Privacy notice

Abroadocs is run by Dmitry, [Postal address — placeholder], [Country — placeholder] (“we”). For anything about your data, write to privacy@abroadocs.com.

We decide how Abroadocs works and are the controller of your account and organisation details, the security and incident records we keep, and the provider catalogue.

Abroadocs is for businesses. When your organisation uses it to arrange documents for other people — an employee’s certificate, a client’s diploma — the personal data in those requests belongs to your organisation, which is its controller, and we process it on your organisation’s behalf as its processor, under the data-processing terms in our Terms of Use. If you are one of those people, your first contact is the organisation that sent your document; we will help it answer you.

Please send only what the work needs. A document that is itself the work — a passport to be translated, a certificate to be apostilled — is expected. Bank details, health records or other data the work does not need should be left out. If you send someone else’s document, you need their authority or your organisation’s, as the Terms of Use say.

Cookies. Abroadocs uses only the cookies it needs to work: one keeps you signed in, and one remembers that you entered the pilot passphrase. There are no analytics or advertising cookies.

These services process personal data on our instructions, each under its own data processing agreement with us, and each may use it only to provide its service to us, as that agreement sets out.

We give business clients 30 days’ notice, by email and on this page, before adding or replacing one of these services.

Your account, requests and files are stored in the EU (Ireland), encrypted at rest, and uploaded files are scanned and read in the EU (the Netherlands). The AI step runs on OpenAI’s API, which is not limited to the EU: the text of your conversation and the text read from your files go to OpenAI in the United States.

That transfer is covered by the EU Standard Contractual Clauses in OpenAI’s data processing addendum. The other services’ companies are outside the EU too (Vercel and Railway in the United States, Supabase in Singapore), so any access they have from there is covered in the same way: by the Standard Contractual Clauses in each one’s agreement, and for Vercel and Railway also by their certification under the EU-US Data Privacy Framework.

• Supabase: Stored in Ireland. Supabase's contracting company is in Singapore; any access from outside the EU is covered by the EU Standard Contractual Clauses in its data processing agreement.
• Vercel: EU Standard Contractual Clauses in Vercel's data processing agreement; Vercel Inc. is also certified under the EU-US Data Privacy Framework.
• Railway: Files are scanned and read in Amsterdam; Railway runs its own operations from the United States, covered by the EU-US Data Privacy Framework (Railway Corporation is certified) and the EU Standard Contractual Clauses.
• OpenAI: EU Standard Contractual Clauses in OpenAI's data processing addendum.

Ask us for a copy of any of these agreements.

OpenAI’s models read your messages and the text of your files to extract the details of the job, write Abroadocs’s replies and suggest candidate providers. Every call asks OpenAI not to store it (store: false). This is not Zero Data Retention, which has not been arranged, so OpenAI may keep abuse-monitoring data for up to 30 days, as the AI notice you accepted says. OpenAI does not use API data to train its models by default, and we do not use request content to train any model.

Fixed rules in Abroadocs’s software, not the AI, make the decisions that matter: which providers pass the checks, and whether a search runs at all — for example, a request for something unlawful is refused, and a request involving a place Abroadocs does not serve is declined. If you think Abroadocs got it wrong, write to privacy@abroadocs.com and a person will look at it.

Abroadocs does not send your request or documents to any provider. If you choose to send the draft quote request from your own email app, that communication is between you and the provider you choose.

Every request is deleted 30 days after its last activity. A request gets a deletion date when you start it; each message you send, each time you confirm services, and each finished search moves that date to 30 days later. A request nobody touches for 30 days is deleted, whether or not it was ever searched. When you close a request it is deleted 30 days after you close it, and a closed request is not kept longer by anything later. Requests that are with a person, and requests Abroadocs declined, follow the same rule.

A daily job deletes the request with its conversation, extracted details, search results, your recorded provider choice and any uploaded files. We keep anonymous cost totals, which say nothing about you or the request. Closing a request does not delete it at once; to ask for earlier deletion, write to privacy@abroadocs.com.

What outlives a request. Your account and organisation. The provider catalogue, which holds only businesses’ own published details. And, only where Abroadocs refused a request, a minimal incident record: your organisation, the reason (a place Abroadocs does not currently serve, or a request for something unlawful), the place where there was one, and the date — never your messages or documents. It is kept while your organisation’s account exists, so we can see how often it happens.

Abroadocs arranges genuine documents and lawful services only. It refuses a request to make, alter or misuse a document, or to deceive an authority, and does not search for providers for it; the team may review it, and we may suspend or close an account used that way.

Abroadocs does not currently serve requests involving Russia, Belarus, China, Iran, Hong Kong, North Korea, Syria, Cuba, Macao, Crimea, Sevastopol, Donetsk, Luhansk. Such a request is declined without a search. Both kinds of refusal leave the incident record described above.

To find and check providers, Abroadocs reads public web pages: providers’ own websites, professional associations’ and chambers’ directories and other public directories, official registers, and official lists that authorities publish (for example, a French court of appeal’s list of sworn translators). An AI web search suggests candidates; Abroadocs’s own server then opens each page, records when it read it and a fingerprint of what it read, and checks it. It reads only what anyone can read without an account: it does not log in, submit search forms, or get round a block, a paywall or a CAPTCHA. Published list copies keep names and the list they came from, nothing more.

If you offer translation, apostille, notarial or similar services, Abroadocs may show your business to a client looking for that work. We collect only what you or an authority published: your business or professional name, website, the email address and phone number your pages publish, the services, languages, prices and turnaround they state, and — for sworn translators — whether your name appears on an official list, and which one. We collect it from those public pages and lists, as described above.

We use it to find and screen providers for clients, on the basis of our legitimate interest in helping clients find suitable providers (Art. 6(1)(f) GDPR). We keep it so later searches can reuse what was checked; entries older than 30 days are checked again before they are reused. Abroadocs never contacts you: a client who wants a quote writes to you from their own email.

You can object at any time, or ask us to correct or remove your details, by writing to privacy@abroadocs.com.

Everything travels over encrypted connections. Clients are kept apart by the database itself, not only by the application. Files are held in private storage with no public links, and every upload is virus-scanned in an isolated service before anything reads it. Only a small number of people on our team can open requests, and every change is recorded in a log that cannot be edited.

What we process about you: the business name, website, the email address you publish, the country and services your site states, and the replies you send us.

Why: to ask you for quotes on behalf of our clients — our legitimate interest in procuring these services, and yours in receiving enquiries at the address you publish for them.

Where it goes: our email service (Resend, EU region), our database (Supabase, Ireland), and the reply text to our AI provider (OpenAI) to read the price and turnaround you state — never your attachments’ files, which are virus-scanned and stored privately.

How long: your replies are deleted with the client’s request, 30 days after its last activity; the published business details stay in our catalogue until you ask us to remove them.

Your rights: access, correction, removal and objection — write to privacy@abroadocs.com; we answer within a month. No automated decision is taken about you. More on why you heard from us: Abroadocs for providers.

You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, or to receive it in a portable form, and you can object to processing based on our legitimate interests. Some things you can do yourself: correct a detail by telling Abroadocs in the conversation, or close a request. For anything else, write to privacy@abroadocs.com from the address you sign in with; we answer within one month.

You can also complain to a data protection authority — in the EU country where you live or work, or where we are established.

When this notice changes, we update the date at the top, and we tell business clients about any change that affects them before it takes effect.