Legal
Privacy policy
Last updated 10 November 2026
This policy explains what personal data Documents Checklist (documentschecklist.com) collects, why, who we share it with, and the choices you have. We have tried to keep it plain and specific.
1. Who we are
Documents Checklist is operated by the owner of documentschecklist.com (“we”, “us”). We are the controller of the personal data described here, under the UK GDPR, the EU GDPR and the Data Protection Act 2018.
To ask a question about this policy or use your rights, send us a message through our contact page.
2. What we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Account | What it includesYour name, email address and sign-in details. Passwords are handled by our authentication provider and are not visible to us. | Where it comes fromYou |
| Application details | What it includesThe answers you give (for example travel dates, employment type, who is applying) and the names of the people on an application. | Where it comes fromYou |
| Your documents | What it includesFiles you upload or scan, plus their names, types, sizes and the dates you enter, such as expiry dates, any name you give a document you add yourself, and whether you uploaded it despite a failed check. Stored in the drive you choose (see section 4). | Where it comes fromYou |
| Messages | What it includesAnything you send through the contact form or Support page, with your name and email. For the contact form we also keep a one-way hash of your IP address to limit abuse. | Where it comes fromYou |
| Usage and analytics | What it includesPages you visit and how long you spend on them, your approximate location (country or city, worked out from your IP address), device and browser type, where you came from, and basic events such as “document uploaded”, “uploaded despite a failed check”, “document list printed” and which official website you opened from our links (the website only, not the page). If you add a document that is not on our checklist, the name you give it is also sent, in lower case with any numbers removed, so we can see which documents are missing from our checklists. The file itself is never sent. Once you sign in these are linked to your account ID. We do not send your name or email to analytics. | Where it comes fromYour use of the service |
| Subscription | What it includesYour plan, subscription status and renewal dates. Payments are handled by Paddle; we never see your card details. | Where it comes fromYou and Paddle |
| Technical | What it includesSecurity and error logs, such as IP address and browser type, kept by our hosting provider. | Where it comes fromYour device |
We do not knowingly collect more than we need, and we do not sell your personal data.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Providing the service: your account, checklists, storing and organising your documents, checks on uploads | Legal basisContract (we need it to provide what you asked for) |
| Optional AI features: AI document check and cover letter drafting | Legal basisYour consent, which you give by choosing to use the feature |
| Replying to your messages and giving support | Legal basisContract, or our legitimate interest in helping people who contact us |
| Keeping the service secure and preventing abuse and fraud | Legal basisLegitimate interests |
| Understanding how the service is used so we can improve it | Legal basisLegitimate interests (analytics that do not store anything on your device) |
| Keeping our checklists accurate, using the names of documents people add that our checklists do not list | Legal basisLegitimate interests |
| Taking payment and meeting tax and accounting duties | Legal basisContract and legal obligation |
4. Your documents
You choose where your documents are stored. You can connect your own Google Drive, Microsoft OneDrive or Dropbox, in which case the files live in your account in a folder we create, or you can use our secure drive. We do not open or read your documents ourselves. Our standard checks use file details and the dates you enter.
These checks are only a basic guide. If a date check fails you can still choose to upload the document, and we note on the document that you did. Documents you add yourself: when you add a document that is not on our checklist, you give it a name. We use that name to label the file, and send it to our analytics in lower case with numbers removed (see section 2) to improve our checklists. Please use a general name such as “Marriage certificate” rather than personal details.
When you connect a drive we store a token that lets the service act on your behalf. It is encrypted, and you can disconnect at any time in Account Settings. We only use the access you grant to create and manage files for your applications.
Optional AI check. If you turn on the AI check when uploading, the document is processed like this:
- If a PDF has readable text, we extract the text on our server, try to mask long number sequences such as document numbers, and send that text to our AI provider (OpenAI) to check it against what the checklist asks for.
- If the file is a scan, photo or PDF without readable text, the file (up to the first three pages) is sent to our OCR provider (Mistral AI) to extract the text. That text is then masked and sent to OpenAI as above. If OCR is unavailable, a small low-resolution preview image may be sent to OpenAI instead.
- We store only the outcome of the check, matched to a fingerprint of the file so identical files are not checked twice. We do not store the extracted text.
The AI check only advises you. It never blocks or decides anything on its own, and you can always upload a file regardless of its result. Cover letters are drafted from your application answers (such as names, itinerary and employment details), sent to OpenAI, and not from your uploaded documents.
5. Who we share data with
We use trusted providers to run the service. They process data only on our instructions.
| Provider | What for | Where |
|---|---|---|
| Neon | What forDatabase and sign-in (authentication) | WhereUK/EU |
| Cloudflare | What forHosting, security, the Turnstile bot check and our secure document drive | WhereGlobal network |
| PostHog | What forProduct analytics and error reports | WhereEU |
| OpenAI | What forOptional AI document check and cover letters | WhereUnited States |
| Mistral AI | What forOptional text extraction (OCR) for scans and photos | WhereEU (France) |
| Paddle | What forTaking payments and handling VAT as our merchant of record | WhereUK/EU |
| Resend | What forSending emails such as replies to your messages | WhereUnited States |
| Google, Microsoft, Dropbox | What forStoring your files, only if you connect your own account. Their own terms and privacy policies apply to your account with them. | WhereTheir locations |
We may also disclose data if the law requires it, or to protect our rights, our users or the service. If the business is ever sold or restructured, your data would transfer to the new owner under the same protections.
6. Transfers outside the UK and EEA
Some providers above are based in, or process data in, countries such as the United States. Where that happens we rely on the safeguards the law provides, such as adequacy decisions and data bridges, or the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses.
7. How long we keep it
- Applications and the files in our secure drive: until you delete them, or close your account.
- Files in your own Google Drive, OneDrive or Dropbox: these are yours. We never delete them, and they stay there if you delete an application or your account.
- Account data: until you close your account, which deletes your applications, connections, usage history, messages and subscription records from our systems.
- Contact-form messages from people without an account: as long as needed to deal with the enquiry and any follow-up, then deleted. You can ask us to delete them sooner.
- Payment and tax records: held by Paddle and by us for as long as the law requires.
8. Security
Connections to the service are encrypted. Access tokens for your drives are stored encrypted, access to your data is restricted to your account, and files in our secure drive are encrypted at rest by our storage provider. No system is perfectly secure, so please use a strong, unique password. If a breach affects your data we will tell you and the regulator where the law requires.
9. Your rights
Under UK and EU data protection law you have the right to:
- access the personal data we hold about you and get a copy
- have inaccurate data corrected
- have your data erased (you can delete files, applications or your whole account yourself in Account Settings)
- restrict or object to how we use your data
- receive your data in a portable format (your files can be downloaded as a zip at any time)
- withdraw consent at any time, for example by not using the AI features
- complain to your data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk).
To use these rights, contact us through the contact page. We respond within one month.
10. Cookies and similar technologies
We keep this to the minimum and do not use advertising or tracking cookies.
- Sign-in session: essential. It keeps you signed in and secure.
- Theme preference (light or dark) and the draft of a cover letter brief, saved in your browser so the site remembers your choices. These are used only on your device.
- Bot protection: when you use the contact form, Cloudflare Turnstile checks you are a person. It is used for security only.
Our analytics are configured not to store anything on your device, so there is no analytics cookie to accept or refuse.
11. Automated decisions
The AI check is an aid. It does not make decisions that affect your legal rights. Every result can be reviewed and overridden by you, and a person is available through the contact page if you would like one to look at a result.
12. Children
The service is for adults aged 18 or over. You may add details of a child who is part of your application, but only if you are their parent or legal guardian. We do not knowingly create accounts for children.
13. Reviews
If you leave a review, we store your rating, your words and the name you choose to show. We only show a review on our website if you tick the box that allows it and we have approved it. You can edit or delete your review in the app at any time, and a deleted review is removed from the website straight away. Our legal basis for showing it is your consent, which you can withdraw whenever you like.
14. Changes to this policy
We will update this page when our practices change and show the date at the top. For significant changes we will tell you in the service or by email.