Privacy Policy
Effective October 13, 2026
This policy explains what information DocumentorAI handles, why, and what you can do about it.
Who we are
DocumentorAI is operated by Jonah Kutikov, a sole proprietor based in New Jersey ("DocumentorAI", "we", "us"). You can reach us at jonahkutikov@gmail.com.
Who this policy covers
- Clients: businesses that subscribe to DocumentorAI.
- Chat users: people who use an AI chat assistant on a Client's website. For these conversations we act as a service provider (processor) on behalf of that Client, who decides how the assistant is used. The Client's own privacy policy also applies.
- Site visitors: people who visit documentorai.org.
What we collect
| Information | Where it comes from | Why |
|---|---|---|
| Chat messages and the assistant's replies, with timestamps | What you type into a chat assistant | To answer you, and to let the Client review conversations with their assistant |
| A random chat session ID | Created by the chat widget and stored in your browser | To keep your conversation together as you move between pages |
| Documents, company details and assistant settings | Uploaded by Clients | So the assistant can answer questions about the Client's business |
| IP address | Your browser's connection | Used in memory to limit request rates and block abuse. We don't store it in our database, though it may appear briefly in our hosting provider's logs. |
| Error diagnostics | Our servers, when something fails | To find and fix problems. A report can include details of the request that failed. |
| Contact and billing details | Clients, by email and through our payment processor | To set up, support and bill for the service |
Please don't share sensitive information, such as health details, payment card numbers, passwords or government ID numbers, in a chat. The assistants aren't designed to handle it.
How we use information
We use the information above only to provide, secure, support and bill for the service. When you send a chat message, we send it, together with relevant excerpts from the Client's documents and a few earlier messages from the same conversation, to OpenAI to generate a reply. We don't sell personal information, we don't use it for advertising, and we don't use it to train AI models.
Service providers
We rely on these providers to run DocumentorAI. Each receives only what it needs for its role:
- OpenAI generates chat replies and document search embeddings. Under OpenAI's API policies, data sent through its API is not used to train its models by default and may be retained for a limited period for abuse monitoring.
- Neon hosts our database.
- Railway hosts our application servers.
- Sentry receives error diagnostics.
- Our payment processor handles Client payments. We don't store card details.
Our providers are based in, and process data in, the United States.
Browser storage and cookies
The chat widget stores a random session ID and the assistant's display settings in your browser's local storage so your conversation and the widget's appearance persist between pages. The Client admin panel stores the admin's sign-in in local storage. We don't use advertising or third-party tracking cookies.
How long we keep information
- Conversations, documents and settings are kept for as long as the Client's subscription is active. Clients can delete individual conversations at any time from their admin panel.
- When a Client cancels, we delete their documents, settings and conversations within 30 days.
- Error diagnostics are kept by our error-monitoring provider for a limited period and then deleted automatically.
- Billing and correspondence records are kept as long as needed for tax and legal purposes.
Your choices and rights
If you chatted with an assistant on a business's website, you can ask that business, or us at jonahkutikov@gmail.com, to see or delete your conversation. Tell us the website, roughly when you chatted, and something you wrote so we can find it. We'll work with the business to respond.
Clients can ask us at any time for a copy of their data or for it to be deleted.
Depending on where you live, for example California, the European Union or the United Kingdom, you may have additional rights such as access, correction, deletion or objection. We'll honor requests as required by the law that applies to you. We'll respond within 30 days.
Security
Data is encrypted in transit with HTTPS and encrypted at rest by our database provider. Admin areas are password-protected, conversations can only be read by the browser session that started them, by the Client's admin, and by us when needed to operate and support the service, and the service is rate-limited against abuse. No system is perfectly secure, but we work to protect your information and will notify affected Clients without undue delay if we learn of a breach involving their data.
Children
DocumentorAI isn't directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child has provided information through an assistant, contact us and we'll delete it.
Changes to this policy
We may update this policy. We'll post the new version here with a new effective date, and email Clients about material changes.
Contact
Privacy questions or requests: jonahkutikov@gmail.com.