Privacy Policy
Last updated September 15, 2026
Solid Docs holds the paperwork of your business — invoices, contracts, company documents. This page says what we store, why, who else sees it, and what you can ask us to do about it. No lawyer's fog: if something isn't here, we don't do it.
Who is responsible
Solid Docs operates this service and decides how your account data is handled. For anything in this page, write to our contact form.
For the documents you upload about your own customers, employees or suppliers, you decide what goes in and why — we only process it on your instructions, as your processor. Under the GDPR you are the controller of that content and we are the processor.
What we collect
- Your account. Email address, name, role, the company you belong to, and a hashed password. We never store the password itself.
- What you put in. Invoices, receipts, contracts, company documents, properties, payments, expense claims and the files attached to them. These may contain personal data about other people — that is your choice and your responsibility.
- Activity needed to run the service. Sign-in timestamps and IP address, approval and submission history, notifications, and error logs.
- Mailbox access, only if you turn it on. If you connect a mailbox so invoices arrive by email, we store the connection details — the password encrypted — and read only the messages needed to create expense records. You can disconnect it at any time.
We do not buy data about you, we do not build advertising profiles, and we do not sell anything to anyone.
Why we are allowed to hold it
- To provide the service you asked for — that is the contract between us.
- To keep the service secure and working: rate limits, logs, backups.
- To meet legal obligations, including the record-keeping rules that apply to accounting documents.
Where it lives
The application and its database run in Frankfurt, Germany. Uploaded files are stored inside that same database, not on a separate file service. Backups stay in the same region.
Who else touches it
We use a small number of specialist companies to run the service. Each one only gets what its job needs, none of them may use it for anything else, and all are bound by a data processing agreement:
- Cloud infrastructure — hosting, the database and the network layer in front of it.
- Email delivery — sending the account and notification emails, and receiving what you write back to us.
- Address lookup and maps — turning an address you type into a point on a map, and drawing the map (the map images service sees your IP address and the area shown).
- Public registries and tax-number lookups — only at the moment you ask us to fetch a company record or fill in details from a tax number.
- Bank details check — confirming that an IBAN you type is valid.
- Analytics and bot protection on our public pages — knowing whether anyone reads them, and keeping robots from creating accounts. These do not run inside the application.
Want the names? Ask through the contact form and we send you the current list of subprocessors, so you can do your own diligence. We tell customers before we change one.
Your account and your documents are held in the EU. The tools on our public pages — analytics and bot protection — are run by companies that may process data outside the EU under the European Commission's standard contractual clauses; nothing you put into the application goes through them.
Text recognition on uploaded documents runs on our own servers. Your documents are not sent to any outside service to be read, and are not used to train anything. We do not sell data to anyone, ever.
Cookies
Inside the application we use one cookie: the one that keeps you signed in. It is not optional — without it there is no session — and it is not used to track you anywhere else. Our public pages additionally load an analytics tool, which sets its own.
How long we keep it
- Your content stays while your account is open, and is deleted on request.
- If you close your account, we delete your content within 30 days, except where a law requires us to keep an accounting record longer.
- Technical logs are kept for a short window and then discarded.
What you can ask for
A copy of your data, a correction, deletion, or that we stop processing it. Write to us through the contact form and we answer within 30 days. If you think we've handled your data badly, you can complain to your national data protection authority.
Security
Traffic is encrypted in transit. Passwords are hashed and mailbox credentials are encrypted at rest. Access inside a company is controlled by role and by explicit per-person permission — people see the modules they were given, not everything. If a breach ever affects your data, we tell you.
Children
The service is for businesses. It is not intended for anyone under 18.
Changes
If this page changes in a way that matters, we say so by email before it takes effect. The date at the top always tells you which version you're reading.