Privacy Policy

01Who we are

Docket Build, Inc. is a Delaware corporation with its principal operating office at Plot No. 5, Road No. 5, Mahindra Hills East Marredpally, Nehrunagar, Hyderabad, Secunderabad, Telangana, 500026, India. We provide immigration case-file assembly software to licensed attorneys and legal professionals.

For personal information relating to our own relationship with you — account records, billing, marketing and support — we act as a controller. For client documents a law firm uploads to assemble a petition, we act as a processor or service provider on that firm's instructions, and the firm remains the controller.

02What we collect about you directly

• Account information: name, work email, firm name, role and telephone number.
• Billing information: billing contact, address and tax identifiers. Card details are handled by our payment processor and never stored by us.
• Support correspondence: the content of messages you send us and our replies.
• Product telemetry: pages viewed, features used, error events and performance timings, associated with your account rather than with any client matter.
• Marketing preferences: what you have subscribed to and what you have turned off.

03How we use it

To provide, secure and support the service; to bill you; to notify you about changes that affect your use of the product; to respond to security and legal obligations; and, where you have not opted out, to tell you about product releases and research publications.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use client documents for any purpose other than performing the assembly service the firm requested.

04Client documents and matter content

Documents a firm uploads to assemble a petition are processed only to perform that assembly. They are encrypted with AES-256 at rest and TLS 1.3 in transit, stored in isolated tenant storage in the region the firm selects, and accessible only to users the firm has granted matter-level access.

Client documents, firm work product, cover-letter templates and exhibit indexes are contractually excluded from all model training, fine-tuning and evaluation. This exclusion is a term of the Data Processing Addendum rather than a policy statement, and it is one of the controls tested in our SOC 2 Type II report.

Retention is set by the firm. The default is 180 days after packet export, after which source uploads are permanently destroyed and only the assembled output and index metadata remain. Any document can be purged on demand, and we will issue a certificate of destruction on request.

05Analytics and telemetry

Our own telemetry never contains client-identifying information. No beneficiary name, alien registration number, passport number or date of birth appears in any analytics event. Matters are identified in telemetry by matter number and petition category only.

06Sharing and subprocessors

We share personal information only with subprocessors that support the service — cloud infrastructure, email delivery, payment processing, error monitoring and customer support tooling. Each is bound by written terms at least as protective as those in our DPA. The current list is published, and we give thirty days' notice before adding one.

We may also disclose information where legally compelled. Where we are permitted to do so, we will notify the affected customer before disclosing, so they can seek protective relief.

07International transfers

Firms select US or India data residency for document processing. Where personal information is transferred out of the EEA or the UK, we rely on Standard Contractual Clauses together with a transfer impact assessment, and we have appointed an EU representative for GDPR purposes.

08Your rights

Where a request concerns client documents held on behalf of a law firm, we will direct it to that firm, which is the controller for that content.

• Access — request a copy of the personal information we hold about you.
• Correction — have inaccurate information corrected.
• Deletion — request erasure, subject to our legal and contractual retention obligations.
• Portability — receive your information in a structured, machine-readable format.
• Objection and restriction — object to or restrict certain processing.
• Withdraw consent — where processing relies on consent, withdraw it at any time.
• Complain — to your supervisory authority, though we would rather you told us first.

09Retention

10Security

We maintain a documented security programme covering encryption, access control, change management, vulnerability management and incident response. We hold SOC 2 Type II certification, host in ISO 27001 certified data centres, and commission an annual third-party penetration test. Full details, and the documents themselves under NDA, are available from the trust center.

11Children

The service is not directed to children and we do not knowingly collect personal information from anyone under 18. Client documents in family and humanitarian matters may contain information about minors; that content is processed on the firm's instructions under the DPA and is subject to the same redaction and access controls as all other matter content.

12Changes

We will post any change here with a new effective date. Where a change materially affects how we handle personal information, we will notify account administrators by email at least thirty days before it takes effect.