Privacy Policy

1. Who we are

DOXBOX is operated by RMS Techknowledgy Private Limited ("RMS", "we", "us"), based in Karachi, Pakistan. This policy explains how we handle personal data when you visit our website, request a demo, or use the DOXBOX application.

Our role depends on the data:

Website visitors, demo requests and account holders: we decide why and how this data is used, so we are the controller.
Documents and other content your organisation stores in DOXBOX: your organisation decides what is uploaded and why. We process it on your organisation's behalf, as a processor (or service provider), following your instructions. If you are an individual whose data appears in a customer's documents, please contact that organisation first.

2. What we collect

When you request a demo

Company name, email address, your preferred date and time, and any message you write.
A reCAPTCHA token, which Google uses to tell people from bots (see who we share it with).

When you have a DOXBOX account

Your name, email address, role and organisation, and your profile details.
Your password, stored only in hashed form, and your two-factor authentication secret and backup codes if you enable 2FA.
Your sign-in session, kept in a secure cookie (see cookies).

Content your organisation stores in DOXBOX

The documents and files you upload, their versions, and the text and fields we extract from them (for example invoice numbers, dates, amounts and names).
Classifications and confidence scores, tags, cases, share links, retention and legal-hold settings, and any automations, recipients and webhook endpoints you configure.

Documents can contain sensitive personal data, such as identity documents, bank statements or résumés. Your organisation is responsible for deciding what it uploads.

Activity records

An audit trail of actions in the application (such as sign-ins, uploads, shares, deletions and setting changes), with the time, the user and their IP address. This is part of the governance features your organisation relies on.
Records of automation runs and webhook deliveries, and the status of document-processing jobs.

We do not use advertising trackers or third-party analytics on the website or in the application.

3. How we use it

To provide the Service: store and process documents, run OCR, classification and extraction, power search, run automations and send the reports and notifications your organisation configures.
To secure the Service: authenticate users, enforce roles and permissions, keep audit trails, prevent abuse and investigate incidents.
To communicate with you: respond to demo requests, send account and security emails (such as password resets and storage alerts) and reply to support questions.
To improve and maintain the Service: monitor processing performance and fix problems.
To meet legal obligations and to establish or defend legal claims.

We do not sell personal data, and we do not use the content of your documents to train AI models.

4. AI and automated processing

We want to be clear about where AI is involved:

OCR, classification and field extraction run within the DOXBOX processing pipeline. Document content is not sent to an external AI provider for these steps.
Plain-English automation drafting is an optional feature, available only when your organisation has it enabled. When a user uses it, the text they type, along with the list of extractable field names and their types, the current date and the user's time zone, is sent to an AI model provider (Anthropic) so that it can return a draft automation. Your documents and their contents are not sent for this feature. We record how much the feature is used (for example the length of the request and the number of tokens) for usage limits and billing.
Results are suggestions. Low-confidence fields are flagged for human review, and drafted automations are never saved until a person approves them.

We share personal data only with people and companies that help us run DOXBOX, and only as needed:

Email delivery: SendGrid sends the emails DOXBOX generates, such as password resets, alerts and the automation reports your organisation configures (including their attachments).
Form protection: Google reCAPTCHA protects the demo request form. Google's own privacy policy applies to what it collects.
AI drafting: Anthropic, only for the optional plain-English drafting feature described above.
Your storage provider: if your organisation connects its own storage (such as AWS S3, DigitalOcean Spaces or MinIO), your documents are stored there under your account.
Infrastructure providers: the hosting and cloud services that run DOXBOX.
Destinations you choose: the email recipients of your automations, the holders of your share links, and the systems that receive your webhooks.
Authorities and advisers: where we are legally required to, or to protect rights and safety, or to our professional advisers under confidentiality.
A business transfer: if RMS is involved in a merger or sale, data may transfer to the new owner under this policy.

Some pages also load resources from other providers: Google Fonts, a Google Maps embed when you open our contact map, and, on the demo request page, scripts from jsDelivr. These providers can see your IP address and browser details when your browser fetches them.

6. Cookies

We use only the cookies needed to make the Service work:

Session cookie (dmsfront_sessionid): keeps you signed in. It is signed to prevent tampering, and it expires or is cleared when you sign out.
Security cookie: protects forms against cross-site request forgery.
reCAPTCHA: Google may set cookies on the demo request page to detect abuse.

We do not use advertising or tracking cookies. You can block cookies in your browser, but you will then not be able to sign in.

7. Security

We protect personal data with role-based access control, optional two-factor authentication, hashed passwords, per-organisation storage isolation, signed webhook payloads, and a full audit trail of activity. Documents can be kept in storage that your organisation owns and controls. No system is perfectly secure, so if we learn of a breach affecting your data we will notify the affected organisation without undue delay and as the law requires.

8. How long we keep it

Documents and content: for as long as your organisation keeps them, subject to the retention policies and legal holds it configures. When your organisation deletes a document, it is removed from the Service. Deleted documents may not be recoverable.
Account data: while the account is active, and afterwards for as long as needed to close it, meet legal obligations and resolve disputes.
Audit and activity records: kept as part of your organisation's audit trail, for as long as your organisation needs it for governance and compliance.
Demo requests: for as long as needed to respond and follow up, unless you ask us to delete them sooner.

When your organisation stops using DOXBOX, we will delete or return its content on request, unless we are required by law to keep it.

9. International transfers

We are based in Pakistan, our team works across more than one country, and our providers operate globally, so personal data may be processed in countries other than yours. Where that happens we take reasonable steps to make sure it stays protected, for example through contractual commitments with our providers.

10. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to certain processing, receive a copy of it, or withdraw consent you have given. To exercise a right, email us at info@rmstechknowledgy.com. We may need to verify your identity first.

If your data is in documents stored by one of our customers, we will pass your request to that customer, as they control that data. You can also complain to your local data protection authority.

11. Children

DOXBOX is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have, please contact us and we will delete it.

12. Changes to this policy

We may update this policy as the product or the law changes. We will update the date at the top of this page and, for material changes, notify your organisation's administrators or show a notice in the Service.

13. Contact us

Questions or requests about privacy? Contact RMS Techknowledgy Private Limited at info@rmstechknowledgy.com or write to Office No. 04-A, Building S-4, Ground Floor, NASTP 2 Silicon Valley, Shahrah-e-Faisal, Karachi, Pakistan.