Does DoCoreAI store my prompts or AI outputs?

No. DoCoreAI never receives, stores, or transmits prompt text or model outputs. Only metadata is collected — token counts, latency, cost, and model identifiers. Your prompts stay in your environment or with your LLM provider.

Where is DoCoreAI data stored?

Aggregated metadata synced to the DoCoreAI cloud dashboard is stored in Manchester, England (UK) via Hostinger, under UK GDPR. Local telemetry in your SQLite database never leaves your own infrastructure.

Is DoCoreAI GDPR compliant?

Yes. DoCoreAI's zero prompt storage architecture means no personal data from prompts is processed at the LLM layer. Cloud infrastructure is hosted in the UK under UK GDPR. DoCoreAI acts as a data processor — customers remain data controllers. A Data Processing Agreement (DPA) is available on request at saji.john@docoreai.com.

Does DoCoreAI sell personal data?

No. DoCoreAI does not sell personal data and does not share it for cross-context behavioural advertising. Data is shared only with subprocessors who process it on our behalf under contract — currently Hostinger for cloud infrastructure.

How long does DoCoreAI retain telemetry data?

Product telemetry is retained for the period your organisation configures in Account Settings. The default retention period is 12 months if unconfigured. Free evaluation account metadata is retained for 3 months after the 60-day evaluation expires, then permanently deleted.

How do I request deletion of my data?

Email saji.john@docoreai.com with your deletion request. We support access, correction, deletion, restriction, and portability rights under GDPR, UK GDPR, and CCPA/CPRA.

Is a Data Processing Agreement (DPA) available?

Yes. A DPA is available on request for all paid plans. Contact saji.john@docoreai.com to receive the DPA template.

Does DoCoreAI use customer data to train its AI models?

Each customer's prediction model trains locally on their own telemetry only. Cross-customer model training is not performed at this stage. Your usage data is never used to improve models for other customers.

Privacy Policy

Last Updated: July 2026

DoCoreAI is built with privacy by design. The SDK runs in your environment and measures cost and efficiency using telemetry only — token counts, timings, and success signals — so your team gets full cost visibility without ever sending prompt or output content to us.

The Short Version

Zero prompt storage. We never receive or store your prompts, completions, or model outputs — only metadata.
We don't sell your data. Ever — and we don't share it for cross-context behavioural advertising.
Telemetry retention defaults to 12 months, configurable per organisation in your Account Settings.
GDPR, UK GDPR & CCPA/CPRA rights supported — access, correction, deletion, and portability on request.
Encrypted in transit (TLS), with restricted access to production systems and read-only dashboards.
Data stored in Manchester, England (UK) — UK GDPR compliant infrastructure.

On This Page

Scope & Roles
Data We Collect
How We Use Data
Legal Bases (GDPR/UK GDPR)
Sharing & Subprocessors
Data Retention
Security
Data Residency & International Transfers
Your Privacy Rights & Choices
Cookies & Tracking
Children's Privacy
Changes to This Policy
Contact Us

01Scope & Roles

This Privacy Policy describes how DoCoreAI handles data depending on the context:

Controller — for website and marketing interactions, such as when you visit our site, book a call, submit a form, or email us.
Processor — for product telemetry collected on behalf of our customers. Customers (the "controllers" of that data) decide what telemetry is sent and how long it's retained. Our default configuration avoids personal data in telemetry entirely.

02Data We Collect

Website & Marketing (Controller)

Contact data — name, email, company, and role, when you submit a form, book a demo, or contact support
Usage & device data — IP address (may be truncated), user-agent, pages visited, campaign parameters (UTM), and cookies or similar identifiers
Communications — emails you send us and our replies

Product Telemetry (Processor)

Collected by the DoCoreAI SDK running in your environment — without prompt or output content:

Token counters — prompt tokens, completion tokens, total tokens
Performance signals — latency, retries, rate-limit hits, success/failure flags
Model & runtime metadata — model identifier, temperature/max_tokens settings, SDK version, and the LLM provider in use
Identifiers — hashed or pseudonymous IDs for request, session, or service (configurable). We recommend avoiding direct personal identifiers in these fields.

Your prompts and outputs stay in your environment or with your LLM provider — they are never transmitted to DoCoreAI.

For healthcare-specific compliance detail, see building HIPAA-compliant AI systems.

03How We Use Data

Website & Marketing

Operate the site, respond to your enquiries, and send collateral you request
Run demos, detect abuse or fraud, and improve our content
Send product updates or marketing — only with consent where required, and you can opt out anytime
Comply with legal obligations and enforce our Terms

Product Telemetry

Power your cost, efficiency, and ROI dashboards
Run quality, uptime, and security monitoring, and assist with troubleshooting
Improve the prediction engine using your own usage data — each customer's model trains locally on their own telemetry only. Cross-customer model training is not performed at this stage.

04Legal Bases (GDPR/UK GDPR)

Contract — to provide the product and support you've requested
Legitimate interests — security, abuse prevention, service improvement, and website analytics, balanced against your rights
Consent — for optional marketing and non-essential cookies or trackers
Legal obligation — where we need to keep records or make disclosures required by law

06Data Retention

Website & marketing data is kept for as long as needed for the purpose it was collected — for example, responding to your enquiry — then deleted or anonymised, unless a longer period is required by law.
Product telemetry is retained for the period your organisation configures in Account Settings. If unconfigured, the default retention period is 12 months. You can request a shorter or longer window at any time.
Free evaluation accounts — metadata is retained for 3 months after the 60-day evaluation period expires, then permanently deleted.

07Security

All communication in transit is encrypted using TLS
DoCoreAI stores only non-sensitive operational telemetry — numeric metrics, timestamps, and model identifiers
Access to production systems is restricted, and customer-facing dashboards are read-only
LLM provider API keys are never read, stored, or transmitted by DoCoreAI — they remain inside your SDK client object in your own runtime

See our Security page for full architecture detail, PII detection behaviour, and compliance status.

08Data Residency & International Transfers

Aggregated metadata synced to the DoCoreAI cloud dashboard is stored on infrastructure located in Manchester, England (United Kingdom), operated by Hostinger. The UK operates under UK GDPR — substantially equivalent to EU GDPR.

Local telemetry stored in the SQLite database created in your environment never leaves your own infrastructure.

DoCoreAI is founded and operated from Bengaluru, India. Where our founding team accesses cloud infrastructure for operational purposes — such as monitoring, support, or maintenance — we apply appropriate internal data handling safeguards to ensure data is accessed only when necessary and by authorised personnel only.

Teams with specific data residency requirements outside the United Kingdom — including EU-only or region-specific constraints — should contact us before deployment: [email protected].

09Your Privacy Rights & Choices

EEA / UK / Swiss Individuals (GDPR / UK GDPR)

You can request access, correction, deletion, restriction, or portability of your data, or object to its processing. Where we rely on consent, you can withdraw it at any time.

California Residents (CCPA/CPRA)

You have the right to know, correct, delete, and limit the use or disclosure of your personal information. We do not "sell" or "share" personal information as those terms are defined under the CPRA.

To exercise any of these rights, email [email protected]. We may need to verify your identity, and if you're not our direct customer, we may refer you to your organisation's administrator.

10Cookies & Tracking

We use necessary cookies to operate the site, and optional analytics/marketing cookies with consent where required:

Strictly necessary — security and session management
Analytics — page performance and aggregate usage (opt-in in the EU/UK)
Marketing — campaign attribution for our site (opt-in where required)

You can manage these preferences via your browser settings or our cookie banner, where shown.

11Children's Privacy

DoCoreAI is not directed to children under 16, and we do not knowingly collect personal data from them.

12Changes to This Policy

We may update this policy from time to time as the product evolves. We'll post the updated effective date here, and if changes are material, we'll provide additional notice via email or an in-dashboard alert.

13Contact Us

Privacy questions or rights requests: [email protected]

Security reports: [email protected]

DPA requests: [email protected]

Data residency enquiries: [email protected]