Privacy Policy

This notice explains how DocuCue handles personal data when people create accounts, use a company workspace, upload certificates or licences, manage subscriptions, contact support, or otherwise use the service.

Last updated: 19 September 2026

1. Who we are

DocuCue is a UK-based certificate and licence tracking service for businesses. For personal data used to operate accounts, billing, support, security and the DocuCue service itself, DocuCue acts as the data controller.

For worker and certificate information uploaded by a customer organisation, that organisation will generally decide why the information is used. In those circumstances, DocuCue processes the information on the organisation's behalf as part of providing the service.

Privacy questions and requests can be sent to docunudgeapp@outlook.com.

2. Personal data we may process

Account data: email address, authentication and session information, workspace membership, account preferences and related account identifiers.

Organisation data: company or workspace name, membership role and subscription status.

Worker and certificate data: worker names, certificate or licence names, certificate numbers, issuing bodies, issue or expiry dates, uploaded PDF/JPG/PNG documents and other information contained in those documents.

Billing data: Stripe customer and subscription identifiers, selected plan, billing status and related subscription information. Payment card details are entered into Stripe's hosted checkout and are not stored in the DocuCue database.

Technical and security data: information needed to operate and protect the service, which may include IP address, request logs, browser/device information, timestamps and security events handled by our hosting and infrastructure providers.

Support data: information you send when you contact us for help.

3. Why we use personal data

We use personal data to create and secure accounts and workspaces, provide certificate and licence tracking, process document uploads, generate expiry information and reminders, provide AI-assisted document reading, manage subscriptions and billing, provide support, prevent abuse, diagnose problems and maintain the security and reliability of DocuCue.

AI-assisted document reading is used to help extract fields from uploaded certificates and licences for the user to review and verify. It is not intended to make solely automated decisions about people that produce legal or similarly significant effects.

4. Lawful bases

Depending on the activity, DocuCue may rely on performance of a contract to provide the service, legitimate interests in operating and securing the service, compliance with legal obligations such as financial or accounting requirements, and consent where consent is specifically requested for an optional activity.

Where DocuCue processes worker or certificate data on behalf of a customer organisation, that customer is responsible for identifying its own lawful basis for collecting and using that personal data.

5. Service providers and sharing

We use specialist service providers to operate DocuCue. These currently include:

Supabase for authentication, database and private document storage.
Cloudflare for application hosting, security, delivery infrastructure and AI-assisted document processing.
Stripe for subscription checkout, payment processing, billing and customer payment management.

We may also disclose information where required by law, to protect the security or rights of DocuCue or others, or as part of a lawful business restructuring. We do not sell personal data.

6. International transfers

Some service providers may process personal data outside the UK. Where an international transfer requires safeguards, we rely on appropriate mechanisms available under UK data-protection law, such as adequacy regulations or approved contractual safeguards used by our service providers.

7. How long we keep data

We keep account, workspace, worker and certificate data for as long as needed to provide the service to the relevant customer. When an account or workspace is closed, information may be retained for a limited period where reasonably necessary for backups, security, dispute handling, fraud prevention, legal obligations or accounting requirements before deletion or anonymisation.

Stripe and other service providers may retain records under their own legal and operational retention requirements.

8. Security

DocuCue uses technical and organisational safeguards designed to protect personal data. These include authenticated access, organisation-level access controls, private document storage, server-side secret management, restricted storage access and transport security. No internet service can guarantee absolute security.

9. Your data-protection rights

Depending on the circumstances and the lawful basis used, you may have rights to access, correct, erase, restrict or object to the use of your personal data, and to receive certain personal data in a portable format. Where processing relies on consent, you may withdraw that consent without affecting processing that was lawful before withdrawal.

If your request concerns worker or certificate data held inside a customer's workspace, we may need to direct the request to or coordinate with the relevant customer organisation.

To exercise a privacy right, email docunudgeapp@outlook.com.

10. Complaints

Please contact us first if you have a concern about how your personal data is handled. You also have the right to complain to the UK Information Commissioner's Office (ICO).

Information Commissioner's Office

11. Changes to this notice

We may update this notice when DocuCue, our service providers, or applicable legal requirements change. The latest version will be published on this page with an updated date.