Privacy Policy

Last updated: September 2026

DocButterfly ("we", "us", or "our") operates the DocButterfly platform and API services. This policy explains what information we collect, how we use it, and your rights.

1. Information We Collect

Account information: When you register, we collect your email address and a hashed password. You may optionally provide a phone number.

Signup details in our CRM: The details you give us when you sign up, which are your name, your email address, your company and role, what you told us you want to use DocButterfly for, when you signed up, which of our sites you signed up on, and whether you asked to receive product updates, are also copied into our customer relationship management system, which we use to keep track of who our customers are and to contact you about the product. Your answer about product updates is recorded exactly as you gave it, and you can change it at any time in your portal settings or by using the unsubscribe link in any update we send; whichever way you change it, the change is sent to that system too.

API usage data: Each API call is logged with a timestamp, endpoint name, token cost, processing duration, response status, and your IP address. This data powers your usage dashboard and our billing system.

Document content: Documents you submit to the API are processed in memory and are not retained once the response is returned, with four exceptions. (a) Template samples — if you save a document as a template sample, that document and a thumbnail of it are stored so the template can be previewed and reused. (b) Training samples — documents you explicitly mark as consented or synthetic training samples are stored so we can build extraction models scoped to your own account. (c) Output cache — the result of a document-composition operation, including the generated document, is cached against your account so an identical repeat request is not billed twice. (d) Email copies you ask for: if you ask the SendEmail operation to keep a copy of a message by setting saveToSentItems to true, and your account is one we have enabled for this on request, that message, with its body, its recipients and its attachments, is kept in the mailbox we send from until you ask us to remove it. A copy is kept only for accounts we enable on request; for any other account, SendEmail keeps no copy. We also store the templates, workflows, web forms, connection records and brand assets you create in the portal; a connection's credential is either stored encrypted at rest or kept in your own Azure Key Vault, in which case we store only a pointer to it and never store the credential ourselves. Stored items are retained until deleted — see Section 6.

Web form submissions: If you publish a web form, the information a visitor enters is recorded when it is submitted and deleted once it is delivered to you (as a workflow run or an email). Submissions to forms configured to store responses, and submissions whose delivery failed, are retained — see Section 6.

Billing information: When you buy tokens, payment is processed by Stripe through Stripe's hosted Checkout. You enter your payment card details on a page hosted by Stripe, not on our site, and none of them reach us. What Stripe returns to us, and all we keep, is the record of the purchase itself: the amount and currency, the date, what you bought, a payment identifier, and the email address you give Stripe at checkout. We retain that record to show your purchase history and to support your account. Your use of Stripe is also subject to Stripe's own privacy policy.

How you found us: When you first open a page on this site we record how the visit started: the address of the site that linked to you (its domain only — never the page you were on, and never anything after it), any campaign tags in the link you followed (utm_source and similar), the page on our site you landed on, and the time. This is held in a first-party cookie that expires when you close your browser, contains no identifier for you, and is sent to no one. If you create an account, it is copied onto that account so we can tell which of our channels people find us through, and the cookie is deleted. If you do not create an account, nothing is stored. We do not use any third-party analytics or advertising service.

Communications: If you contact us, we retain that correspondence to assist you. When you ask us a question through the contact form on this site, what you enter is also copied into the same customer relationship management system described above, so that whoever answers you can see it. That is your name, your email address, your company, your phone number if you give one, the topic you pick, your question itself, and which of our sites you asked from. This happens whether or not you have an account with us. Ticking the box to receive product updates is recorded as your answer; leaving it unticked changes nothing about updates you may already have asked for elsewhere.

2. How We Use Your Information

• To authenticate you and secure your account
• To track token usage and generate invoices
• To display your usage history in the portal
• To investigate abuse or errors if they occur
• To understand which of our channels people find us through, in aggregate
• To send transactional emails (password reset, billing receipts) — no marketing emails without your consent

3. Data Storage & Security

All data is stored in Microsoft Azure, in the Central US region. Data is encrypted at rest and in transit (TLS 1.2 or higher).

API keys are verified against a salted one-way authenticator, so checking your key never requires holding it in the clear. Separately, and by default, we keep an encrypted copy of the key itself so you can retrieve it from the portal if you lose it — which means that copy is one we are able to decrypt. If you would rather we could not, you can switch your account to hash-only storage, after which the key cannot be recovered and can only be regenerated.

4. Third-Party Services

Service	Purpose	Data Shared
Microsoft Azure	Infrastructure hosting	All application data
Azure OpenAI	AI features (Document AI, AI assistant)	Document content you submit to AI endpoints, and messages you type into our AI assistant
Azure Document Intelligence	Document extraction and OCR	Documents submitted to Document AI operations, and consented training samples
Azure Communication Services	Transactional email	Recipient address and message content
Microsoft Graph	Email sending and calendar event creation, on your instruction	Message content, recipients, extracted dates
DocuSign	E-signature requests	The document to be signed and signer details
Stripe	Payment processing (hosted Checkout)	Your email address and purchase amount; payment card details are entered on Stripe's own checkout page and are not shared with us

We do not sell your data to any third party.

5. Connected Storage Accounts

You can connect DocButterfly to storage you own, so that files can be delivered into it or read from it. This section explains, for each kind of storage, what we can reach, what we keep, and how to disconnect. It applies only if you choose to connect one.

OneDrive, Google Drive, Dropbox and Box

You connect these by signing in to the provider from the Connections page in your portal. We ask each provider for the narrowest permission it offers that still lets us put a file where you can see it:

• OneDrive: the Files.ReadWrite.AppFolder permission, which reaches only a folder Microsoft sets aside for our app in your OneDrive (normally /Apps/DocButterfly) and nothing else there. We also ask for your basic sign-in profile, so the connection can show which Microsoft account it uses, and for ongoing access, so deliveries keep working while you are away. This works with personal and with work or school Microsoft accounts.
• Google Drive: the drive.file permission, which reaches only files our app created in your Drive, starting with a folder named DocButterfly. It does not reach any other file in your Drive, including a file you put into that folder yourself. We also ask for your email address, so the connection can show which Google account it uses.
• Dropbox: app folder access, which reaches only a folder Dropbox sets aside for our app (normally /Apps/DocButterfly) and nothing else in your Dropbox. We do not ask for permission to read your Dropbox account details, so we do not learn your Dropbox email address; Dropbox tells us only an account identifier.
• Box: the permission to read and write all files and folders stored in Box. This is wider than the other three, and it is Box's limit, not our choice: Box offers an app you sign in to no permission narrower than your whole Box. DocButterfly works in one folder, named DocButterfly, at the top of your Box, which it creates if it is not there, and before it reads or removes any file it checks with Box that the file is inside that folder. When you sign in, we also read your Box login and Box user identifier once, so the connection can show which Box account it uses.

The provider's own consent screen may describe this permission with several words, such as see, read, create, update and delete. Those come bundled with the one permission, and the provider offers nothing narrower that can still write a file you can see. We use the permission to add files to that folder, and to read files in it when you use the connection as a source: listing the folder, downloading a file from it, or watching it for new files. Adding a file never overwrites a file already there. When you test a connection, we write a small file named docbutterfly-connection-test.txt into the folder to prove delivery works, and then delete it. If that delete fails, the file stays in the folder and the test result tells you so.

What we store. When you sign in, the provider gives us a refresh token: a long-lived credential that lets us act within that folder while you are away, so deliveries keep working. We store it encrypted, and it is never shown in the portal, returned by our API, or sent to your browser. Each time we deliver or read a file, we exchange it with the provider for a short-lived access token, which we use and do not store. Box is different in one way: a Box refresh token works only once, and each exchange gives us a new one, which we store encrypted in place of the old. So that two deliveries at the same moment cannot use up the same one, we keep a Box access token in our service's memory, never in storage, and reuse it until shortly before it expires, which is about an hour. The one exception is FlyaDoc delivery set to run in your browser: there, a short-lived access token is sent to your own signed-in browser so it can upload the file itself. Alongside the refresh token we store what is needed to show and use the connection: its name, where the folder is, and which account it signed in as (for OneDrive, the account's sign-in name, its Microsoft identifiers, and whether it is a personal or a work or school account; for Google Drive, the account's email address; for Dropbox, Dropbox's account identifier; for Box, the account's login and Box's user identifier).

SharePoint (signed in)

You can also connect one SharePoint document library by signing in with your work or school Microsoft account, from your FlyaDoc box or the Connections page, and then choosing the site, the library and, if you like, a folder in it. We ask Microsoft for the Sites.ReadWrite.All permission, as you. Microsoft describes it as reading and writing items in all site collections, and it reaches only what you can already reach in SharePoint. We use it to list the sites, libraries and folders you can open while you choose where files go, and then to add delivered files to the one library and folder you chose, creating that folder if it is missing. We do not read files out of the library. As for OneDrive, we also ask for your basic sign-in profile and for ongoing access. We store the refresh token encrypted, as described above, together with the names and identifiers of the site and library you chose, the folder path, your organization's SharePoint address (so your browser may upload to it), and which account signed in. Turning the connection off deletes our copy of the credential; Microsoft offers no way for an app to revoke a single sign-in, so an access token already issued may keep working for a short time. Your Microsoft 365 administrator can remove DocButterfly's access for your whole organization in the Microsoft Entra admin center.

SharePoint, SFTP, Azure Blob Storage, Azure Files and Amazon S3

You connect these with credentials you create and give us, not by signing in:

• SharePoint: you register an app in your own Microsoft Entra directory and give us its directory ID, app ID and client secret, and optionally the site, library and folder to use.
• SFTP: you give us the server address and the account's password or private key, and optionally the port, the user name, the folder to use and the server's host key fingerprint.
• Azure Blob Storage: you give us the storage account address, optionally a container, and either a shared access signature (SAS) or a storage account connection string.
• Azure Files: you give us the storage account's file address, the file share, optionally a folder in it, and either a shared access signature (SAS) or a storage account connection string.
• Amazon S3 (or an S3-compatible service): you give us the bucket, the region, optionally the service's address, and an access key pair.

What we can reach is exactly what you grant that app, account or key on your side, so we recommend granting only what the connection needs: for SharePoint, the Sites.Selected permission, which reaches nothing until you grant the app a role on a specific site; for SFTP, an account limited to one directory; for Azure Blob Storage, a SAS scoped to one container with only the permissions the connection uses, rather than an account key; for Azure Files, a SAS scoped to the one file share with read, write, delete and list only (delete lets us remove a file an upload could not finish), rather than an account key; for Amazon S3, an access key whose policy names only the bucket and folder the connection uses. We store the secret encrypted, or, if you prefer, it stays in your own Azure Key Vault and we store only a pointer to it, reading the secret when it is needed and holding it only briefly in memory, never in storage. We use the connection only for what your workflows, watchers, web forms and FlyaDoc deliveries ask of it: listing, reading and writing files and, for SharePoint, reading and setting file details.

For every kind of connected storage

Watchers. If you set up a watcher on a folder, we store a list of what we have already seen there, so that only new or changed files start your workflow: for OneDrive, Google Drive, Dropbox and Box, each file's identifier with its size and modified time; for SFTP, each file's name with its size and modified time; for SharePoint, a change marker SharePoint gives us. The list is updated after each successful check, and files no longer in the folder are dropped from it. Each time a watcher starts your workflow, our service log records the watcher, the workflow and the file's name or path. Our service logs are deleted automatically after 90 days.

Usage record. We record which of your workflows, forms or features used a connection, for what purpose, when it was first and last used, and how many times. This record holds no file content and no credential.

FlyaDoc deliveries. When we deliver a FlyaDoc into your storage, our logs do not record the file's name or content.

Files. Files we read from or write to your storage through a workflow are handled like any other document you submit (see "Document content" in Section 1). Files already delivered into your storage stay there, including after you disconnect.

How we use it. We use access to your connected storage only to run what you set up: your workflows, watchers, web forms and FlyaDoc deliveries, and connection tests. We do not sell data from your connected storage, use it for advertising, use it to train AI models, or share it with anyone except as needed to run the features you set up.

DocButterfly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to disconnect

Turn the connection off on the Connections page in your portal. For Google Drive, Dropbox and Box, we first ask the provider to revoke our access, and then delete our stored copy of the credential in the same step that turns the connection off. If the provider does not confirm the revoke, the page tells you, and an access token the provider already issued may keep working for a short time (up to an hour on Google Drive and up to four hours on Dropbox, and about an hour on Box), though we send nothing new. Microsoft offers no way for an app to revoke a single OneDrive sign-in, so for OneDrive we delete our copy and an access token already issued may keep working for a short time, usually about an hour and up to 90 minutes for a work or school account; again, we send nothing new. For SharePoint, SFTP, Azure Blob Storage, Azure Files and Amazon S3, turning the connection off deletes the stored secret, or clears the Key Vault pointer from the connection. To end our access at the source as well, act on your side: remove the app's permission (SharePoint), change the password or key (SFTP), revoke the SAS or rotate the account key (Azure Blob Storage and Azure Files), or deactivate the access key (Amazon S3).

You can also remove DocButterfly's access from the provider's own settings at any time: in Dropbox, under Connected apps; in Box, among the apps you have authorized in your account settings; in Google, under Third-party apps with account access at myaccount.google.com; in Microsoft, for a personal account, under Privacy at account.microsoft.com, among the apps and services you have given access, and for a work or school account, in the My Apps portal at myapps.microsoft.com, by choosing Manage your application on the app and then Revoke permissions (permissions your administrator granted can be removed only by your administrator). After that, the connection asks you to sign in again before anything more can be delivered.

A connection you have turned off stays in your Connections list, without its credential, until you delete it. For a Key Vault connection, the pointer (not the secret) also stays in the connection's version history until you delete the connection. Deleting it removes its record and its version history. The usage record described above is kept as history. We keep turned-off connections and usage records while your account is active, and remove them with the rest of your account's data when you ask us to delete your account (see Section 6).

6. Data Retention

API usage logs are currently retained indefinitely. We are implementing a 12-month retention window; until it is in place you may request deletion of your usage history by contacting us (see Section 8).

Documents stored as template samples, training samples or cached outputs are retained until you delete them, or until you ask us to remove them.

A copy of an email you asked the SendEmail operation to keep (by setting saveToSentItems to true) is retained, with its recipients and attachments, in the mailbox we send from until you ask us to remove it. A copy is kept only for accounts we enable on request; for any other account, or without that request, SendEmail keeps no copy.

Web form submissions are deleted automatically once delivered to you. Submissions to forms configured to store responses, and submissions whose delivery failed, are retained until you ask us to remove them.

Account data is retained while your account is active. We do not yet offer self-service account deletion; to have your account and associated data removed, email privacy@docbutterfly.com and we will action it manually within 30 days.

7. Cookies

We use first-party cookies only: those required for authentication and security, plus the session cookie described under "How you found us" above. No third-party, tracking, advertising, or analytics cookies are used. See our Cookie Policy for details.

8. Your Rights

Depending on your location, you may have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate data
• Request deletion of your account and associated data. Deletion is currently handled manually — email privacy@docbutterfly.com. Deleting a template in the portal also deletes its stored samples, previews, and any training documents you uploaded for it.
• Object to or restrict certain processing
• Data portability (receive your data in a machine-readable format)

To exercise any of these rights, contact us at privacy@docbutterfly.com. We will respond within 30 days.

9. GDPR (EU/UK Users)

Our lawful basis for processing your data is contractual necessity (to provide the service you signed up for) and legitimate interest (security, fraud prevention, usage tracking). Where we rely on consent, you may withdraw it at any time.

10. Changes to This Policy

We may update this policy as the service evolves. Material changes will be communicated via email. Continued use of the service after changes constitutes acceptance.

11. Contact

DocButterfly
Email: privacy@docbutterfly.com