California Privacy Notice

This California Privacy Notice supplements our main Privacy Policy and applies solely to California residents. It describes how Dokli (the «Service») collects, uses, discloses, and retains your personal information, and explains your rights under the California Consumer Privacy Act of 2018 («CCPA»), as amended by the California Privacy Rights Act of 2020 («CPRA»).

1. Scope and Applicability

This Notice applies to natural persons who are California residents (each, a «Consumer») whose personal information we collect through interactions with Dokli. Capitalized terms not defined here have the meanings given in the CCPA.

2. Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information:

• Identifiers: name, email address, IP address, account identifier (Cal. Civ. Code § 1798.140(v)(1)(A))
• Customer records information: billing details (when you subscribe to a paid plan)
• Commercial information: subscription tier, payment history, plan upgrades/downgrades
• Internet or other electronic network activity: pages visited, buttons clicked, session metadata (analytics opt-in only)
• User-provided content: text descriptions you enter to generate documents (we do not use this content to train AI models)
• Geolocation data: country-level only (derived from IP for jurisdiction-specific document templates)
• Inferences: aggregate product usage patterns (no individual profiling)

We do not collect: biometric information, racial or ethnic origin, religious beliefs, philosophical beliefs, union membership, genetic data, sexual orientation, precise geolocation (latitude/longitude), driver's license, social security number, or financial account numbers (we do not store payment card numbers — payment processing is performed by Stripe / YooKassa).

3. Sources of Personal Information

• Directly from you (registration, document creation, account settings)
• Automatically (cookies, server logs, analytics — only with your consent)
• From service providers (Supabase auth, payment processors)

4. Purposes of Collection

• Provide and operate the Service (generate documents, manage account)
• Process payments and manage subscriptions
• Communicate with you about your account, security, and updates
• Detect, prevent, and respond to fraud or abuse
• Comply with legal obligations
• Improve the Service through aggregated analytics

5. Disclosure of Personal Information

We disclose personal information to the following categories of third parties for business purposes:

• Cloud infrastructure providers: Supabase (database + auth), Vercel (hosting)
• Payment processors: Stripe, YooKassa (card numbers never reach Dokli servers)
• AI providers: Anthropic (document generation; user-provided text is not used for training per their terms)
• Analytics: PostHog (product analytics, opt-in only)
• Error monitoring: Sentry (no user content; redacted error events only)

We do not «sell» or «share» personal information as those terms are defined under CPRA (Cal. Civ. Code § 1798.140(ad), (ah)). We have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months.

6. Retention

We retain personal information only as long as necessary to fulfill the purposes described above. Account data is retained for the lifetime of the account; upon deletion request, we erase data within 30 days except where retention is required by law (e.g., financial records — 4 years per applicable tax law).

7. Your California Rights

As a California resident, you have the following rights:

• Right to Know: request disclosure of categories and specific pieces of personal information we have collected, sources, purposes, and third parties with whom we shared it (Cal. Civ. Code § 1798.110, § 1798.115)
• Right to Delete: request deletion of personal information we have collected from you, subject to lawful retention exceptions (§ 1798.105)
• Right to Correct: request correction of inaccurate personal information (§ 1798.106 — added by CPRA)
• Right to Limit Use of Sensitive Personal Information: not applicable — we do not collect Sensitive Personal Information as defined in § 1798.140(ae)
• Right to Opt-Out of Sale/Sharing: not applicable — we do not sell or share personal information
• Right to Non-Discrimination: we will not discriminate against you for exercising any of these rights (§ 1798.125)
• Right to Data Portability: receive your data in a portable, machine-readable format (subset of Right to Know)

8. How to Submit a Request (DSAR)

To exercise any of the above rights, send a verifiable consumer request to hello@dokli.ru with the subject line «California Privacy Request». Include:

• The email address associated with your Dokli account
• The specific right you are exercising (Know / Delete / Correct / Portability)
• Sufficient information to verify you are the consumer (we may require additional verification depending on the sensitivity of the information requested)

We will respond within 45 calendar days. We may extend this period by an additional 45 days if reasonably necessary, with notice to you (Cal. Civ. Code § 1798.130(a) (2)). You may designate an authorized agent to make a request on your behalf; proper authorization documentation is required.

9. Minors

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, contact us at hello@dokli.ru and we will promptly delete it.

10. «Shine the Light» (Cal. Civ. Code § 1798.83)

California residents may request once per calendar year a list of categories of personal information disclosed to third parties for those parties' direct marketing purposes. Dokli does not disclose personal information to third parties for direct marketing purposes; the answer to such request is therefore a null list.

11. Updates to This Notice

We will update this Notice when our practices change. The effective date at the top of this page reflects the most recent material update. Material changes will be communicated by email or in-product notice when feasible.

12. Contact

Privacy Officer / Data Protection Inquiries: hello@dokli.ru. Mailing address and registered legal entity will be added once owner finalizes business registration (per /privacy section 0).

This Notice is provided in English; the main Privacy Policy is in Russian and applies in addition to this supplemental notice. In case of conflict, the more protective provision applies.