the machine-readable zone as text; they can include any other field printed on the document, which is why GDPR Art. 9(1) is treated as engaged.
• The window is decided per call. options.retain_hours in the request wins if it is there; otherwise the account's history-retention setting applies. That setting offers 24 hours, 7 days, 30 days or 1 year and defaults to one year (8760 hours).
• retain_hours: 0 stores nothing at all – no row is written, so there is nothing to read back and nothing to delete.
• Expiry is a physical delete, run in bounded batches by a background sweep against expires_at, not a filter that hides rows. Shortening an account's window back-dates the rows it already has.
• Derived display artefacts. A retained scan may carry a non-readable micro thumbnail – longest side 96 px, at most 16 KiB, re-encoded from decoded pixels so no EXIF, GPS or camera tag survives – and the history list shows a display label, a first name and a surname initial. Both are held on the scan row and destroyed with it when its window ends.
• The caller's own reference string is stored with the scan, whatever the caller puts in it.

How to make the service store nothing

Send "retain_hours": 0 in options on every /v1/scans request. That is the product's own zero-retention switch: no scan row, no result, no thumbnail, no history entry. The account setting cannot be set to zero – zero is a per-request choice, by design – so a customer who wants nothing kept must send the field.

5. Who else sees the data

The full record of processing, with each provider's terms, is available from admin@doc.cheap on request. We sell nothing and share nothing for advertising. The cookie banner, our own measurement script, the session recorder, the software that decides which version of a page you see, and the reports your browser makes about our security policy add no recipient at all: every one of them is our own software, running on our own server, and the last of them is never loaded into your browser at all. Two exceptions: Google Analytics, which is loaded only after you allow Measurement and is described in section 7; and the three badge images on our MCP page in the table above. Those images run no script and we set no cookie through them; one directory's server answers its image with cookies of its own, marked for its own site only, which browsers refuse to store when the image is shown on ours. The use of those three images rests on our legitimate interest in showing where the service is listed (Art. 6(1)(f) GDPR); every other badge on that page is a copy served by us, and no other page loads anything from them.

Where our own statistics come from, and what those services get from us. We read figures about ourselves from a handful of outside services: two search engines' webmaster tools report which of our pages they show and what was searched for, already aggregated by them and by day, page, country and device; the package registry reports how often our client package was downloaded; a public directory of integrations publishes a use count; the source-code host publishes counts about the repository; and the edge provider's own dashboard reports the volume of traffic it carried. Every one of those is a pull of numbers about us, and none of them receives anything about you from us – no address, no page view, no identifier of any kind is sent to any of them. The edge provider appears in the table above because it carries the traffic itself, which is a different matter entirely.

6. What leaves the process in a failure report

Reports to the error tracker are built from an allow-list – account id, key prefix, scan id, request id, route, method, status, release, environment and a few similar values – so a field nobody has thought about is dropped by default, and text is scrubbed for data: URLs, long base64 runs, e-mail addresses, bearer tokens and API keys before it is sent. Logs redact credentials, request and response bodies and recognised fields; a request is logged as its path with the query string cut off.

7. Cookies, consent, and how we count visits

We ask before anything that is not strictly necessary. On your first visit a banner appears – on this site and on the documentation alike – carrying three buttons of the same size, weight and shape: Accept all, Reject all and Manage. Behind Manage are two separate questions – Measurement and Trying out changes – and both are off until you switch them on, one at a time if you like. No box is pre-ticked and silence is not consent. Closing the banner with its × records a refusal, which is why that control is labelled Close and reject.

You can change your answer at any time, and changing it back is the same one click. Every page of this site and of the documentation carries a Cookie settings link in its footer, which reopens the panel with your current choices in it. Nothing here is conditional on your answer: the service, the prices, the documentation and this page are identical whichever you give. With no JavaScript running, that footer link is an ordinary link to this page, which carries the same table.

Your answer is remembered in one cookie, dc_consent, for 182 days, and then the banner asks again. We also count the answers themselves – how many people accept, reject, close the banner or change their mind later – as a tally of those four words. That tally carries no identifier of you and no account number, and it is kept because nobody can tell us what proportion of an audience like this one agrees to be measured.

Every cookie and stored value this site can set

Every cookie our server sets is httpOnly and SameSite=Lax, and Secure on https, except sd_signed_in, which a page has to be able to read and which carries no token, no account id and no authority. dc_ft and dc_vid are signed as well, so a value we did not write cannot be handed to us.

Nothing else is written to your device, on any page. Our own measurement software below writes nothing either: it reads one localStorage key, umami.disabled, as an opt-out switch it never sets, and derives everything else on our own server. The two _ga cookies are written by Google Analytics itself, on this site's own domain, and only once you have allowed Measurement.

Why the necessary ones need no consent

Art. 5(3) of Directive 2002/58/EC requires consent for storing information on your device, or reading what is stored there, except what is "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". We are established in Iceland, where the rule that binds us is Art. 88(2) of the Electronic Communications Act No. 70/2022. That rule is drawn wider – it catches equipment that "monitors his activities" too – and its exception is worded differently: such use is allowed "for a lawful purpose and with the knowledge of the user in question". No Icelandic authority has ruled on how far the second formula reaches, so we take the stricter reading of the two: everything that is not strictly necessary to deliver what you asked for sits behind the banner.

On that test the session cookies above are necessary and nothing more. sd_session is how a signed-in page knows it is you; sd_signed_in is how a page built ahead of time knows to offer you the cabinet rather than the sign-in link; sd_verify_email is how a verification code and the page that accepts it find each other; sd_delete_confirm, sd_admin_session and sd_impersonating exist only inside an errand you have already started; blog_comment_sent only tells the page you just sent a comment from that it arrived; and sd_notice_… remembers that you closed a service notice. dc_consent is exempt for the reason the European Data Protection Board's cookie-banner taskforce gave in its report of 17 January 2023: a cookie that remembers the preference you expressed is essential, and a site that forgot your refusal would ask more and store no less.

dc_ft, the first-touch cookie, plainly

What it is for. Most people who register here arrived for the first time weeks earlier, from somewhere else – a search, an article, a link pasted into a chat, somebody else's documentation. Knowing which of those brought a person who later registers is what tells us which of our own pages are worth writing. Nothing on our server can answer it: by the time you register, the step that actually earned the account is long gone.

What it holds. The host of the site that referred you – news.example, never the page you were reading there – the three campaign values in the address you arrived on (utm_source, utm_medium, utm_campaign), the path of the page you landed on with its query string dropped, and the instant you first arrived. Each is cut to 255 characters. It is signed and httpOnly, so no script of ours or of anybody else's can read it.

When it is written. Only after you accept, only by our server, only on the one request that reports your answer, and only once – a later arrival from a second campaign does not overwrite it, which is the whole difference between first touch and last touch. If you typed our address and landed on the front page, nothing is stored at all: there is nothing there we do not already know.

What it is used for, and never used for. At registration it is copied onto your account row in the same statement that creates the account, and the cookie is deleted as soon as it has been copied. It decides nothing – no price, no limit, no content, no message. It is a marketing figure, and a forged one would cost us a wrong number and you nothing at all.

The basis is your consent: Art. 5(3) of Directive 2002/58/EC and Art. 88(2) of Act No. 70/2022 for putting it on your device, and Art. 6(1)(a) of the GDPR (EU) 2016/679 for what we then do with the values.

If you withdraw. From the moment you press Reject, or clear the measurement category, our server deletes the cookie on that same request and never reads it again. If you are signed in when you withdraw, we also clear the values already copied onto your account, on that same request: the referring site, the three campaign values, the landing page and the instant are all emptied together. If you are not signed in we cannot, because nothing on that request tells us which account is yours and we will not guess from an address; in that case the copied values stay until the account is deleted, or until you ask. Withdrawal does not undo what was lawful before it (Art. 7(3)). Write to admin@doc.cheap and we will erase them sooner; that is a request we honour without asking why.

dc_vid, and being shown one version of a page rather than another

What it is for. Sometimes we write one of our own public pages two ways – the front page, or the pricing page – and show each way to some of the people who come, to find out which is clearer. That only means anything if you keep seeing the same version instead of a new one on every visit, so we label your browser and choose from the label.

What it holds. A random value our server generated, and a signature of it. There is no name in it, no address, no account number and nothing worked out from any of those; it is not built from your sign-in cookie, and it joins to nothing else we hold. It is signed, httpOnly and Secure, so no script – ours or anybody else's – can read it or put one of its own in its place.

When it is written. Only after you allow Trying out changes, only by our server, and only on a page that is under test at that moment. When nothing is under test, nothing is written and nothing is read.

If you are signed in, nothing is put on your device for this at all. We use your account's own identifier, which we already have.

What we write down. When a page under test is shown to you: which test, which version you were shown, the label (or the account) it was chosen for, and the instant. Nothing else – not where you went next, not what you did there. The first time counts and a second visit adds nothing.

What it never changes. Which words and which layout one of our own public pages is written with. It never changes the price, what you are charged, the Terms of Service, this policy, what the service does, or anything you are allowed to do here – our legal texts and our prices are never under test – and it never touches an account, a balance or a recognition result.

Nobody else is involved. The software that holds these tests runs on our own server, its database runs on our own server, and only our server reads them. None of it is loaded onto any page you see, and it is never told anything about you: which version you get is worked out inside our own process, from the label above.

The basis is your consent: Art. 5(3) of Directive 2002/58/EC and Art. 88(2) of Act No. 70/2022 for putting the label on your device, and Art. 6(1)(a) of the GDPR (EU) 2016/679 for choosing a version from it and writing that down.

If you withdraw. Our server deletes dc_vid on that same request, and you leave every test at once: with no label there is no version to choose, so the next page you open is the ordinary one and nothing more is recorded. Withdrawal does not undo what was lawful before it (Art. 7(3)), so the record that you were shown a version stays – it is deleted 13 months after it was made, with the rest of the measurement, and at once if you delete your account. Write to admin@doc.cheap and we will erase it sooner.

What changes with each answer

If you reject both, or close the banner, or never answer. The site sets the session cookies above and nothing else. No measurement script is fetched, no recording is made, no first-touch cookie is written, and any that existed is deleted by our server on the same request. What still happens is what happens whether you visit or not: our own server writes down that it answered a request and that it sent a page, described below, which touches nothing on your device.

If you accept measurement. Four further things happen, and only these four: the first-touch cookie above is written; our own measurement script is loaded from this site and reports the pages you read; on the public pages only, a session recording and a heatmap may be made of that reading; and Google Analytics is loaded and counts the same reading, as described below. Allowing Trying out changes is a separate answer with its own separate effect, and it is the subsection on dc_vid above.

What the measurement script reports

It is our software, served from this site, reporting to our own server. For each page you open it sends: the path you are on with everything but the campaign parameters cut off the address, the previous page of ours you came from, the title of the page, our own hostname, your browser's language, the size of your screen, and how quickly the page loaded and responded. Clicks are reported by name only – elements we have labelled ourselves, such as a particular button – and the code that does it has no way to read a value, so what you type cannot travel with it. The query string of a sign-in, registration or verification address is cut whole before anything is sent.

From your address and your browser's description the tool works out which requests belong to one session, using a secret changed every day, so a visit cannot be joined to one made the day before. From the moment you withdraw, the very next thing it would have sent is not sent.

Google Analytics

Only if you allow Measurement. Until you do, nothing is requested from Google at all – not the script, not a signal that you said no. When you allow it, this site loads Google's analytics script from www.googletagmanager.com, tells it that measurement is allowed and that advertising is not, and it sets the two _ga cookies in the table above. It runs on this site, on the documentation and in the cabinet, and never on the administrator console.

What it receives. The address of the page you are on – cut the same way as for our own script, so only the campaign parameters survive and an id in the address is replaced by a placeholder – the page's title, the previous page of ours, the random number in the _ga cookie, your browser and device type, your screen size and language, and an approximate location that Google works out from your connection's address. For visitors in the EEA, Switzerland and the UK, Google states that it uses that address only to work out the location and then discards it, and does not log or store it. It also receives a list of named things you did here: that you scrolled to the end of a page, clicked a link to another site, downloaded a file, used a form, pressed one of our labelled buttons, switched the site's language, copied an example from the documentation, created an account, signed in, confirmed your e-mail address, created an API key, the outcome of a recognition you ran on the landing page or in the cabinet (recognised or not, and why not), started or completed a top-up (its amount in dollars and the currency it was paid in), and that an error page was shown to you (its status code).

What it never receives. Your e-mail address, your name, your password, anything you type into a form, and anything from a document – not a field, not a document type, not the image. Every event is checked against a fixed list before it is sent, and one that carries anything shaped like an e-mail address or a document line is not sent at all. If you are signed in, Google is given a pseudonym for your account – a one-way code derived from our internal account number, which cannot be turned back into it and matches nothing else – so that visits from your phone and your laptop count as one person. An administrator's visits while signed in are marked as ours and excluded from the figures.

What it is never used for. Advertising. Google signals, advertising features, ad personalisation and the sharing of data with other Google products are all switched off, and no advertising account is linked.

Who is responsible. Google processes this data for us as our processor, under Google's data processing terms. The basis is your consent: Art. 5(3) of Directive 2002/58/EC for the cookies and Art. 6(1)(a) GDPR for the data. Google Analytics keeps it for 14 months and then deletes it.

If you withdraw. From that moment the script sends nothing more, and the _ga cookies are deleted from your browser on the same click. What Google already received stays until its 14 months run out; write to admin@doc.cheap and we will ask Google to delete the data tied to your account's pseudonym sooner.

Session recordings and heatmaps

Where. The public pages only – the landing page, the product, pricing and comparison pages, the country pages, the free tools, the status page, the documentation and these legal pages. Never the cabinet, the administrative console, your account pages, the sign-in, registration or verification pages. That boundary is written into the code rather than set in a dashboard, and it is enforced twice: the recorder is loaded only on a page it is allowed on, and every batch it tries to send is discarded at the moment of sending if the page it describes is not one of them.

What a recording is. The shape of the page, where the pointer moves, what is clicked, how far you scroll, and how the page changes as you use it. A heatmap is the same material added up across many visits.

What is never in one. All text is masked – every word on the page is stored as asterisks, including anything you type, so a recording shows that a field was filled and never with what. Nothing drawn on a canvas is recorded and no image is stored inside a recording. The document demo on the front page is blocked entirely: the widget and everything inside it – the file you choose, the preview drawn from it and the fields read out of it – are replaced by a blank placeholder before anything is stored. We checked that by recording a document through the demo and searching the stored result: not one value, not one image, not one marker from inside the widget.

Why we do it. To see where a page loses people and which part of an explanation is unreadable – on pages we wrote, not on pages that show your data.

How long. Recordings and heatmap points are deleted after 14 days. The plain page counts live longer, as below.

How we count visits

The half that asks nothing. When our server sends a page, it records that it sent one, into measurement software that runs on our own machine. There is no script on the page for this, no cookie, and nothing written to or read from your device – so there is nothing to block, and nothing for Art. 5(3) of Directive 2002/58/EC to ask consent for. That record holds the address of the page, including any campaign parameters and with one-time credentials cut out; the page that referred you; the language your browser asked for; the address your request came from; and the description your browser sends of itself. From the last two the tool works out which visits belong to one session, using the same secret changed every day. These page-view records are deleted after 13 months.

We also keep a record of the request itself, the one described in section 3, in our own database. That record keeps the address your request came from, for 400 days, and is then deleted by the same job that writes it. The address is kept because it is where an investigation into abuse begins – a fraudulent top-up, a scripted registration, an attack on the sign-in form – and because a count with no address cannot tell one visitor from ten thousand requests. The figures we actually read are built from daily and hourly totals that carry no address at all, and both they and the record beneath them are read through a database account that can do one thing: read, in the measurement schema, and nowhere else in our systems.

The basis for those two is our legitimate interest under Art. 6(1)(f), and it has been weighed. The interest is in knowing how much traffic the service serves, which of it is machines, and being able to investigate abuse of a service that gives credit away for free. Against that: the information is what your own request carried to us, none of it is bought, enriched or joined to anything that names you, none of it decides anything about you, none of it is sold or shared for advertising, it stays on our own server, and it deletes itself. On that balance your interests and rights do not override ours – but you may object at any time (section 9), and where you do we stop unless we can show compelling legitimate grounds, which for a traffic statistic we cannot.

The one question we ask

The registration form asks, optionally, how you heard about us: ten choices in a random order with a "something else" box of at most 120 characters. You can skip it, and skipping it changes nothing – not the account, not the price, not a single thing you can do here. What you pick is stored on your account row as one word, kept for as long as the account exists and deleted with it. We ask because a link pasted into a chat and an arrival from inside an assistant carry no trace at all, so this is the only instrument that sees them; we read it as a tiebreaker and never as a number. The basis is our legitimate interest under Art. 6(1)(f) – not answering is the simplest objection there is, and you can also write to us and have the answer removed.

Reports about our own security policy

Our pages carry a content security policy, and your browser is asked to report to us when a page tries to load something the policy does not allow. Today that policy only watches and blocks nothing. A report is written by your browser, not by us, and it holds: the address of the page, the page that referred to it, the address that was refused, which rule was involved, the policy itself, the response status and, where it is known, the file and line it happened in. It never contains a sample of the page's content – a browser includes one only where the policy asks for it, and ours does not. Reports go to our own error tracker, on our own server; no third party receives them.

Cloudflare sets no cookie on https://doc.cheap/ as the site is configured. Where Cloudflare's bot products are on, its own __cf_bm (30 minutes) and cf_clearance may appear; both are strictly-necessary security cookies documented by Cloudflare.

No analytics beacon. Cloudflare's edge used to inject a static.cloudflareinsights.com analytics script into HTML responses. That injection has been switched off, and no such script is served any more: pages from https://doc.cheap/ now carry no cloudflareinsights script and no cf-beacon attribute. No advertising or profiling script loads anywhere on this site, and the one third-party analytics script – Google Analytics, above – loads only after you allow Measurement.

What our MCP server tells us about itself

If you use our published MCP server, every call it makes to our API names itself – the package and its version – and, where the tool you are running it in reports one, that tool's name and version. That is how we can tell how much use arrives that way. It sends nothing about you, your machine or your documents, it is never used to decide anything, and setting the environment variable DO_NOT_TRACK=1 removes the tool's name and version completely. The package's own name and version stay, because a program has to say what it is to the service it calls. The package's README states the same thing.

8. Security

One hardened server, key-only SSH, no published ports, every third-party image pinned by digest, the recognition engine on an internal network reachable only by the API, secrets in a root-only file, nightly database dumps encrypted to a key whose private half never touches the server, and an independent watchdog. The uploaded image never reaches disk. The server's disks are not encrypted at rest – stated, not glossed.

9. Your rights

You may ask us for access, rectification, erasure, restriction, portability, and to object to processing based on legitimate interests (GDPR Arts. 15-21). Write to admin@doc.cheap; we answer within one month, and deleting the account from the cabinet does most of it immediately. Where we rely on your consent you may withdraw it at any time (Art. 7(3)) from the Cookie settings link at the bottom of any page – one click, the same one click it took to give – which does not affect what was lawful before you did. Withdrawing deletes the cookies it covers on that same request, Google Analytics' _ga cookies included, and if you are signed in when you withdraw measurement it also clears the first-touch values already copied onto your account (section 7). You may complain to a supervisory authority (Art. 77) – Persónuvernd, the Icelandic Data Protection Authority (Laugavegur 166, 105 Reykjavík, postur@dpa.is), which is our lead authority, or the one in your own country.

If the data is in a document somebody else submitted, we are only the processor: go to the company that submitted it. We hold no name, address or other handle by which a document holder could be found in our systems, so we often cannot identify you without that company's help.

10. No automated decisions, no children, changes

The API returns extracted data; it decides nothing about anyone. Any decision – approve, refuse, verify – is the customer's, so on our side there is no automated decision-making producing legal or similarly significant effects within the meaning of Art. 22. The service is for people aged 18 or over; we do not knowingly open accounts for minors.

We may publish a new version of this policy; a change that materially affects you is notified by e-mail to the account address, or by a notice in the cabinet, before it takes effect. Questions and requests: admin@doc.cheap.