DocuRise Privacy Policy

Risecraft, LLC ("DocuRise", "we") provides document sharing and protection, engagement analytics, lead capture, contact management, messaging, and digital product sales (the "Service"). This policy explains what personal information we handle, why, who receives it, and how long we keep it.

One thing to read before anything else: Section 13 explains when a creator is the controller of your data and we are only their processor. Which side applies decides who you send a request to.

If you use the Korea-only payment path for a creator's product, additional notices may appear at checkout, on the payment page or on a receipt, and those supplement this policy for that transaction. The Korean-language version of this policy is here.

1. Information We Collect

We collect the minimum information needed to run the Service. What we hold depends on whether you are a creator, a viewer or a buyer, and on which features the creator enabled.

2. How We Use Information

We process personal information for the purposes below. If we ever need it for a new and incompatible purpose, we will ask for consent first.

• Providing, operating, maintaining and improving the Service
• Creating and managing accounts, authenticating users, managing access
• Document sharing and protection, engagement analytics, lead capture, CRM features
• Sending email and KakaoTalk messages on a creator's behalf, and recording results
• Subscription billing, receipts, creator payouts, and bank account holder verification
• Brokering Korean transactions and supporting payments, refunds and cancellations
• Responding to support enquiries and handling disputes
• Preventing and investigating abuse, security incidents, fraud and policy violations
• Displaying watermarks to discourage unauthorised redistribution, where a creator enabled it
• Recording consent and unsubscribe status, and honouring opt-outs
• Usage analytics, product improvement and advertising measurement
• Meeting legal, regulatory, tax, accounting and contractual obligations
• Enforcing our Terms of Service and related policies

Marketing messages are sent only to people who separately consented to receive them.

3. How Long We Keep It

We destroy personal information without delay once its purpose is fulfilled, except for the periods below. Where a law requires retention, that data is stored separately from active records and destroyed when the period ends.

4. How We Destroy It

• Electronic records are deleted using methods that make recovery or reconstruction impossible.
• Paper records are shredded or incinerated. We do not keep personal information on paper as a matter of practice.
• When a creator account closes, the viewer and lead data we processed on that creator's behalf is destroyed along with it.

5. How We Share Information

We do not sell personal information. We share it only in the cases listed below, and only to the extent each purpose requires.

5.1 With the creator

When you submit information through a creator's document, folder, lead form or checkout, that information goes to that creator so they can fulfil the purpose you gave it for. The creator is the controller of that data; we process it on their behalf. See Section 13.

5.2 For advertising measurement

Where a creator has connected their own advertising account, we transmit the events below so that creator can measure and optimise their advertising. Email addresses and phone numbers are hashed before transmission — the plain values are never sent. On pages where no advertising account is connected, nothing is transmitted.

See Section 12 for how to refuse behavioural data collection.

5.3 With tools a creator connected

Where a creator connected an outside tool such as Slack or Google Sheets, lead and order information is delivered to it. The destination is an account the creator chose and connected themselves — not a processor we selected. We carry out the delivery on their instruction and record that it happened and when, but storage, use and deletion after delivery are that creator's responsibility.

5.4 For legal reasons

We disclose information where a law requires it, or where a law enforcement or regulatory body requests it through a lawful process. We verify that such requests have a legal basis, and we try to notify the affected person where we are not prohibited from doing so.

6. Processors We Use

We entrust the processing below to the parties listed. Our agreements with them restrict use to our instructions, require security measures, restrict onward sub-processing, and provide for audit and liability, as required by Article 26 of the Korean Personal Information Protection Act. We publish changes to this list in this policy.

7. International Transfers

DocuRise is operated by Risecraft, LLC in the United States, so personal information is transferred to and processed outside Korea to the extent the Service requires. The recipients and items are listed below.

Traffic Machine Co., Ltd., Payple and Sendon process personal information inside Korea, so those are not overseas transfers.

You may refuse an overseas transfer. What happens depends on the transfer:

• Transfers essential to providing the Service — hosting, database, payments, email and Kakao delivery, error monitoring. Refusing limits the relevant feature or the Service, and may require closing your account.
• Optional analytics and advertising transfers — PostHog, Google Analytics, Meta. You can refuse these and keep using the Service; Section 12 explains how.

Contact us at the address in Section 18 with any question about, or objection to, an overseas transfer.

8. Your Rights

You may at any time ask us to:

• tell you what personal information we hold about you
• correct it if it is wrong
• delete it
• stop processing it
• withdraw a consent you previously gave
• give you a copy of it

Email support@docurise.io, or use the Korean contact point in Section 17. We act within 10 days of receiving a request and tell you the outcome. Where a law lets us decline part of a request, we explain why.

8.1 Data a creator collected

For information collected through a creator's documents, lead forms or CRM, that creator is the controller — see Section 13. Direct those requests to the creator.

If you cannot identify the creator, or they do not respond within a reasonable time, contact us. As their processor we pass the request on and assist with it, and we act immediately ourselves on anything we can handle directly, such as stopping marketing messages.

8.2 Stopping marketing messages

Every marketing email carries an unsubscribe link. You can also email us and we will remove your address from sending. For KakaoTalk messages, block the channel or contact us.

9. Region-Specific Rights

9.1 South Korea (PIPA)

We process personal information in accordance with the Personal Information Protection Act. Personal information is destroyed securely once its purpose is achieved unless another law requires retention, in which case it is stored separately for only the required period. The Korean-language version of this policy, our data protection officer, and the domestic contact point are in Sections 15 and 17. Korean data subjects may also bring a dispute to the bodies listed in Section 16.

9.2 United States — California and other states

We do not sell personal information and we receive no consideration for disclosing it.

We do, however, share information for cross-context behavioural advertising in one narrow case: where a creator has connected their own Meta advertising account to their pages, we transmit the hashed identifiers and event data described in Section 5.2.

If you are a California resident and want us to stop this, email support@docurise.io with the subject "Do Not Sell or Share My Personal Information", or refuse the trackers using the methods in Section 12. We will not discriminate against you for exercising any of these rights.

Several other states — including Virginia, Colorado, Connecticut and Texas — give residents comparable rights to know, correct, delete, obtain a copy of, and opt out of targeted advertising using their personal information. Where one of those laws applies to us, residents of that state may exercise those rights through the same email address, and we will not discriminate against them for doing so.

Each of these statutes, including the CCPA as amended by the CPRA, applies only above thresholds tied to revenue and to the number of residents whose data a business handles. Where a statute applies to us we additionally honour an opt-out preference signal such as Global Privacy Control, publish a "Your Privacy Choices" link, and give the notice-at-collection and category disclosures it requires. We reassess which of these apply as the business grows. The email routes above are open to residents of any state either way.

California residents may also request to know, correct, delete, or receive a portable copy of their personal information, and may designate an authorised agent to act for them.

10. Security

• Technical — TLS in transit, encryption at rest, AES-256-GCM for access tokens and payout bank details, one-way hashing of passwords, HMAC-SHA256 for sensitive identifiers, rate limiting, webhook signature verification, access logging and monitoring
• Organisational — an internal management plan, least-privilege access for staff who handle personal information, confidentiality obligations, periodic review of security practices
• Physical — data held in secure cloud infrastructure with physical access controls

We take this seriously, but no method of transmission or storage over the internet is completely secure.

10.1 If personal information is breached

If we learn that personal information has been lost, stolen, disclosed, altered or destroyed, we tell the affected people without delay — what was involved, when and how it happened, what we have done, what they can do to limit harm, and where to reach us — and we report it to the Korean Personal Information Protection Commission or the Korea Internet & Security Agency where the statutory thresholds apply. This is the duty Article 34 of the Personal Information Protection Act places on us.

Where the breach involves data we process on a creator's behalf, we notify that creator without delay and give them the information and technical help they need to meet their own notification and reporting duties. In that case the creator, as controller, is the one who notifies the affected people — see Section 13.

11. Cookies and Similar Technologies

We use cookies and local storage to keep you signed in, remember settings and manage document viewing sessions. The cookies the Service needs to function are:

You can block cookies in your browser. Doing so limits features such as staying signed in and opening password-protected documents.

12. Behavioural Data and How to Refuse It

We collect data about online activity for product improvement and advertising measurement. The collectors, purposes and refusal methods are:

• Items — page URLs, page view and click records, whether a lead was submitted or a purchase completed, hashed email address and phone number, advertising cookie identifiers, IP address, device and browser information
• Method — browser scripts, and server-to-server transmission via conversions APIs, at the moment the corresponding event occurs
• Retention — per each collector's own policy; the delivery records we keep follow Section 3

We do not collect or use special-category data — beliefs, political opinions, health, sexual life — for advertising, and we do not collect behavioural data from anyone we know to be under 14.

13. Creator and Company Roles

Responsibility for personal information splits two ways in DocuRise, and which side applies determines who you direct a request to.

13.1 Where the creator is the controller

For personal information a creator collects through their own documents, folders, lead forms, contact management and messaging, that creator is the controller and we are their processor. In that scope the creator is responsible for:

• obtaining lawful consent for collection and for marketing, and keeping the evidence
• deciding what to collect and for what purpose, and disclosing that to people
• complying with the marketing laws of the regions they send to
• responding first to access, correction, deletion and stop-processing requests
• the accuracy of any attestation they make about imported contact lists

As processor we supply the infrastructure and compliance tooling, process within the creator's instructions, and record consent and unsubscribe status. The terms of that processing are set out in our data processing agreement, which is incorporated into the Terms of Service.

13.2 Where we are the controller

We act as controller in our own right, and this policy applies directly, for: creating, authenticating and managing DocuRise accounts and subscription billing; operating the Service, responding to incidents, security and abuse prevention; producing usage statistics and improving features; and meeting legal obligations and handling disputes.

14. Children

A DocuRise account is for creators aged 18 and over. We do not knowingly collect personal information from children under 14, or under 13 for users in the United States.

We do not verify the age of people who open a creator's document or answer their lead form. Responsibility for that data rests with the creator under Section 13, and a creator running a flow aimed at, or likely to reach, children must meet the applicable requirements themselves, including obtaining a legal representative's consent.

If we learn we have collected a child's personal information without the required consent, we destroy it without delay. Tell us at support@docurise.io if you believe this has happened.

15. Data Protection Officer

• Name: Gayoung Park
• Title: Chief Executive
• Email: support@docurise.io
• Phone: +82-70-8080-4559

16. Dispute Resolution Bodies (Korea)

Korean data subjects may bring a complaint or dispute to:

• Personal Information Dispute Mediation Committee — 1833-6972 / www.kopico.go.kr
• Korea Internet & Security Agency privacy report centre — 118 / privacy.kisa.or.kr

17. Korean Contact Point

We are a United States company, but Korean users may raise privacy matters through our Korean affiliate, which forwards them to the data protection officer.

Traffic Machine Co., Ltd. | Representative: Gayoung Park
Business registration number: 684-88-02857 | Mail-order registration: 2023-Seoul Songpa-5624
125 Wangsimni-ro, Room 302, Seongdong-gu, Seoul, Republic of Korea
Phone: +82-70-8080-4559 | Email: support@docurise.io

18. Changes and Contact

We may update this policy as laws or the Service change. We post the effective date and the substance of any change on this page. For changes that materially affect your rights, we post them 30 days before they take effect and notify account holders by email or in-app notice.

Questions: DocuRise / Risecraft, LLC — support@docurise.io, or the Korean contact point in Section 17.

The Korean-language version of this policy is available here. The two versions reflect the law and the user protections that apply in each jurisdiction, so some provisions differ. For users in South Korea, Korean mandatory law prevails and whichever version is more favourable to the user applies.