Privacy Policy
- Last updated
- Version
- 2026-10-07
https://www.ashdocs.com/privacy · ASH Studios · Coimbatore, India · GSTIN 33DLEPA9895M2ZH
1. Who we are
ASHDOCS (ashdocs.com) is a product of ASH Studios, a proprietorship owned by Ashwin Manikandan, registered at No. 102, Ramalingam Colony, Sanganur, Coimbatore North, Coimbatore, Tamil Nadu 641043, India (GSTIN 33DLEPA9895M2ZH). In this policy "ASHDOCS", "we" and "us" mean ASH Studios. For anything about this policy or your data, write to ashwinmanikandan@ashdocs.com.
2. Who this policy is about
It covers three groups.
- Visitors to ashdocs.com.
- Account holders: people and businesses who sign up for the ASHDOCS dashboard or API.
- End customers: the people whose details an account holder puts into invoices and documents through ASHDOCS. For end customers we act as a data processor on the account holder's instructions; the account holder is the data controller (or "data fiduciary" under Indian law). If you are an end customer and have a question about an invoice you received, please contact the business that sent it first; we will help them respond.
3. What we collect
From visitors: standard server logs (IP address, browser, pages requested, timestamps) and, only if you accept analytics cookies, product analytics events through PostHog (see the Cookie Notice).
From account holders: name and email address; a password, stored only as a salted hash; sign-in and security events; API keys you create (shown once, stored hashed); your billing plan, credit balance and payment history (our payment provider, Razorpay, handles card and bank details; we store only the plan, the amounts, the last four digits of a card and Razorpay's payment identifiers); the business name, address, tax ID and logo you enter for your invoices; support messages; usage metadata for each API request (endpoint, time, credits used, status code, request size) so we can bill and secure the Service.
On behalf of account holders (end-customer data): customer names, email addresses, postal addresses, phone numbers, tax identifiers, line items, amounts, notes, uploaded files, HTML or URLs submitted for rendering, documents submitted for extraction or redaction, and everything the Service produces from them: PDFs, hosted invoice pages, emails, webhook payloads.
We do not knowingly collect payment card numbers, government ID numbers or health data; please do not put them in invoice notes.
4. Why we use it and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Providing the Service: rendering, numbering, hosting, sending documents | account and end-customer data | performance of our contract with you |
| Billing and credits | account, plan, usage metadata | contract; legal obligation (tax records) |
| Security, fraud and abuse prevention, rate limiting | logs, usage metadata, IP, signup checks | legitimate interests |
| Support | your messages and the records needed to answer | contract |
| Product analytics on the website and dashboard | analytics events | consent (cookie banner); you can withdraw it at any time |
| Product and service emails (receipts, invoices, security notices) | email address | contract |
| Marketing email | email address | consent; every message has an unsubscribe link |
| Legal compliance | whatever the law requires | legal obligation |
5. Where your data is stored and transferred
Our servers run on DigitalOcean; the database is MongoDB Atlas; files are stored on Cloudflare R2; the website runs on Vercel; email goes through Resend; payments through Razorpay; analytics through PostHog. The current list, with purposes and regions, is at ashdocs.com/subprocessors. Some providers process data outside India and outside your country. Where EU or UK personal data leaves those regions we rely on the providers' standard contractual clauses and equivalent safeguards. Indian personal data is processed in line with the Digital Personal Data Protection Act, 2023.
6. How long we keep it
- Account data: while your account exists, then up to 90 days after deletion for recovery and abuse prevention.
- Invoices, hosted pages and generated PDFs: while your account exists, because invoices are records you may be legally required to keep. You can delete an invoice from the dashboard; its hosted page stops working immediately and the file is removed from storage within 30 days.
- Files uploaded for one-off conversion, extraction or redaction: deleted within 24 hours after processing unless you save the output to your account.
- Request logs: 30 days. Backups: up to 35 days.
- Billing and tax records: as long as Indian tax law requires (currently up to 8 years).
- Support emails: 2 years.
7. Who we share it with
Only the sub-processors listed at ashdocs.com/subprocessors, under written data-processing terms, and only so they can provide their service to us. We do not sell personal data. We do not use your documents or your customers' data to train machine-learning models, and we do not use them for advertising. We disclose data when a law, court order or government authority requires it, and we will tell you unless we are legally prevented from doing so. If ASH Studios is ever sold or merges, your data moves with the Service under this policy, and we will notify you.
8. Security
TLS on every connection; encryption at rest with our storage and database providers; salted password hashes; API keys stored hashed and shown once; signed webhooks; least-privilege access to infrastructure; audit records for billing, key and account events; automated abuse detection at signup and on the API. No service is perfectly secure. If we learn of a breach that affects your personal data we will notify you and any required authority without undue delay, and in any case within the period the applicable law sets (72 hours under the GDPR).
9. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a supervisory authority (for example the Data Protection Board of India, your EU data-protection authority, or the UK ICO).
Account holders can export invoices and customers from the dashboard, change their details in Settings, and delete their account from Settings → Account. For anything else, email ashwinmanikandan@ashdocs.com; we will verify your identity and respond within 30 days.
End customers should contact the business that invoiced them; we will support that business in responding.
10. Grievance Officer (India)
As required by the Information Technology Act, 2000 and rules made under it, and the Digital Personal Data Protection Act, 2023, our Grievance Officer is: Ashwin Manikandan, ASH Studios, No. 102, Ramalingam Colony, Sanganur, Coimbatore North, Coimbatore, Tamil Nadu 641043; ashwinmanikandan@ashdocs.com; +91 73958 84070. We acknowledge grievances within 48 hours and resolve them within 30 days.
11. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children; if you believe we have, email us and we will delete it.
12. Cookies
See the Cookie Notice at ashdocs.com/cookies.
13. Changes
We will post changes on this page with a new "Last updated" date. For material changes we will email account holders at least 14 days before they take effect.