Privacy Policy

This Privacy Policy explains how Aecron Technologies (“Aecron Technologies”, “UploadDoc”, “we”, “us”, or “our”) collects, uses, stores, and protects information when you use the UploadDoc platform at https://uploaddoc.space, https://workspace.uploaddoc.space, and associated intake and tracking links (collectively, the “Service”).

We process personal data in strict compliance with the Nigeria Data Protection Act (NDPA) 2023 (overseen by the Nigeria Data Protection Commission, NDPC) and align our privacy practices with the European Union General Data Protection Regulation (GDPR) for international workspaces and document submitters.

We collect only the information necessary to operate document intake folders, verify submissions, synchronize approved files, and secure workspace accounts:

• Workspace Account & Identity Data: When you create a personal or organization workspace, or accept a team invitation, we collect your full name, email address, bcrypt-hashed password (or Google OAuth identifier), organization name, organization category, optional cropped profile avatar, and Two-Factor Authentication (TOTP 2FA) enrollment state.
• Document Submission & Tracking Data: When a Submitter uploads a file via an intake link without an account, we collect the Submitter’s full name, email address, document title, optional notes, responses to custom intake fields configured by the workspace, the uploaded file binary (file name, MIME type, byte size), and a cryptographically generated tracking token (/track/[token]).
• Billing & Transaction Metadata: When a workspace upgrades a subscription plan or purchases a token add-on pack in Nigerian Naira (NGN), Paystack processes your payment instrument. We store transaction references, plan tier, token ledger balances, promo code redemptions, and invoice receipts. We never collect or store full credit/debit card numbers or CVV codes.
• Security, Audit & Notification Telemetry: To maintain workspace accountability and prevent abuse, we record IP addresses, browser/OS user-agent summaries, active session identifiers, immutable workspace audit log events (uploads, approvals, fix requests, deletions, permission changes), and optional Web Push (VAPID) subscription endpoints when you enable browser notifications.

Under the NDPA 2023 and GDPR, we process personal data only where we have a valid lawful basis:

• Performance of a Contract: Operating your workspace, generating intake links, rendering in-browser document previews, routing “Request Fix” notices to Submitters, deducting approval tokens, and syncing accepted files to your connected cloud storage.
• Legitimate Interests & Platform Security: Enforcing file type and size limits, verifying email ownership via 6-digit One-Time Passwords (OTP), maintaining immutable audit trails for team compliance, detecting fraudulent transactions or chargebacks, and diagnosing application errors.
• Consent: Connecting optional third-party cloud drives via OAuth 2.0, subscribing to browser Web Push notifications, and storing optional user interface preferences. You may withdraw consent at any time in Workspace Settings.
• Legal Obligations: Retaining financial transaction records for tax and accounting compliance under Nigerian law and responding to lawful requests from regulatory authorities.

Workspace Owners and authorized administrators can optionally connect Google Drive, Microsoft OneDrive, or Dropbox so that documents approved in UploadDoc are automatically copied into a designated folder in their external cloud drive.

• AES-256-GCM Token Encryption: OAuth 2.0 refresh and access tokens issued by Google, Microsoft, or Dropbox are encrypted at rest using AES-256-GCM before being stored in our database.
• Scoped Folder Dispatch: UploadDoc only transfers files that your team explicitly marks as Approved into the target folder path you configure. We do not scan, index, modify, or delete unrelated files in your cloud storage account.
• Instant Revocation: You can disconnect any cloud provider at any time from Workspace → Cloud Sync, which immediately revokes active sync operations and removes stored OAuth credentials.

UploadDoc is designed as an organized document intake and review workspace—not a permanent cold-storage archive. Every workspace can configure custom retention windows between 1 day and its plan’s maximum allowance in Settings → Data & Retention:

• Prospective Retention Updates & 7-Day Reminders: Each document receives a retentionExpiryDate at submission or acceptance. Workspace owners receive an email reminder 7 days before scheduled expiration. Once expired, the file binary is permanently purged from Cloudflare R2 object storage.
• Zero-Retention Cloud Handoff (purgeBinaryAfterSync): Workspaces with connected cloud storage can enable “Remove the UploadDoc copy after cloud sync”. When enabled, UploadDoc automatically deletes the file binary from our Cloudflare R2 storage immediately after confirming the file reached your connected Google Drive, OneDrive, or Dropbox folder, while preserving lightweight submission metadata and audit history.

We do not sell, rent, or trade personal data. We share data only with vetted infrastructure sub-processors bound by confidentiality and data protection obligations necessary to deliver the Service:

Aecron Technologies implements defense-in-depth technical and organizational controls to protect uploaded documents and account credentials:

• Direct Presigned Object Uploads: Document uploads travel over HTTPS/TLS directly to isolated Cloudflare R2 storage buckets using short-lived, cryptographically signed URLs.
• Strong Credential & Token Protection: Account passwords are hashed using bcrypt with minimum 12-character password enforcement. Connected cloud storage tokens are encrypted with AES-256-GCM.
• Multi-Factor & Session Controls: Users can enable TOTP Two-Factor Authentication (2FA) with single-use recovery backup codes, inspect active device/browser sessions, and revoke individual or all sessions remotely from Settings → Security.
• Role-Based Access Control (RBAC): Organization workspaces enforce granular permissions (owner, admin, member, and folder-scoped access) with every sensitive action recorded in the workspace audit log.

Under the Nigeria Data Protection Act (NDPA) 2023 and the GDPR, you have the following rights regarding your personal data:

• Right of Access & Data Portability: You may request a copy of your personal data or use our self-service export tools in Workspace Settings to download your account and workspace records in a structured, machine-readable format.
• Right to Rectification: You can update your display name, avatar, and verified email address directly in Settings → Account Profile and Settings → Security. Submitters can replace rejected documents using their tracking link.
• Right to Erasure (Account & Document Deletion): Workspace users can permanently delete their account from Settings → Security after password/OTP confirmation. Workspace owners and authorized reviewers can delete submitted documents at any time.
• Right to Object, Restrict Processing & Withdraw Consent: You may disconnect cloud integrations, disable push/email notification categories, or object to specific processing activities.
• Requests by External Document Submitters: Because UploadDoc processes submitted files on behalf of the receiving workspace (the Data Controller), Submitters seeking deletion or access to a submitted file should contact the organization that requested the document, or email us at support@uploaddoc.space so we can coordinate with the workspace owner.
• Supervisory Authority Complaints: If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) (ndpc.gov.ng) or your local data protection supervisory authority.

UploadDoc uses strictly necessary cookies and browser local storage to keep your workspace secure and remember your interface preferences. We do not use third-party advertising or cross-site tracking cookies:

• Authentication & Session State: Secure HTTP-only refresh tokens and client session state used to authenticate API requests across uploaddoc.space and workspace.uploaddoc.space.
• Theme Preference (uploaddoc_theme): A first-party cookie and localStorage key that remembers whether you selected Light, Dark, or System appearance.
• Verification Cooldown Timers: Temporary browser storage used to prevent duplicate OTP email dispatches during sign-in and registration.

Cross-Border Data Transfers: While Aecron Technologies operates from the Federal Republic of Nigeria, our cloud infrastructure providers (such as Cloudflare R2, MongoDB Atlas, Resend, and Vercel) may process data in secure data centers located outside Nigeria. Where personal data is transferred internationally, we ensure appropriate safeguards—including Standard Contractual Clauses (SCCs) and NDPA 2023 cross-border transfer protections—are in place.

Children’s Privacy: The Service is designed for businesses, academic institutions, and individuals aged 16 and older (or students submitting academic documents under institutional authorization). We do not knowingly collect personal information from children under 13 without verifiable parental or school consent.

Changes to This Privacy Policy: When we make material updates to this Privacy Policy, we will update the “Updated” date at the top of this page and notify workspace owners via email or an in-app banner.

Contact Our Data Protection Team: For privacy inquiries, NDPA/GDPR data subject requests, or security questions, contact Aecron Technologies at support@uploaddoc.space (Support & Privacy) or hello@uploaddoc.space (General Inquiries). You can also review our Terms of Service.