Legal
Privacy Policy
Last updated 13 November 2026 · This app is in Beta Testing
Actionable Docs is in beta testing. This policy explains what personal data the service keeps, why, where it is held and what you can do about it. It applies to the website, the web app and the desktop, Linux, Android and iOS apps.
Who is responsible
Actionable Docs ("we") runs the service and is the controller of the account data described here. For documents and files an organization keeps in Actionable Docs, that organization decides what goes in and we process it on its behalf. Write to privacy@actionabledocs.com with any question or request.
What we keep
- Your account: email address, name, the account type you chose, time zone and avatar colour.
- How you sign in: passkeys (only the public key — your device keeps the private key), and short-lived sign-in codes and links stored only as one-way hashes.
- Signed-in devices: for each session, the device name and platform your browser or app reports, the IP address it signed in from, and when it was last seen. This lets you see and sign out your devices on the Security page.
- What you and your team create: documents, notes, presentations, comments, versions, files and scans, and the activity and audit log of your organizations.
- Integrations an administrator sets up, such as the link to Actionable Sheets, with their credentials encrypted.
Why we keep it
- To provide the service you signed up for: your account, your documents and syncing them across your devices (contract).
- To keep accounts secure: sign-in codes, rate limits, lockouts, the audit log and emails telling you about a sign-in from a new device (legitimate interest in security).
- To meet legal obligations where they apply.
We do not sell personal data, show advertising or use third-party analytics or tracking.
Where it is held
Everything is stored on our own servers in Helsinki, Finland (European Union), hosted by Hetzner. Uploaded files are stored on those servers or in Burmeel, our own object storage, unless your organization connects its own storage.
Who else processes it
- Our email provider, to deliver sign-in codes, sign-in links, invitations and security notices.
- If your organization turns on DocTAG's AI writing help, the text you ask DocTAG about is sent to the AI provider your organization's administrator configured. Without that, DocTAG runs on our own servers and nothing leaves them.
- If an administrator links Actionable Sheets, the two products exchange the documents and tables the people using them are allowed to see.
How long we keep it
- Sign-in codes: 10 minutes. Sign-in links: 15 minutes. Sessions: 14 days from sign-in, or until you sign out.
- Documents in the trash stay there until someone with permission empties it.
- Your account and everything that is yours alone: until you delete your account. Removed data may remain in our encrypted backups until those expire.
Your rights
You may ask for a copy of your data, have it corrected, restrict or object to its use, or have it erased. You can export any document from the editor, correct your profile on the Account page and delete your account yourself on the Security page (in the apps: Settings → Security → Delete my account). Deleting your account removes your profile, passkeys, sessions, API tokens, your personal space and any organization only you belong to; documents you wrote in organizations other people use stay there without your name. For anything else, write to privacy@actionabledocs.com. You may also complain to your data protection authority.
Cookies
We use only cookies that are essential for the service to work. See the Cookie Policy.
Changes
We will update this page when the service changes and say so in the app when a change matters.
Contact: privacy@actionabledocs.com