COMPANY

Privacy Notice

Last updated: September 1, 2026

PRIVACY NOTICE

This Privacy Notice applies to:

visitors to our website;
business prospects who interact with us, request information, or receive marketing communications; and
business customers and their representatives who use or subscribe to our services.

It explains how AIDOCS STUDIO collects, uses, shares, and protects personal data in these contexts, as well as the rights available to individuals under applicable data protection laws, in particular the General Data Protection Regulation (GDPR).

Protecting your privacy is important to AIDOCS STUDIO. When you interact with us or use our services, you may share personal data with us, and we take this responsibility seriously. This Privacy Notice is intended to help you understand how and why we process your personal data and how you can exercise your rights.

This Privacy Notice applies regardless of whether you interact with us directly, through our website, or through the use of our services by your organization.

WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?

AIDOCS STUDIO, a French company registered under the number 939 664 108 R.C.S. Montpellier, with its registered office at 3 Rue des Gladiateurs 34170 Castelnau-le-Lez, France, acts as data controller for personal data that it processes for its own purposes, including in connection with the website, business development, account administration, the B2B contractual relationship, support and the security of its activities.

In addition, when AIDOCS STUDIO provides its services to business customers, it may process personal data on behalf of and under the instructions of such customers, acting as a data processor within the meaning of the GDPR. In those cases, the relevant customer acts as the data controller and is primarily responsible for the processing of personal data.

If you have any questions or wish to exercise your rights in connection with processing carried out on behalf of one of our customers, you should contact that customer directly. Where appropriate, any request we receive in this context will be forwarded to the relevant customer.

This Privacy Notice governs processing for which AIDOCS STUDIO acts as controller. It also provides, for transparency, general information about operations that AIDOCS STUDIO may perform as processor in relation to Client content; that processing is governed by the Client’s instructions and the applicable Data Processing Agreement. This Privacy Notice does not apply to processing carried out by our clients independently of the Services and does not replace the information that the Client, as controller, must provide to data subjects.

WHAT PERSONAL DATA DO WE COLLECT?

We may collect and process different categories of personal data, depending on how you interact with AIDOCS STUDIO, whether as a website visitor, a business prospect, or a business customer.

The categories of personal data processed may vary depending on the services used, the nature of the relationship with AIDOCS STUDIO, and applicable contractual arrangements.

Data you provide directly

When you contact us, request information, book a demonstration, subscribe to our services, place an order, or otherwise interact with us, we collect the personal data that you choose to provide, which may include in particular:

identification data (such as your first and last name);
professional contact details (such as business email address, phone number, job title);
company-related information (such as company name, industry, or size);
account and subscription information;
the content of your communications with us.

We only collect personal data that is necessary for the relevant purpose. Providing such data is voluntary; however, if you choose not to provide certain information, we may be unable to respond to your request or provide access to certain services.

Data collected automatically

When you visit our website or use our services, certain technical and usage data may be collected through server logs and, for strictly necessary preferences, local browser storage, including:

IP address;
device and browser information;
operating system;
date and time of access;
pages viewed and interactions with the website or services;
log and usage data relating to the performance and security of our services.

Local browser storage used on the website may retain, in particular, language, navigation or interface preferences and is not intended for advertising tracking. If non-essential cookies or similar trackers are introduced, the information provided to users and, where required, the consent mechanism will be updated accordingly.

Technical logs and operational records may contain data relating to requests, users and their interactions with the Services. They may be processed where necessary for security, continuity, support, diagnostics, auditing, traceability and evidence.

Data collected from third-party sources

Subject to applicable law, we may receive personal data from third-party sources, in particular in a B2B context, such as:

professional social networks;
publicly available databases or websites;
business partners or service providers.

Such data may be used, in particular, to identify potential business contacts, maintain and develop our commercial relationships.

Content entrusted to Max services and data-protection measures

Questions, instructions, communications, emails, documents, attachments, folders, document spaces, sources and other content entrusted or made accessible to Max may contain personal data or confidential information selected, submitted or made available by the customer or user.

Depending on the functionality and processing stage, AIDOCS STUDIO may apply measures such as data minimisation, pseudonymisation, generalisation or anonymisation where appropriate and technically relevant. Pseudonymisation reduces data exposure but remains reversible and the resulting data continues to constitute personal data.

Certain operations, including receipt, routing, extraction, optical character recognition, translation, presentation generation or document transformation, may require access to or processing of source content before pseudonymisation or without prior pseudonymisation. Any external processing is limited to what is necessary for the relevant function and is governed by the applicable contractual and data-protection safeguards.

AIDOCS STUDIO does not represent that all content is anonymised or pseudonymised before every processing operation or before every operation performed by an authorised service provider.

Sensitive data and data relating to criminal convictions and offences

Given the nature of the Services, content submitted or made accessible by the Client may contain special categories of personal data within the meaning of Article 9 of the GDPR, as well as data relating to criminal convictions and offences within the meaning of Article 10.

AIDOCS STUDIO does not specifically request such data. Where it is contained in Client-submitted content, AIDOCS STUDIO processes it on behalf of and under the documented instructions of the Client, which remains responsible for ensuring the lawfulness of the processing, identifying the applicable legal basis and satisfying any additional conditions or safeguards required by law.

WHY DO WE COLLECT YOUR DATA AND HOW LONG DO WE RETAIN IT?

We process personal data only for specific, explicit, and legitimate purposes, based on an appropriate legal basis under the GDPR, and for no longer than is necessary to achieve those purposes.

The table below is intended to provide a clear overview of why we process personal data, the legal bases relied upon, and how long such data is retained.

Contract management and service provision

Purpose	Legal basis	Retention period
Management of contractual relationships and provision of services	Performance of the contract where the data subject is a party to it; legitimate interest in managing and performing a B2B contractual relationship in other cases	Duration of the contractual relationship, then for the applicable period required for legal obligations, evidence and the establishment, exercise or defence of legal claims
Compliance with accounting, tax, and regulatory obligations	Processing is necessary to comply with legal obligations	Retained in intermediate archives for the applicable statutory retention periods
Management of pre-litigation and litigation	Legitimate interest in establishing, exercising, or defending legal claims	Duration of the applicable statute of limitations (generally 5 years)

Marketing and commercial prospecting

Purpose	Legal basis	Retention period
Marketing communications and commercial prospecting by electronic means	Legitimate interest in promoting and developing our business; consent where required by law	Until withdrawal of consent (where applicable), or 3 years from: (i) the end of the commercial relationship for customers, or (ii) the last contact or data collection for prospects

Commercial activity management

Purpose	Legal basis	Retention period
Business analytics, statistics, surveys, and service improvement	Legitimate interest in improving our services, user experience, and business performance	For the period necessary to produce and use the relevant analysis, then aggregated or anonymised where reasonably possible

Security, operation and performance of services

Purpose	Legal basis	Retention period
Monitoring, ensuring security, preventing fraud, and maintaining the performance of our website and services (including logs and technical data)	Legitimate interest in ensuring the security and proper functioning of our services	For the period reasonably necessary for security, continuity, support, diagnostics, auditing, traceability and evidence, taking account of the nature and sensitivity of the relevant data

Data subject rights management

Purpose	Legal basis	Retention period
Handling requests to exercise data subject rights	Compliance with a legal obligation	Time necessary to handle the request and, where appropriate, to retain evidence of its handling for the applicable statutory limitation period

When AIDOCS STUDIO acts as a processor, Client-submitted content and related personal data are retained in accordance with the DPA for the periods necessary to provide and maintain the continuity of the Services, ensure security, support, diagnostics, auditing and traceability, carry out return or deletion operations, rotate backups, establish, exercise or defend legal claims, and comply with applicable legal obligations.

Personal data may be retained for longer periods where required to comply with legal obligations or for the establishment, exercise or defence of legal claims. In all cases, personal data is not retained beyond what is necessary for the applicable purpose. Deletion from active systems does not necessarily result in the immediate erasure of temporary copies, caches, reconstructible derived data or backups, in which data may remain until normal expiry or rotation. During that period, access and use remain restricted to the relevant purpose. Once the applicable retention period and technical purge cycle have expired, data is deleted or, where appropriate, irreversibly anonymised.

WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

We do not sell personal data.

We disclose personal data only where necessary for the purposes described in this Privacy Notice, including communication and collaboration, hosting and storage, backup, document processing, extraction or optical character recognition where required, artificial-intelligence processing, technical support, security, performance measurement, professional advice or compliance with a legal obligation.

Internal recipients

Personal data may be accessed by AIDOCS STUDIO’s authorized employees, strictly on a need-to-know basis and solely for the performance of their duties.

External recipients

Depending on the service used and the configuration selected, the categories of external recipients are as follows:

communication, messaging and collaboration service providers;
hosting, infrastructure, storage and backup service providers;
document-processing, extraction, optical-character-recognition, translation, presentation-generation and artificial-intelligence service providers selected for the applicable function or workflow;
CRM, customer support, or analytics tools, for account, customer relationship, support, and performance data required for their respective functions;
professional advisors (such as legal counsel, auditors, or accountants);
public or judicial authorities, where disclosure is required by applicable law or a binding legal request.

All processors are subject to appropriate contractual obligations, including confidentiality and data-protection commitments in accordance with the GDPR. The current detailed list of sub-processors, their functions and data locations is provided in our Data Processing Agreement. Not every provider listed in that agreement is necessarily used for each request or workflow.

Corporate transactions

Personal data may also be disclosed in the context of a potential or actual merger, acquisition, restructuring, or sale of all or part of AIDOCS STUDIO’s assets, subject to appropriate safeguards.

International data transfers

Some of our service providers are located outside the European Economic Area (EEA), including in countries such as the United States. Where personal data is transferred outside the EEA to a country that is not subject to an adequacy decision by the European Commission pursuant to Article 45 of the GDPR, such transfers are governed by appropriate safeguards under Articles 46 et seq. of the GDPR, in particular the Standard Contractual Clauses adopted by the European Commission.

Where required, we implement additional technical and organizational measures to ensure a level of protection essentially equivalent to that guaranteed within the EEA.

You may obtain further information on international data transfers and a copy of the relevant safeguards (excluding confidential information) by contacting us as indicated in Section 7.

WHAT ARE YOUR RIGHTS AND HOW TO EXERCISE THEM?

Under applicable data protection laws, you have the following rights, subject to legal conditions:

To withdraw your consent at any time where processing is based on consent;
To obtain confirmation as to whether we process your personal data and, if so, to access it and receive a copy;
To request correction or completion of inaccurate or incomplete data;
To request erasure of your data or restriction of processing in certain circumstances;
To receive your data in a structured, commonly used, and machine-readable format, or to request its transmission to another controller;
To define instructions regarding the processing of your data after your death;
To object to processing based on our legitimate interests, unless we demonstrate compelling legitimate grounds or the processing is required for legal claims;
To object at any time to the processing of your data for direct marketing purposes.

You can exercise your rights by contacting us at the email address provided in Section 7.

Where AIDOCS STUDIO processes personal data solely on behalf of a Client, requests relating to that processing should be addressed in the first instance to the relevant Client, which controls the purpose and instructions. AIDOCS STUDIO will assist that Client in accordance with the DPA. Where data originates from a mailbox, document space or other source controlled by the Client, the Client remains responsible for actions in that source. Removing access to, or deleting, a source item does not necessarily erase operational histories, copies, metadata, logs, caches or backups retained within the Services for the applicable purposes; those records remain subject to the DPA and the retention rules described above.

You also have the right to lodge a complaint with the competent supervisory authority. In France, the relevant authority is the CNIL (www.cnil.fr).

These rights may be subject to limitations or exceptions under applicable law.

PROTECTION OF MINORS

Our services are intended for business users only and are not designed for use by minors. We do not knowingly collect personal data from minors.

Any individual providing information to AIDOCS STUDIO in connection with an order or service represents that they are of legal age. If we become aware that we have collected personal data from a minor without an appropriate legal basis or authorization, we will take the measures required by applicable law, which may include deletion, subject to any applicable retention obligation.

Where personal data relating to minors is processed as part of content submitted or made accessible by a Client, the Client is responsible for ensuring the lawfulness of the processing and satisfying any consent, information or other requirements that apply. AIDOCS STUDIO processes that data on the Client’s documented instructions and assists the Client in accordance with the DPA.

Please contact us if you believe that personal data relating to a minor has been provided to us without proper authorization.

CONTACT

For any questions regarding this Privacy Notice, to exercise your rights, or to raise a complaint, please contact us at: dataprivacy@aidocs.studio.

CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time to reflect changes in legal requirements, our services or our data-processing practices. The version in force at the time of the relevant processing applies.

Where appropriate, we will inform you of material changes by posting a notice on this page.

Effective date: September 1, 2026