1. Introduction
Welcome to doxlo ("we", "our", or "us"). doxlo is an AI-powered study assistant operating through Telegram and the web at doxlo.ai. This Privacy Policy explains how we collect, use, store, and protect your personal information.
By using doxlo, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.
2. Information We Collect
2.1 Information You Provide
- Telegram profile data: Your Telegram user ID, first name, username (if public), and language preference. We do not access your phone number or contact list.
- Uploaded content: Documents, PDFs, images, and text you send to doxlo for processing (summaries, flashcards, mind maps, quizzes).
- Communications: Messages you send us via email, support channels, or in-bot feedback.
- Payment information: If you subscribe to a paid plan, we collect billing data through our payment processors. We do not store full credit card numbers on our servers.
2.2 Information Collected Automatically
- Usage data: Commands sent, features used, approximate file sizes, and processing timestamps.
- Technical data: Device type, operating system, IP address (only for abuse prevention), and error logs.
- Referral data:If you were invited via a referral link, we record the inviter's ID to credit their bonus.
2.3 What We Do NOT Collect
- Your Telegram phone number or contacts
- Private messages with other users
- Biometric data, health data, or political/religious beliefs
- Location data (beyond country-level for localization)
3. How We Use Your Information
We use your information only for the following legitimate purposes:
- Service delivery: To process your documents and generate study materials (summaries, mind maps, flashcards, quizzes).
- Personalization: To remember your preferences (language, dialect, study level) for a better experience.
- Communication: To respond to support requests and notify you of important service updates.
- Safety & abuse prevention: To detect misuse, prevent fraud, and enforce our Terms of Service.
- Product improvement: We analyze aggregated, anonymized usage patterns to make doxlo better. We never train AI models on your private content.
- Legal compliance: To comply with applicable laws, court orders, and government requests.
4. How Long We Keep Your Data
| Data Type | Retention Period |
|---|---|
| Uploaded documents (PDFs, images, text) | Deleted immediately after processing (within minutes) |
| Generated outputs (PDFs, mind maps, etc.) | Stored in your account so you can re-download anytime; deleted on account deletion |
| Account data (Telegram ID, preferences) | Kept until account deletion |
| Usage logs | 90 days, then anonymized |
| Payment records | 7 years (legal requirement) |
| Support communications | 2 years after last interaction |
5. How We Share Your Information
We do not sell, rent, or trade your personal data. We share information only with:
5.1 AI Processing Providers
To generate study materials, we send your content to trusted AI providers under strict contracts that prohibit data retention and model training on your content:
- Google (Gemini API): Used for content analysis and generation. Google's API terms.
- Vercel & cloud infrastructure: For hosting, analytics, and PDF generation.
- Telegram: doxlo is delivered through Telegram's Bot API. See Telegram's Privacy Policy.
5.2 Payment Processors
Payments are processed by Stripe, Paymob, Fawry, and other regional providers. We receive a payment confirmation only; we do not handle your card details directly.
5.3 Legal Requirements
We may disclose information if required by law, to prevent fraud, protect our users, or enforce our rights. We will always challenge overbroad requests when lawful to do so.
5.4 Business Transfers
If doxlo is merged, acquired, or sold, your data may transfer to the new entity. We will notify users of any ownership change at least 30 days in advance.
6. Your Rights
Regardless of where you live, you have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Correct inaccurate or incomplete data.
- Erasure: Delete your account and associated data (subject to legal retention requirements).
- Restriction: Limit how we process your data.
- Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to specific uses of your data.
- Withdraw consent: Revoke consent you previously granted.
To exercise any of these rights, email us at [email protected]. We respond within 30 days.
7. Data Security
We implement industry-standard security measures to protect your data:
- TLS 1.3 encryption for all data in transit
- AES-256 encryption for data at rest
- Regular security audits and penetration testing
- Principle of least privilege for employee access
- Multi-factor authentication for all admin accounts
- Incident response plan with 72-hour breach notification
No system is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security. In the unlikely event of a data breach affecting your information, we will notify you within 72 hours as required by applicable law.
8. Children's Privacy
doxlo is intended for users 13 years and older. We do not knowingly collect personal information from children under 13. Users aged 13-17 should use doxlo with parental consent.
If you believe a child under 13 has provided us with personal data, please contact [email protected] and we will delete it immediately.
For schools and institutions serving minors, we support FERPA-aligned data handling. Contact [email protected] for our institutional data processing agreement.
9. International Data Transfers
doxlo operates globally. Your data may be processed in countries other than yours, including the United States and the European Union. We ensure appropriate safeguards:
- Standard Contractual Clauses (SCCs) with all processors
- Data residency options for enterprise customers (MENA region available)
- Adherence to GDPR principles regardless of user location
10. Cookies & Tracking
Our website uses minimal cookies:
- Essential cookies: Required for the site to function (cannot be disabled).
- Analytics cookies: Anonymous usage statistics via Vercel Analytics (no personal identifiers).
We do not use advertising cookies, behavioral tracking, or third-party pixels.
11. AI and Automated Decision-Making
doxlo uses AI models to generate study materials. These are informational tools only and do not make decisions with legal or similarly significant effects on you. You can always request human review by emailing [email protected].
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be announced via in-bot message and a prominent notice on doxlo.ai at least 14 days before taking effect. Continued use of doxlo after changes means you accept the updated policy.
13. Contact Us
Questions, concerns, or requests? Reach out:
- Email (General & Privacy): [email protected]
- Telegram support bot: @doxloSupportBot
We typically respond within 48 hours. For urgent privacy concerns, mark your email subject with [URGENT].