Pilot version. This policy will be reviewed by a lawyer before general launch.
Doc Chaser Privacy Policy
1. Who we are and what this policy covers
Doc Chaser is a web app that helps accounting and tax firms collect documents from their clients. It is made and run by AK TECK (Ashish Khadka), 5413 Aerodrome Road, Regina, Saskatchewan, Canada ("we", "us").
This policy explains what personal information Doc Chaser handles, why, where it is stored, and the choices you have. It applies to the Doc Chaser app at docchaser.ca (the app at app.docchaser.ca), including the client upload pages, and to the emails and text messages the app sends.
Effective date: November 2, 2026.
2. Our role
We play two different roles, depending on whose information it is.
| Whose information | Who decides how it is used | Our role |
|---|---|---|
| A firm's own account: the owner's and staff members' names, emails and logins | AK TECK | We are responsible for it under this policy. |
| A firm's clients: names, contact details, consent records and the documents they send | The accounting or tax firm | We handle it only on the firm's behalf, to provide Doc Chaser, under our agreement with the firm. |
If you are a firm's client, your accountant chose to use Doc Chaser and decides what to ask you for. Their own privacy policy also applies to you. For access or correction requests about your information, please contact your accountant first. We will help them answer you.
3. Information we collect
We collect only what Doc Chaser needs to work.
| About | What we collect |
|---|---|
| Firm owners and staff | First and last name, email address, a securely hashed password, two-step login settings and recovery codes, role (owner or staff), and the firm's name, reply-to email and business mailing address |
| A firm's clients | First and last name, email address, mobile number, the firm's own client reference (optional), whether the client agreed to text messages and when, and whether they opted out of texts or emails |
| Requests | Which checklist was used, the due date, which documents were received or marked not applicable and when, file sizes, and where each file is stored in the firm's Google Drive |
| Messages | A record of each email or text sent (channel, type, time, delivery status). We do not keep the text of the message. |
| Google account | The email address of the Google account a firm connects, and an encrypted access permission (a "refresh token") so we can save files to that Drive |
| Technical | IP addresses, held briefly to limit repeated attempts; a sign-in cookie; and an activity log of actions (for example "file received" or "staff invited") that records IDs and times, not names or file contents |
4. Information we never collect
Doc Chaser does not keep copies of uploaded files. It does not ask for or store Social Insurance Numbers, birth dates, home addresses, income amounts or bank details, and it refuses to save a number that looks like a SIN in any text box. We never open or read the contents of files clients upload.
Doc Chaser does not show ads, does not sell personal information, and does not use it to train software or build marketing profiles.
5. How we use information
We use personal information only to provide Doc Chaser and keep it safe:
- to let firm owners and staff sign in, and to protect their accounts
- to send clients the firm's document requests, reminders and private upload links
- to save uploaded files to the firm's Google Drive and show the firm what has arrived
- to show the firm's status board and season report (the report shows counts only, no names)
- to honour opt-outs from emails and texts
- to prevent misuse, investigate problems and keep the service running
- to meet our legal obligations
We do not use a firm's client information for any other purpose, and we do not contact a firm's clients for our own reasons.
6. Uploaded files and Google Drive
Files clients upload pass through Doc Chaser's memory and go straight into the Google Drive account the firm connected. They are not written to our servers, database or backups. Doc Chaser renames each file using the client's last name, a document code and the date, and keeps only the file's size, upload time and Drive location.
When a firm connects Google Drive, Doc Chaser asks Google for one permission only: to see, create and manage the files and folders Doc Chaser itself creates. It cannot see anything else in that Drive. We store the connection's access permission encrypted. A firm can disconnect at any time in Settings, or remove Doc Chaser at myaccount.google.com/connections.
Files in the firm's Drive belong to the firm. Doc Chaser never deletes them, including after a firm cancels. Google's own privacy terms apply to files stored in Google Drive.
Doc Chaser's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Emails and text messages
Doc Chaser sends a firm's clients the firm's document requests and reminders, on the firm's behalf. Each email names the firm and shows its mailing address and reply-to address.
- Text messages are sent only to clients the firm has recorded as agreeing to receive them. A text contains only the firm's name, the client's first name, the number of documents needed, a private link and "Reply STOP to opt out".
- Emails may also list the types of documents needed. No email or text contains amounts, account numbers or last names.
- Opting out: reply STOP to any text, or use the unsubscribe link in any email. Doc Chaser stops at once. Texts restart only if the client replies START. Emails restart only if the client asks the firm, and the firm records that request.
- Messages are sent only between 9:00 and 20:00 Saskatchewan time, and at most 6 per request.
8. Service providers and where data is stored
We use a small number of service providers. Each receives only what it needs to do its job, under terms that require it to protect the information.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Fly.io | Runs the app, its database and backups | The information in section 3 | Canada (Toronto) |
| Amazon Web Services (Amazon SES) | Sends emails | Client email addresses and email content, including the private link | Canada (Central region) |
| Twilio | Sends text messages and receives STOP and START replies | Client mobile numbers and text content, including the private link | United States |
| Google (Google Drive) | Stores uploaded files in the firm's own Drive | The files, file and folder names (which include the client's name), and the connected account's email | Wherever the firm's Google account stores data |
Information handled outside Canada is subject to the laws of that country and may be accessed by its courts or authorities. This is why texts carry only the minimum.
We do not sell, rent or trade personal information. We disclose it to others only as described here, with consent, or when the law requires it.
9. Cookies
Doc Chaser uses only the cookies it needs to work: a sign-in cookie that keeps firm users logged in, and a security cookie that protects forms from misuse. We do not use advertising cookies, tracking pixels or third-party analytics, and our emails contain no tracking.
10. How we protect information
We use safeguards suited to the sensitivity of the information, including:
- two-step login (password plus an authenticator code) for every firm user, which can't be turned off
- encryption of data sent over the internet (HTTPS), and encryption of stored Google access permissions
- separation so each firm can see only its own clients and requests, and owner-only access to settings, staff and exports
- private client links that are hard to guess, expire after 7 to 45 days, and can be cancelled by the firm at any time
- automatic sign-out after 60 minutes of inactivity
- checks that uploads are real PDF, JPEG, PNG or HEIC files (Doc Chaser does not scan for viruses; Google Drive scans received files)
- logs that leave out names, email addresses, phone numbers, links and file names
- limits on repeated attempts, and regular security reviews
No system is perfectly secure, but we work to keep the risk low and to act quickly if something goes wrong.
11. How long we keep information
| Information | How long |
|---|---|
| A client's details and upload links | Until the firm deletes the client. Deleting removes them at once. Anonymous counts with no names are kept for the firm's season report. |
| An expired or cancelled upload link | Stops working at once; its record is deleted 90 days after it expires |
| Message records (not message text) | 2 years |
| Activity log entries | 1 year |
| Unused invitations, signup codes and email-verification records | 30 days after they expire or are used |
| All of a firm's data after it cancels | Deleted 30 days after cancelling. The firm can export its data or reopen the account during those 30 days. |
| Backups | A limited period set by our hosting provider's backup schedule |
Files in a firm's Google Drive are never deleted by Doc Chaser.
12. Your rights
Under Canadian privacy law (PIPEDA), you can ask to see the personal information held about you, ask us to correct it, and withdraw your consent, subject to legal and contract limits. We will answer within 30 days.
- Firm owners and staff: contact our Privacy Officer (section 14).
- A firm's clients: contact your accountant first, because they decide how your information is used. You can also stop messages yourself at any time (section 7). If you contact us directly, we will pass your request to your firm and help them answer.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.
13. Privacy breaches
If we learn of a breach involving personal information, we act right away to contain it. We tell any affected firm promptly so it can meet its own obligations to its clients. Where a breach creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify the people affected, as the law requires. We keep a record of every breach.
14. Children, changes and contact
Children. Doc Chaser is a business tool for accounting and tax firms. It is not meant for children to use. A firm may hold information about a client who is under 18; that information is handled on the firm's behalf as described in section 2.
Changes to this policy. We will post any update here with a new effective date. If a change is significant, we will email firm owners before it takes effect.
Contact. Questions or requests about privacy:
Privacy Officer: Ashish Khadka
AK TECK, 5413 Aerodrome Road, Regina, Saskatchewan, S4W 0K4
akteck.npl@gmail.com