This privacy policy explains which personal data we process, for what purpose and on what legal basis. It distinguishes between data we process on behalf of our customers and data we process under our own responsibility.
The controller within the meaning of Art. 4 (7) GDPR for the processing described in section 5 is: Nibsy Tech Ltd 71-75 Shelton Street Covent Garden London WC2H 9JQ United Kingdom Email: datenschutz@doccanvas.app
The controller is established in the United Kingdom and therefore outside the European Union. As the service is directed specifically at data subjects in the Union, the GDPR applies pursuant to Art. 3 (2) (a) GDPR, and a representative in the Union must accordingly be designated pursuant to Art. 27 (1) GDPR. This designation is currently being arranged; the representative's contact details will be added here once finalised. Until then, you may exercise your rights under the GDPR directly against the controller at datenschutz@doccanvas.app.
We have not appointed a data protection officer. In our assessment, the requirements of Art. 37 (1) GDPR and Section 38 (1) of the German Federal Data Protection Act are not met: our core activity consists neither of regular and systematic monitoring of data subjects on a large scale nor of large-scale processing of special categories of personal data, and fewer than twenty persons are permanently engaged in the automated processing of personal data. Please direct all data protection enquiries to datenschutz@doccanvas.app.
Where you as a customer enter or generate your own content in DocCanvas, in particular master data of your own customers, quotation and invoice line items, amounts, payment information, uploaded documents and the records generated from them, we process this data exclusively on your documented instructions. In this respect you are the controller within the meaning of Art. 4 (7) GDPR and we are the processor within the meaning of Art. 4 (8), Art. 28 GDPR. The legal basis and purpose of the processing follow from your relationship with the data subjects and must be set out in your own privacy information.
For the following processing operations we are the controller ourselves. They relate exclusively to your account, the billing of the contractual relationship and the technical operation of the platform, not to the content you enter.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract)
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR (commercial and tax retention obligations)
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operational security, abuse prevention and error analysis)
DocCanvas offers the optional function of automatically analysing an uploaded document and pre-filling the fields it contains, such as invoice number, date, line items and amounts. Using this function requires you to actively upload a document for analysis. If you do not use the function, no document content is transmitted to the service named below.
We use service providers to operate the platform who act for us as processors pursuant to Art. 28 GDPR. For the processing of the content you enter (section 4), we provide you on request at datenschutz@doccanvas.app with a data processing agreement pursuant to Art. 28 (3) GDPR in text form. The service providers listed below are the sub-processors we use. We inform you of intended changes to this list before engaging a new sub-processor.
Your documents and master data are stored permanently on servers in Germany. Our hosting provider is netcup GmbH, Daimlerstrasse 25, 76185 Karlsruhe, Germany, acting for us as a processor pursuant to Art. 28 GDPR. Any transfers to processors beyond this follow from sections 6 (AI-assisted field extraction), 7 (recipients), 10 (payment processing) and 11 (sending email).
| Data type | Retention period |
|---|---|
| Account data | Until the account is cancelled and the 30-day follow-up period has expired |
| Documents and templates (not finalised) | Until deleted by the user or until the follow-up period after the end of the contract expires |
| Finalised invoices and journal entries | 10 years from the end of the calendar year in which they were created (Section 147 (3) of the German Fiscal Code); deletion is technically excluded during this period. Legal basis: Art. 6 (1) (c) GDPR |
| Billing data of the Provider | 10 years in accordance with commercial and tax retention obligations. Legal basis: Art. 6 (1) (c) GDPR |
| Log files | Generally up to 30 days |
| Backup data | Up to 30 days (rolling backups) |
| Waiting list data | Until consent is withdrawn, at the latest three months after the service launches |
Contact: datenschutz@doccanvas.app
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) (f) GDPR. This concerns in particular the usage and log data described in section 5.3. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. The objection is not subject to any particular form and may be declared informally by email to datenschutz@doccanvas.app.
Where processing is based on your consent pursuant to Art. 6 (1) (a) GDPR, you may withdraw that consent at any time with effect for the future. The lawfulness of the processing carried out until withdrawal remains unaffected. Withdrawal is possible informally by email to datenschutz@doccanvas.app.
Providing an email address and setting a password are contractually required in order to set up and use an account. For billing purposes, your company name, billing address and, if you are an entrepreneur established in the European Union, a valid VAT identification number are also required. Without this information we cannot provide access and cannot enter into a contract with you. There is no statutory obligation to provide the data.
Automated decision-making in individual cases, including profiling, within the meaning of Art. 22 GDPR does not take place. The AI-assisted field extraction described in section 6 serves solely to pre-fill input fields; it does not make any decision producing legal effects concerning you or similarly significantly affecting you, and the pre-filled values remain fully verifiable and editable by you.
All fonts used on this website are served locally from our own server. There is no connection to Google Fonts or any other external provider, and no IP address is transmitted to third parties.
We use Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, to process payments. Only the data required to process the payment is transmitted, in particular name, billing address, email address, amount and payment reference. The legal basis for the transfer is Art. 6 (1) (b) GDPR (performance of a contract). For the payment processing itself, including the verification of payment methods and compliance with anti-money-laundering obligations, Mollie acts as an independent controller; in this respect the Mollie privacy policy at https://www.mollie.com/privacy applies.
DocCanvas lets you send documents by email using your own SMTP credentials. The SMTP credentials you enter are stored encrypted and used solely to send your documents. To send our own system and notification emails to you, for example registration confirmations, password resets and Provider invoices, we use an email dispatch service provider as a processor pursuant to Art. 28 GDPR; its name and address are provided on request at datenschutz@doccanvas.app. The legal basis is Art. 6 (1) (b) GDPR.
If you sign up for the waiting list on our home page, we process your email address and – where provided – your company name and industry solely in order to inform you when DocCanvas launches. The legal basis is your consent under Art. 6 (1) (a) GDPR. You may withdraw this consent at any time by sending an informal email to datenschutz@doccanvas.app; we will then delete your entry without delay. Waiting list data is deleted no later than three months after the service launches. The data is not passed on to third parties.
Pursuant to Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority about our processing of personal data. Competent authorities include in particular the authority at the place of the representative in the Union, at your habitual residence or at the place of the alleged infringement. A list of the supervisory authorities of the member states is available from the European Data Protection Board at edpb.europa.eu.
We reserve the right to amend this privacy policy in order to reflect changes in the law, in case law or in the service. We will inform you by email or directly in the application about material changes.
Email: datenschutz@doccanvas.app
Response time: usually within 48 hours
You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The competent authority is named in section 20.
Last updated: September 2026 – version 2.0