Privacy notice

Your data belongs to you. No one else.

Docyt AI Privacy Policy

Last Updated: October 26, 2026

Your Data, Your Rules

At Docyt, we believe privacy should be simple:

• Your data belongs to you. We don’t own it. We process your business’s books on your behalf and on your instructions.
• Delete it, and it’s gone. If you remove your data, we remove it from our servers on the timelines in How Long We Keep Your Data.
• Private by default. Nothing you add is public unless you decide to share it.

We built Docyt to make accounting easier, not to snoop on your information. This notice covers docyt.com, the Docyt web and mobile applications, and any AI assistant (such as ChatGPT or Claude) that you choose to connect to your Docyt account.

What We Collect (and Where It Comes From)

Docyt is accounting software, so most of what we hold is your business’s financial information. We collect:

• Account information: your name, email, phone number, profile picture, job title, the business or businesses you belong to, and your role in each.
• Financial documents: invoices, bills, receipts, bank and credit card statements, payroll reports, contracts and the other files you upload or that your connected systems send us. We store the files plus basics like file name, size and the data we read from them.
• Transactions and books data: bank and card transactions, balances, account identifiers (such as the last digits of an account or card), your chart of accounts, journal entries, categorizations, reconciliations, financial reports and the KPIs we calculate from them.
• Information about people on your documents: the names, contact details, payment details and amounts of the vendors, customers and employees that appear in your books and files. We process this on your behalf as part of doing your accounting.
• Data from systems you connect: property management systems (PMS), point-of-sale systems (POS), payroll providers, banks and card issuers, QuickBooks Online and other integrations you authorize. We pull only the data you allow each connection to share.
• Billing information: your plan, invoices and payment status. Card and bank details used to pay Docyt are handled by our payment processor; we keep only a reference and the last digits.
• Communications: support requests, emails, chat messages and, where you use it, the SMS verification codes described below.
• Device and usage details: browser type, operating system, IP address, crash logs, and which pages and features you use, so we can fix problems fast and understand what is useful.
• Location: approximate location from your IP address or Wi-Fi. Precise GPS location only if you give us permission.
• Contacts: if you allow it, we use your device contacts to make sharing simpler.

This information comes from you and your team, from the systems you connect, from the accounting firm or Docyt staff who work on your books with your permission, and from your use of Docyt. We also use cookies, the tiny digital reminders that help us remember your preferences and improve your experience. See Types of cookies we use.

How We Use Your Data

Here’s how we put your data to work:

• To do your books. We extract data from your documents, match and categorize transactions, reconcile accounts, post entries to your ledger, close your months and produce your financial reports and KPIs.
• To run Docyt. To log you in, sync your connected systems, process payments you initiate and deliver the reports and tools you use every day.
• To operate AI features. Our accounting automations use AI models to read documents, suggest categories and answer questions about your books, under the rules in AI and Your Data.
• To serve a connected AI assistant. If you connect ChatGPT, Claude or another assistant, we return the data it requests on your behalf, as described in Connected AI Assistants.
• To support you. To answer your questions and resolve issues.
• To improve Docyt. To understand which features are most helpful, using anonymized usage data.
• To keep Docyt secure. To verify identities, block fraud or abuse and investigate incidents.
• To bill you and keep records. To invoice you and meet our legal, tax and accounting obligations.
• To keep you informed. To send important updates, like product changes or account notices, and, if you opt in, marketing emails.

No hidden agenda. No surprise usage. We do not sell your information and we do not use your books data to advertise to you or anyone else.

AI and Your Data

Docyt uses Google Cloud Vertex AI (Gemini models) to power certain accounting automations. And here’s the key part:

• Your data is never used to train AI models.
• We’ve set it up for zero retention: no storing your requests or responses.
• Everything is encrypted with customer-managed keys.
• All AI calls are encrypted, and enterprise customers can choose private, extra-secure routing.

In short: you get AI power without giving up control of your information.

Connected AI Assistants

You can connect a third-party AI assistant, such as OpenAI’s ChatGPT or Anthropic’s Claude, to your Docyt account and ask it questions about your business. Connecting is optional and never required to use Docyt. You start the connection yourself, sign in to Docyt and approve it on a consent screen.

What a connected assistant can read. When you ask it a question, the assistant may request the following from Docyt on your behalf:

• The businesses in your Docyt account.
• Financial reports: profit and loss, balance sheet, cash flow and operating statements.
• KPIs and metrics, such as occupancy, ADR and RevPAR for hospitality businesses.
• Portfolio summaries across your businesses.
• Transactions, including dates, amounts, categories, vendor or payee names and whether they are verified.
• Bank statement status and coverage.
• Your Docyt account credit balance.

The assistant can only see businesses your own Docyt account can already see, with the permissions you already have. It never receives your Docyt password, your online banking credentials or access to any business you have not been granted.

What Docyt receives from the assistant. When an assistant calls Docyt, Docyt receives the details of the request: the business, the date range, the report or metric, and any filters, such as a vendor name or an amount. We use these details only to answer that request. For security, we log each request with your user ID, the tool used, the assistant’s name, your IP address and your device type. We do not log the request details. We keep these logs for up to 24 months, as described under How Long We Keep Your Data.

The connection is read-only. Every tool Docyt exposes to a connected assistant reads data; none of them write. A connected assistant cannot create, edit, categorize, verify or delete a transaction, post a journal entry, move money, pay a bill, upload a document or change any setting in your account.

What the assistant provider receives. The data Docyt returns, and anything you type in that conversation, is received by the assistant’s provider: OpenAI for ChatGPT, Anthropic for Claude. That provider’s own privacy policy and your settings with them govern how long they keep the conversation and whether they use it to train their models. Docyt does not control and cannot change those practices, so review them before connecting. Remember that your books contain information about third parties, such as your vendors, customers and employees, and that information travels with your questions.

Disconnecting. You can disconnect an assistant at any time from the assistant’s connector settings or by asking us at privacy@docyt.com. Disconnecting revokes its access to Docyt immediately. It does not delete anything in your books, and it does not reach into the provider’s own record of past conversations, which you manage with that provider.

How We Keep Things Secure

We take security seriously (without overcomplicating it):

• Sensitive documents and credentials are locked with AES-256 encryption.
• Every connection uses TLS 1.2+ encryption.
• Our team uses multi-factor authentication and role-based permissions.
• Every access to your data is logged and reviewed.
• We maintain SOC 2 Type II compliance, independent proof that our security practices meet strict standards.

Your data is encrypted on your device, in transit, and on our servers.

How Long We Keep Your Data

We keep personal information only as long as we need it for the purposes above. The periods below are our standard practice:

Data	How long we keep it
Financial documents and books data	While your business is active in Docyt. After you delete it or close your account, it is removed from active systems within 30 days and from backups within 90 days.
Account, billing and transaction records	While your account is open, then as needed to meet legal, tax and accounting obligations, generally up to 7 years.
Support requests and communications	Up to 3 years after the interaction.
Usage, device and log data	Up to 24 months in identifiable form; longer once anonymized.
Anonymized and aggregated data	Indefinitely. It no longer identifies you or your business.

We may keep information longer where the law requires it, where it is subject to a legal hold or where we need it to protect our rights. Data that a connected AI assistant received is held by that assistant’s provider under its own retention rules.

Your Rights and Choices

You’re in control the whole way. In Docyt you can:

• Delete files anytime. They’ll be removed from Docyt servers on the timeline above.
• Deactivate your account. Stops new activity but keeps your past records accessible.
• Opt out of marketing emails. Click “unsubscribe” and you’re done.
• Disconnect any AI assistant or integration you have connected.

You can also ask us to:

• Access the personal information we hold about you and learn how we use and share it.
• Correct information that is inaccurate.
• Delete your personal information, subject to the retention periods above.
• Receive a copy of your information in a portable format.
• Opt out of targeted advertising, the sale of personal information and profiling that has legal or similarly significant effects. We do not sell personal information or use it for targeted advertising, and we honor the Global Privacy Control browser signal as an opt-out request.

Residents of California, Colorado, Connecticut, Texas, Virginia and other U.S. states with comprehensive privacy laws have these rights under their state law. We extend them to everyone whose information we hold directly. To exercise them, email privacy@docyt.com or contact us at the address below. We will verify your request, will not discriminate against you for making it and will respond within 45 days; if we need more time we will tell you why and take up to 45 more. If we decline a request, you may appeal by replying to our response, and we will answer the appeal within 45 days. If you are not satisfied, you may contact your state attorney general.

If your information appears in a Docyt customer’s books, for example because you are their vendor, customer or employee, Docyt processes it on that business’s behalf. Please direct access, correction or deletion requests to that business; we will help it respond.

When We Share Data

We don’t sell your information. Ever. We share it only in these cases:

• Service providers that work for us, under contracts that limit them to our instructions: cloud hosting and storage, AI model providers (see AI and Your Data), payment processing, email and SMS delivery, customer support tooling, product analytics, error monitoring and security services.
• People you authorize: your team members, your accountant or bookkeeping firm and anyone else you give access to your Docyt account.
• Systems you connect: the PMS, POS, payroll, banking and accounting systems you link to Docyt, which receive the data needed to keep them in sync.
• AI assistant providers you connect, such as OpenAI or Anthropic, which receive the data your assistant requests, as described in Connected AI Assistants.
• Payment networks and banks when you use Docyt to pay a bill or receive a payment.
• If the law requires it, or to respond to lawful requests from public authorities.
• To stop fraud or security threats and protect the rights and safety of Docyt, our customers and others.
• If Docyt merges with or is acquired by another company. We will tell you before your information becomes subject to a different privacy notice.
• In anonymized or aggregated form for research or product improvements.

SMS Communications and Mobile Data

Docyt may send SMS (Short Message Service) text messages to the phone number you have provided in connection with your account. These messages are strictly transactional in nature and are used exclusively to relay bank verification codes during Docyt’s automated bank statement retrieval process, in cases where your financial institution requires two-factor authentication. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes at any time. Mobile opt-in data and consent are not shared with any third parties. Phone numbers collected for the purpose of SMS verification are used solely for that verification purpose. Docyt does not use your mobile phone number for marketing communications, does not sell your phone number to data brokers, and does not share your phone number with lead generators or any other third party for commercial purposes. Standard message and data rates charged by your mobile carrier may apply to messages you receive from Docyt. For information about how to opt out of SMS messages, how to request assistance, or how to resubscribe after opting out, please refer to the “Docyt Bank Verification SMS Program” section of our Terms of Service.

Who Can Use Docyt

Right now, Docyt is available in the U.S. only. If you’re outside the U.S., your data may still be processed here under U.S. laws.

Children’s Information

Docyt is not intended for individuals under 18, and we do not knowingly collect personal information from anyone under 18. If you become aware that a minor has provided us with personal information, please contact us immediately and we will delete it.

Types of cookies we use

• Necessary: keep you signed in, remember your consent choices and protect the site. Always on.
• Functional: remember preferences such as language and form details.
• Analytics: help us understand how visitors use docyt.com (for example Google Analytics and HubSpot).
• Advertisement: measure the ads that bring visitors to docyt.com and show relevant ads elsewhere. Off until you accept them.

Manage cookie preferences

You can modify your cookie settings anytime by clicking the ‘Consent Preferences’ button on docyt.com. This will allow you to revisit the cookie consent banner and update your preferences or withdraw your consent immediately. Additionally, different browsers offer various methods to block and delete cookies used by websites. You can adjust your browser settings to block or delete cookies. Below are links to support documents on how to manage and delete cookies in major web browsers.

• Chrome: support.google.com/accounts/answer/32050
• Safari: support.apple.com/guide/safari/sfri11471/mac
• Firefox: support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
• Microsoft Edge: support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge

If you are using a different web browser, please refer to its official support documentation.

Policy Updates

If we make changes, we’ll update this page and the date at the top. Big updates? We’ll give you a heads-up by email or in the app.

Contact Us

Questions or concerns? privacy@docyt.com

Docyt Inc.
5255 Stevens Creek Blvd, STE 220
Santa Clara, CA 95051, USA
Attention: Privacy