Privacy Policy

Last Updated: May 3, 2026

1. Introduction

AI Buddies LLC, doing business as DocStreamAI ("DocStreamAI," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you:

• Visit our website at https://www.docstreamai.com or our application at https://app.docstreamai.com (the "Site");
• Use DocStreamAI, our document processing and accounting automation software-as-a-service platform (the "Service"); or
• Interact with us through email, social media, customer support, or other communications.

Please read this Privacy Policy carefully. By accessing or using the Site or Service, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with our policies and practices, please do not use the Site or Service.

This Privacy Policy applies to information we collect:

• On or through the Site;
• Through the Service;
• In email, text, and other electronic communications between you and AI Buddies; and
• When you interact with our advertisements, integrations, or applications on third-party websites or services.

This Privacy Policy does not apply to information collected by third parties, including through any application, integration, or content (such as third-party accounting platforms or email providers) that may link to or be accessible from the Site or Service. We encourage you to review the privacy policies of any third-party services you use in connection with DocStreamAI.

2. Information We Collect

We collect several types of information from and about users of our Site and Service, including:

2.1 Personal Information You Provide

When you register for, access, or use our Service, we may collect the following information that you voluntarily provide to us:

Account Information:

• Full name
• Email address
• Company name
• Phone number
• Billing address
• Payment information (processed by a third-party payment processor)
• Country of Residence

Profile Information:

• Username and password
• Profile photo (optional)
• Professional information
• Preferences and account settings

Communications:

• Support requests and correspondence
• Survey responses
• Feedback and testimonials

Service-Specific Information:

• Documents you upload to the Service, including invoices, receipts, and related files
• Email data and attachments that you authorize the Service to access through connected email accounts
• Metadata derived from documents or emails (such as vendor name, transaction amounts, dates, document type, and processing status)
• Team member or collaborator information, where applicable
• Authentication and integration credentials required to connect and maintain authorized integrations with third-party services (such as account identifiers, API keys, access tokens, refresh tokens, and similar authentication data). We store and handle this information securely and use it solely to provide the Service on your behalf.

2.2 Information Collected Automatically

When you access or use our Site or Service, we automatically collect certain information about your device and usage, including:

Device and Usage Information:

• IP address
• Browser type and version
• Operating system
• Device identifiers
• Time and date of visits
• Referring and exit pages

Location Information:

• General geographic location (such as country, state, or city) inferred from your IP address
• We do not collect precise geolocation data unless you explicitly grant permission.

Cookies and Similar Technologies:

We use cookies, web beacons, pixels, and similar tracking technologies to collect information about your interactions with the Site and Service. For more information, please see Section 8 (Cookies and Tracking Technologies).

2.3 Information from Third Parties

We may receive information about you from third parties, including:

Service Providers:

• Payment processors for billing and subscription management
• Analytics providers to help us understand how users interact with the Site and Service
• Email, cloud infrastructure, and security providers that support Service functionality

Integrated Services:

If you choose to connect third-party services to DocStreamAI (such as email providers or accounting platforms), we may receive information from those services in accordance with your authorization and the applicable third-party privacy policies. This information may include account identifiers, document attachments, transaction references, or other data necessary to provide the Service.

Business Partners:

• Referral or lead information from marketing or integration partners

2.4 Sensitive Personal Information

We do not intentionally collect sensitive personal information, such as Social Security numbers, government-issued identification numbers, biometric data, health information, or information related to race, religion, or sexual orientation.

If sensitive personal information is included within documents, emails, or files that you choose to upload or connect to the Service, such information is processed solely at your direction and for the purpose of providing the Service. We do not use or disclose such information for any other purpose.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 To Provide and Maintain the Service

• Create, authenticate, and manage your account
• Process documents, emails, and transactions in accordance with your instructions
• Provide customer support and respond to inquiries
• Perform technical operations such as hosting, security, monitoring, and backups
• Troubleshoot, diagnose, and fix technical issues

3.2 To Improve and Develop the Service

• Analyze usage patterns and trends to understand how the Service is used
• Test, evaluate, and develop new features and functionality
• Conduct internal research and development
• Improve user experience, performance, and interface design

3.3 To Communicate With You

• Send service-related announcements, confirmations, and operational updates
• Respond to your comments, questions, and support requests
• Send marketing or promotional communications, where permitted by law and in accordance with your preferences
• Notify you about changes to our policies, terms, or the Service
• Conduct surveys and collect feedback

3.4 For Security and Fraud Prevention

• Detect, investigate, and prevent fraudulent, unauthorized, or illegal activity
• Protect against security threats, abuse, and misuse of the Service
• Monitor, log, and analyze security-related events
• Enforce our Terms of Service and other agreements

3.5 For Legal Compliance

• Comply with applicable laws, regulations, and legal obligations
• Respond to lawful requests from public or government authorities (such as subpoenas or court orders)
• Protect our rights, privacy, safety, or property, and those of our users or others
• Resolve disputes and enforce agreements

3.6 With Your Consent

• For any other purpose disclosed to you at the time we collect your information
• With your explicit consent for specific uses not otherwise described in this Privacy Policy

3.7 Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, our legal basis for collecting and using your personal information depends on the specific context in which it is processed, including:

• Contractual Necessity: Processing is necessary to perform our contract with you, including providing and operating the Service
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as improving the Service, ensuring security, preventing fraud, and communicating with existing customers
• Legal Obligation: Processing is necessary to comply with applicable laws and regulations
• Consent: You have provided explicit consent for specific processing activities

You may withdraw your consent at any time. For more information, see Section 6 (Your Privacy Rights).

4. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes without your explicit consent. We share your information only in the limited circumstances described below.

4.1 Service Providers

We use trusted third-party service providers to process and store information on our behalf, including:

These providers act as data processors and do not use your information for their own purposes.

These service providers are contractually obligated to:

• Use your information solely to perform services on our behalf and in accordance with our instructions
• Implement appropriate technical and organizational security measures
• Comply with applicable data protection and privacy laws

4.2 Within Your Organization

If you are a member of an Organization within the Service, certain information about you and your activity may be visible to other members of that Organization, including but not limited to Organization Owners, Organization Admins, Accountants, and Members. This information may include:

• Your name and email address as associated with your user account
• Documents you uploaded, extractions you initiated, and processing history within the Organization's Workspace
• Activity logs and metadata related to your use of the Service within the Organization

Organization Owners and Organization Admins may have the ability to manage your access, view your activity within the Organization, and remove you from the Organization. If you are removed from an Organization or voluntarily leave, your personal identifiers (such as your name or email) may remain associated with Organization Data that you contributed during your membership, and that information will continue to be accessible to the Organization. For more information about how Organization Data is managed, see our Terms of Service, Section 6 (Organizations and Workspaces).

If you assign the Accountant role to a user from an external accounting firm, that user may concurrently hold the Accountant role in other Organizations they manage. Information visible to that user within your Organization may therefore be accessible to the same individual across each Organization where they hold the Accountant role.

4.3 Integrated Third-Party Platforms

If you choose to connect third-party platforms to the Service, we may share information with those platforms as necessary to perform the requested integration. These platforms include, but are not limited to, email providers and accounting platforms such as Google, QuickBooks, and Xero.

Information shared with integrated third-party platforms is governed by your authorization and the privacy policies and terms of those third parties. We do not control how third-party platforms process your information once it is shared with them.

4.4 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, dissolution, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Site before your information becomes subject to a different privacy policy.

4.5 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Court orders, subpoenas, or other legal process
• Requests from law enforcement or regulatory authorities
• Legal claims, audits, or disputes

We may disclose information when reasonably necessary to:

• Detect, investigate, or prevent fraud, security incidents, or misuse of the Service
• Protect the security, integrity, and reliability of our systems and infrastructure
• Enforce our Terms of Service or investigate violations of our policies

Any such disclosures are limited to the information reasonably necessary to address the issue and are made in accordance with applicable laws and contractual obligations.

4.6 With Your Consent

We may share your information with third parties when you have provided explicit consent for a specific purpose.

4.7 Aggregated and De-identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify any individual, user, organization, or specific financial document.

Such information may include anonymized statistics about general Service usage, system performance, feature adoption, processing volumes, and accuracy metrics. This information may be used for analytical, research, operational, or reporting purposes.

We may derive aggregated or de-identified insights from financial documents processed through the Service (such as invoices, receipts, credit memos, attachments, or extracted financial data), provided that such information:

• does not include raw document content,
• does not contain personally identifiable information, and
• cannot reasonably be linked back to any individual, organization, or specific document.

We do not sell or share identifiable financial documents or extracted data with third parties.

4.8 Data Sales

We do not sell your personal information to third parties, as defined under applicable privacy laws, including the California Consumer Privacy Act (CCPA) and similar state privacy laws.

5. Data Retention

We retain personal information for as long as necessary to provide and operate the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

Unless otherwise specified, information associated with your account is retained for the duration of the active account. After an account is deleted, certain information may be retained for limited periods where necessary for operational, legal, or security purposes.

Retention Categories:

• Account Information: Retained for the duration of the active account and up to 30 days after account deletion to allow account recovery, billing reconciliation, fraud prevention, and compliance with applicable legal obligations.
• Authentication and Integration Credentials: Retained only while integrations are active and removed when the integration is disconnected or the account is deleted.
• Organization Workspace Data — General: Uploaded documents and extracted financial data are associated with an Organization Workspace within the Service. Each user account is automatically assigned to an Organization. Documents uploaded to the Service and data generated through the Service within an Organization Workspace are considered Organization Data, not personal user data. Organization Data is controlled by the Organization, not by individual users.
• Organization Workspace Data — User Departure or Removal: If a user leaves an Organization, removes their account, or is removed by an Organization Owner or Organization Admin, documents and extracted data associated with the Organization will not be deleted and will remain accessible to the Organization. The removed user's personal identifiers (such as name or email address) may remain associated with Organization Data that the user contributed during their membership. Removed users have no right to request deletion of Organization Data through the exercise of individual privacy rights. For more information about Organization Data ownership and user removal, see our Terms of Service, Section 6 (Organizations and Workspaces).
• Organization Workspace Data — Subscription Inactivity: If an Organization's subscription becomes inactive — whether due to cancellation, non-payment, expiration, or downgrade to a plan that does not include continued data storage — Organization Data will be retained for six (6) months after the subscription becomes inactive. After this six (6) month retention period, Organization Data may be permanently deleted without further notice.
• Organization Workspace Data — Organization Deletion: Organization Data may be retained for up to thirty (30) days after the Organization account is permanently deleted, after which it may be permanently deleted.
• Disclaimer: DocStreamAI is not intended to serve as the authoritative accounting record for users' financial documents. Users are responsible for maintaining their own records and backups.
• Billing and Transaction Records: Retained as required for tax, accounting, and legal compliance, generally up to seven (7) years where applicable.
• Service Processing Metadata and Logs: Retained for operational, security, auditing, and service reliability purposes. Certain system logs and operational records may be retained for up to one (1) year to support historical analysis, debugging, financial reporting, and abuse prevention. These logs may include operational metadata and identifiers, including but not limited to user IDs, organization IDs, trace IDs, timestamps, and internal system or database reference identifiers, to enable troubleshooting and support for specific accounts. However, logs do not include raw document content or full financial document data. Aggregated metrics and reporting derived from logs may be de-identified or anonymized where appropriate.
• Support Communications: Retained as reasonably necessary to resolve support requests, disputes, or operational issues.
• Operational and Infrastructure Cost Records: Records related to system operations, infrastructure usage, and AI processing costs associated with the Service may be retained indefinitely for internal financial reporting, auditing, security, and operational analytics.

6. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information.

6.1 Rights for EEA, UK, and Swiss Residents (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Right to Access — Request a copy of the personal information we hold about you; receive information about how and why we process your data
• Right to Rectification — Request correction of inaccurate or incomplete personal information
• Right to Erasure ("Right to Be Forgotten") — Request deletion of your personal information in certain circumstances
• Right to Restrict Processing — Request that we limit how we use your personal information
• Right to Data Portability — Request a copy of your personal information in a structured, commonly used, and machine-readable format; request that we transmit your information to another service provider, where technically feasible
• Right to Object — Object to processing based on our legitimate interests; object to direct marketing, including profiling related to such marketing
• Right to Withdraw Consent — Withdraw consent for processing activities at any time (this does not affect the lawfulness of processing before withdrawal)
• Right to Lodge a Complaint — File a complaint with your local data protection authority

To exercise any of these rights, contact us at support@docstreamai.com

6.2 Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to Know — Request disclosure of the categories and specific pieces of personal information we have collected about you; request information about the sources of personal information, business purposes for collection, and categories of third parties with whom we share information
• Right to Delete — Request deletion of your personal information, subject to certain legal exceptions
• Right to Opt-Out of Sales or Sharing — Opt out of the sale or sharing of your personal information (if applicable)
• Right to Non-Discrimination — We will not discriminate against you for exercising your privacy rights

CCPA Request Process:

• Submit a request by emailing support@docstreamai.com
• We may verify your identity before processing your request
• We will respond within 45 days (this period may be extended by an additional 45 days where permitted by law)

Authorized Agent:

You may designate an authorized agent to submit a request on your behalf. The agent must provide written authorization signed by you and verification of both your identity and the agent's identity.

6.3 Rights for Texas Residents (TDPSA)

If you are a Texas resident, you have the following rights under the Texas Data Privacy and Security Act (TDPSA):

• Right to Know — Confirm whether we are processing your personal data; access your personal data
• Right to Correct — Request correction of inaccuracies in your personal data
• Right to Delete — Request deletion of personal data you provided to us
• Right to Data Portability — Obtain a copy of your personal data in a portable and readily usable format
• Right to Opt-Out — Opt out of targeted advertising, sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects

Universal Opt-Out Mechanisms: Where required by law, we honor browser-based opt-out signals, such as Global Privacy Control (GPC).

TDPSA Request Process:

• Submit a request by emailing support@docstreamai.com
• We will respond within 45 days (which may be extended by up to 15 days if necessary)

Appeals:

If we deny your request, you may appeal by contacting support@docstreamai.com within 30 days of our decision. We will respond to appeals within 60 days. If your appeal is denied, you may contact the Texas Attorney General.

6.4 Rights for Residents of Other U.S. States

Residents of other U.S. states, including Virginia, Colorado, Connecticut, and Utah, may have similar rights under applicable state privacy laws. To exercise your rights, please contact us at support@docstreamai.com.

6.5 Limitations on Deletion Rights for Organization Data

Privacy rights described in this Section 6 — including rights to access, deletion, and data portability — apply to your personal Account data (such as your profile information, account credentials, and personal account settings). These rights do not extend to Organization Data controlled by the Organization within the Service.

Organization Data — including documents, extracted data, processing results, and activity logs generated within an Organization's Workspace — is considered business data under the control of the Organization, not personal data of the individual user who contributed it. Accordingly:

• Requests to delete personal data will not result in the deletion of Organization Data that you contributed during your membership in an Organization
• Your personal identifiers (such as name or email address) may remain associated with Organization Data even after your account is deleted or you are removed from the Organization, to the extent necessary to maintain the integrity and auditability of Organization records
• If you believe that Organization Data contains your personal data that should be corrected or removed, you should contact the Organization Owner or Organization Admin directly, as the Organization is the controller of that data for purposes of applicable data protection laws (including GDPR)

For users subject to GDPR: where an Organization processes personal data of its members through the Service, the Organization acts as the data controller and DocStreamAI acts as a data processor. Requests related to personal data contained within Organization Data should be directed to the Organization. DocStreamAI will cooperate with Organizations in responding to data subject requests to the extent required by applicable law.

Where an Organization grants the Accountant role to a user from an external accounting firm, that user acts under the Organization's direction and on its behalf. The Organization remains the data controller and may revoke the Accountant role at any time.

7. International Data Transfers

AI Buddies LLC, doing business as DocStreamAI, is based in the United States. If you access our Site or Service from outside the United States, your personal information may be transferred to, stored, and processed in the United States and other countries where we or our service providers operate.

These countries may have data protection laws that are different from those in your jurisdiction.

7.1 For EEA, UK, and Swiss Residents

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we transfer your personal information to countries outside the EEA/UK/Switzerland only when appropriate safeguards are in place, including:

• Adequate Protections — The destination country has been determined by the European Commission or the UK government to provide an adequate level of data protection; or we have implemented Standard Contractual Clauses (SCCs) approved by the European Commission or applicable UK authorities; or we rely on other lawful transfer mechanisms recognized under applicable data protection laws.
• Your Rights — You may request a copy of the safeguards we use for international data transfers by contacting us at support@docstreamai.com.

8. Cookies and Tracking Technologies

We may use cookies, web beacons, pixels, and similar tracking technologies to collect information about your interactions with our Site and Service. These technologies help us operate the Service, improve functionality, and enhance user experience.

8.1 What Are Cookies?

Cookies are small text files that are placed on your device when you visit a website. Cookies allow the website to recognize your device and store certain information about your visit, such as your preferences or login status.

8.2 Types of Cookies We May Use

Not all cookie types may be used at all times. The specific cookies in use may change as the Service evolves.

8.3 Third-Party Cookies

We may allow third-party service providers to place cookies or similar technologies on your device to support analytics, functionality, or marketing activities.

Any third-party cookies are governed by the privacy policies of the respective third parties. We encourage you to review those policies for more information about how they handle your data.

8.4 Your Cookie Choices

Browser Settings: Most web browsers allow you to manage cookies through their settings, including the ability to block all cookies, block third-party cookies, and delete cookies after each session. Please note that disabling or restricting cookies may affect the functionality of the Site or Service.

Opt-Out Tools: Where applicable, third-party providers may offer opt-out mechanisms for analytics or interest-based advertising. These tools are subject to the availability and policies of those providers.

Do Not Track (DNT): Some browsers offer a "Do Not Track" (DNT) signal. At this time, we do not respond to DNT signals.

Global Privacy Control (GPC): Where required by applicable law, we honor Global Privacy Control (GPC) signals as a request to opt out of the sale of personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects.

9. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, alteration, and disclosure. Our security practices are intended to be appropriate to the nature of the data we process and the size and complexity of our operations.

9.1 Security Measures

Technical Safeguards:

• Encryption of data in transit using industry-standard transport layer security (TLS)
• Secure authentication mechanisms, including password hashing and token-based access controls, implemented through our authentication providers and infrastructure
• Use of managed cloud infrastructure and security services
• Secure storage of certain sensitive credentials and secrets using managed secret-storage services
• Reliance on trusted third-party providers for OAuth authentication and token management for connected accounts

Administrative Safeguards:

• Access controls based on the principle of least privilege
• Restricted access to systems containing personal information
• Policies and procedures governing data access and handling
• Incident response procedures designed to address suspected security events

Physical Safeguards:

• Use of secure, professionally managed data centers operated by our cloud service providers
• Physical access controls and environmental protections implemented by those providers

9.2 Limitations of Security

No method of transmission over the Internet or method of electronic storage is completely secure. While we strive to protect your personal information using reasonable safeguards, we cannot guarantee absolute security.

You are responsible for:

• Maintaining the confidentiality of your account credentials
• Promptly notifying us of any suspected unauthorized access to your account
• Using strong, unique passwords and securing your access devices

9.3 Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

• Notify affected users and relevant authorities within the timeframes required by applicable law
• Describe, to the extent permitted by law, the nature of the breach and the categories of information affected
• Provide information about steps you may take to protect yourself

10. Children's Privacy

Our Site and Service are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children under 18.

If you are under 18, you may not:

• Register for an account
• Provide personal information through the Site or Service
• Use features that require the submission or processing of personal information

If we become aware that we have collected personal information from a child under 18 without appropriate consent, we will take reasonable steps to delete such information as soon as practicable.

If you believe that we may have collected personal information from a child under 18, please contact us immediately at support@docstreamai.com

11. Third-Party Links and Services

Our Site and Service may contain links to third-party websites, applications, or services that are not operated or controlled by us. This Privacy Policy does not apply to third-party sites or services.

We are not responsible for:

• The privacy practices of third-party websites or services
• The content or security of third-party websites or services
• How third parties collect, use, or share your information

Before providing personal information to any third party, we encourage you to review their applicable privacy policies. Please be aware that when you leave our Site or Service, you are subject to the terms and privacy practices of the third party you are interacting with.

Third-Party Services We Integrate:

Our Service may integrate with third-party platforms at your direction, including, for example:

• Gmail (email-related services)
• QuickBooks (for accounting and financial integrations)
• Xero (for accounting and financial integrations)
• Composio (for secure OAuth connections and integration management)

When you connect third-party services to your account, those services may access certain information as authorized by you. The use of your information by third-party services is governed by their own privacy policies and terms, and not by this Privacy Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational or business needs.

How We Notify You:

• Material Changes: If we make material changes to this Privacy Policy, we will provide notice by email to the address associated with your account and/or by posting a prominent notice on our Site prior to the changes becoming effective.
• Non-Material Changes: For non-material updates, we will revise the "Last Updated" date at the top of this Privacy Policy.

Your Continued Use:

Your continued use of the Site or Service after the effective date of an updated Privacy Policy constitutes your acceptance of the revised Privacy Policy. If you do not agree to the updated Privacy Policy, you must discontinue use of the Service and close your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect and use your information.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

AI Buddies, LLC 6417 Highland Drive Park City, Utah United States

Email: support@docstreamai.com

If you are submitting a privacy-related request, please include sufficient information for us to verify your identity and understand your request.

Response Time: We will respond to privacy-related inquiries within a reasonable timeframe, and no later than required by applicable law.

14. California "Shine the Light" Law

California Civil Code Section 1798.83 (the "Shine the Light" law) permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes.

We do not share personal information with third parties for their own direct marketing purposes without your consent.

California residents who have questions about this policy may contact us at support@docstreamai.com

15. Nevada Residents

Nevada law allows Nevada residents to opt out of the sale of certain types of personal information.

We do not sell personal information as defined under Nevada law.

If you are a Nevada resident and have questions regarding this notice or our privacy practices, please contact us at support@docstreamai.com