Privacy Policy — doc.cheap
Effective date: 2026-09-20 · Version: 1.0 · published at
https://doc.cheap/privacy.
1. Who we are
Document Cheap Inc., Midvangur 7, 701 Egilsstaðir, Iceland operates doc.cheap. Write to admin@doc.cheap about anything in this policy.
Iceland is a party to the EEA Agreement, into which the GDPR (EU) 2016/679 is incorporated (EEA Joint Committee Decision No 154/2018), "Member State" there being read to include the EFTA States. We are therefore established inside the EEA, so the representative Art. 27 requires of controllers and processors not established there is not needed. There is no data protection officer; Art. 37 does not require one of us.
2. Two very different roles
We are the controller for your account: the person or company that registers, signs in, holds API keys and pays.
We are a processor, and the customer is the controller, for the documents submitted to the API. If your passport was scanned through doc.cheap by a bank, a rental platform or an employer, that company decides why and for how long and your rights are exercised against them; our duties to them are the Data Processing Policy. Section 4 still tells you exactly what happens to the data inside our systems.
3. Account holders — what we hold, why, and for how long
| Data | Why (legal basis) | Kept |
|---|---|---|
| Name and e-mail address, and whether the address is verified | to run the account you asked for — Art. 6(1)(b) | until the account is deleted |
| Password, stored only as a hash | same | same |
| Google sign-in identity (issuer, provider account id, tokens) where you sign in that way | same | same |
| API keys — a short non-secret prefix and a hash; the key itself is never stored | same | until revoked, then as an audit record; deleted with the account |
| Credit ledger and top-up records | Art. 6(1)(b) and, for accounting records, Art. 6(1)(c) | deleted with the account |
| Sign-in sessions, with the IP address and browser user-agent of the session | security and abuse prevention — Art. 6(1)(f) | until the session expires or the account is deleted |
| Administrative actions on an account (who did what, with IP and user-agent) | Art. 6(1)(c) and 6(1)(f) — accountability | kept after the account is gone, deliberately, as the record that it was closed |
| Server logs: request path, status, timing, request id, the caller's address | Art. 6(1)(f) — running and defending the service | the container's log stream; no collector ships or archives it |
| Error reports to our own tracker, running on our own server | Art. 6(1)(f) | 30 days, and at most 10 000 events per project |
Deleting your account erases, in one transaction, the login, the sessions, the sign-in identities, the API keys, the whole ledger, top-up intents, deposit addresses and every scan row and counter. The administrative audit record survives on purpose and carries no document data.
4. Documents submitted to the API — what actually happens
We do not say "nothing is stored", because that is not true at every setting. What is true:
- The uploaded image is never written to durable storage. It lives in the process's memory for the request and is gone when the request ends. The result returned to the caller contains crops of it; the copy we may keep has every image payload stripped.
- The extracted fields are written down when — and only when — the retention window resolved for that call is above zero. For an identity document these routinely include the holder's name, date and place of birth, sex, nationality, document number and expiry, and the machine-readable zone as text; they can include any other field printed on the document, which is why GDPR Art. 9(1) is treated as engaged.
- The window is decided per call.
options.retain_hoursin the request wins if it is there; otherwise the account's history-retention setting applies. That setting offers 24 hours, 7 days, 30 days or 1 year and defaults to one year (8760 hours). retain_hours: 0stores nothing at all — no row is written, so there is nothing to read back and nothing to delete.- Expiry is a physical delete, run in bounded batches by a background sweep
against
expires_at, not a filter that hides rows. Shortening an account's window back-dates the rows it already has. - Derived display artefacts. A retained scan may carry a non-readable micro thumbnail — longest side 96 px, at most 16 KiB, re-encoded from decoded pixels so no EXIF, GPS or camera tag survives — and the history list shows a display label, a first name and a surname initial. Both are held on the scan row and destroyed with it when its window ends.
- The caller's own
referencestring is stored with the scan, whatever the caller puts in it.
How to make the service store nothing
Send "retain_hours": 0 in options on every /v1/scans request. That is
the product's own zero-retention switch: no scan row, no result, no thumbnail,
no history entry. The account setting cannot be set to zero — zero is a
per-request choice, by design — so a customer who wants nothing kept must send
the field.
5. Who else sees the data
| Recipient | What for | Where |
|---|---|---|
| Our hosting provider (Coolhousing) | the dedicated server everything runs on | Prague, Czech Republic (EU) |
| Cloudflare | DNS, TLS termination, the tunnel that carries all traffic, edge protection | global network; the point of TLS termination cannot be pinned to the EEA on the plan in use |
| Proton Mail | sending verification and notification e-mail from admin@doc.cheap |
Switzerland, covered by a European Commission adequacy decision |
| Our error tracker | diagnosing failures | on our own server, not a third party |
| GitHub | source code only | no personal data of customers or document holders |
The full record of processing, with each provider's terms, is available from admin@doc.cheap on request. We sell nothing and share nothing for advertising.
6. What leaves the process in a failure report
Reports to the error tracker are built from an allow-list — account id, key
prefix, scan id, request id, route, method, status, release, environment and a
few similar values — so a field nobody has thought about is dropped by default,
and text is scrubbed for data: URLs, long base64 runs, e-mail addresses,
bearer tokens and API keys before it is sent. Logs redact credentials, request
and response bodies and recognised fields; a request is logged as its path with
the query string cut off.
7. Cookies and browser storage
We use no advertising, profiling or tracking cookies, and there is no consent banner because nothing we set requires consent under Art. 5(3) of Directive 2002/58/EC: each item below is strictly necessary for a function you asked for.
| Name | What it is | Life |
|---|---|---|
sd_session |
the session token for the cabinet; httpOnly, SameSite=Lax |
7 days |
sd_signed_in |
a readable marker that a session exists, so a statically-built page can show the right header. No token, no account id, no authority | 7 days |
sd_verify_email |
the address a verification code was just sent to; httpOnly |
30 minutes |
sd_delete_confirm |
a one-shot marker that you left to sign in again on the way to deleting your account; httpOnly |
10 minutes |
sd_admin_session, sd_impersonating |
set only in our own administrative console; httpOnly |
30 minutes |
sd_notice_… (sessionStorage, not a cookie) |
remembers that you dismissed a service notice | the browser tab |
Cloudflare sets no cookie on https://doc.cheap/ as the site is configured.
Where Cloudflare's bot products are on, its own __cf_bm (30 minutes) and
cf_clearance may appear; both are strictly-necessary security cookies
documented by Cloudflare.
No analytics beacon. Cloudflare's edge used to inject a
static.cloudflareinsights.com analytics script into HTML responses. That
injection has been switched off, and no such script is served any more:
pages from https://doc.cheap/ now carry no cloudflareinsights script and no
cf-beacon attribute. No third-party analytics, advertising or profiling
script loads anywhere on this site, so there is nothing here that would ask
for your consent.
8. Security
One hardened server, key-only SSH, no published ports, every third-party image pinned by digest, the recognition engine on an internal network reachable only by the API, secrets in a root-only file, nightly database dumps encrypted to a key whose private half never touches the server, and an independent watchdog. The uploaded image never reaches disk. The server's disks are not encrypted at rest — stated, not glossed.
9. Your rights
You may ask us for access, rectification, erasure, restriction, portability,
and to object to processing based on legitimate interests (GDPR Arts. 15-21).
Write to admin@doc.cheap; we answer within one month, and deleting the
account from the cabinet does most of it immediately. You may complain to a
supervisory authority (Art. 77) — Persónuvernd, the Icelandic Data
Protection Authority (Laugavegur 166, 105 Reykjavík, postur@dpa.is), which is
our lead authority, or the one in your own country.
If the data is in a document somebody else submitted, we are only the processor: go to the company that submitted it. We hold no name, address or other handle by which a document holder could be found in our systems, so we often cannot identify you without that company's help.
10. No automated decisions, no children, changes
The API returns extracted data; it decides nothing about anyone. Any decision — approve, refuse, verify — is the customer's, so on our side there is no automated decision-making producing legal or similarly significant effects within the meaning of Art. 22. The service is for people aged 18 or over; we do not knowingly open accounts for minors.
We may publish a new version of this policy; a change that materially affects you is notified by e-mail to the account address, or by a notice in the cabinet, before it takes effect. Questions and requests: admin@doc.cheap.