Privacy Policy

DockRay Privacy Policy
Effective from the date of its publication on the Service.

1. Data Controller and Contact Information

1.1. The controller of personal data processed in connection with the DockRay website, dashboard and service (the "Service") is Dock sp. z o.o., with its registered office in Gdańsk, at Wały Piastowskie 1, Unit 1508, 80-855 Gdańsk, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001105135, NIP (Tax Identification Number) 9571173402, REGON 524088178 (the "Controller", "Dock", "we" or "us").

1.2. For privacy-related matters, you can contact us at contact@dockray.io, hello@dock.codes, or by post at our registered office address.

1.3. The Controller has appointed a Data Protection Officer, Miron Miotek. You can contact the Data Protection Officer at m.miotk@dock.codes or by post at the Controller's registered office address, marked "Data Protection Officer".

2. Scope and Roles in Data Processing

2.1. This Privacy Policy describes the processing of personal data relating to individuals who visit the DockRay website, create an Account, use the dashboard, place Orders, subscribe to the newsletter, use the Lighter AI assistant, contact us, or represent Clients and suppliers.

2.2. Dock acts as the data controller and independently determines the purposes and means of processing personal data relating to Accounts, dashboard Users, billing, communication, Service security, the newsletter, use of the AI assistant and its own marketing activities.

2.3. Telemetry data transmitted from a Client's monitored applications, including error reports, HTTP transaction information, IP addresses, user identifiers, URLs, headers and other information included through an Integration, is generally processed by us as a data processor acting on the Client's instructions. The Client remains the controller of such data. The terms of data processing are specified in the Service Terms and Conditions or a separate agreement with the Client.

2.4. The Client determines which data is transmitted from its systems to DockRay and is responsible for establishing the appropriate legal basis, fulfilling information obligations and correctly configuring Integrations. Individuals whose personal data has been transmitted to DockRay from a monitored application should first direct requests concerning that data to the controller of the relevant application. We assist the Client in handling such requests in accordance with the data processing agreement.

2.5. When a logged-in User interacts with the Lighter AI assistant, selected information about their Projects, errors and settings may be used to prepare a response. We limit this information to what is necessary to answer the question, taking into account the User's permissions.

3. What Data We Process

• Account and User data – Account name, first name, last name, email address, telephone number, preferred language, roles and permissions, email verification status and authentication settings.
• Authentication and security data – password hash, encrypted TOTP secret, information about trusted devices or IP addresses, login dates, history of significant operations, IP address, session identifiers and information about the browser and device.
• Social login data – account identifier from the selected provider, email address, first name, last name, username or avatar URL shared by Google, Facebook or GitHub when the User chooses such a login method.
• Business and billing data – company or business name, NIP or another tax identification number, address, country, billing email address, selected Plan, currency, Order history, payments and issued documents.
• Payment data – payment method, transaction status and transaction identifier. Full payment card details are provided directly to the payment service provider and are not stored by DockRay.
• Contact data – information provided through contact forms, chat, email messages or support requests, including correspondence content and information necessary to handle the matter.
• Service technical data – IP address, date and time of requests, requested URL, referring page, response code, browser and operating system type, cookie identifiers, diagnostic data and security-related events.
• Client telemetry data – information depending on the configuration of the monitored application, which may include error messages and stack traces, request and transaction data, identifiers, IP addresses, URLs, device information, environment details and software versions.
• Newsletter subscription data – email address, preferred language, selected technologies, subscription status, subscription confirmation, information about consent withdrawal and message delivery history.
• Lighter AI assistant conversation data – the content of the current question, context from up to four previous questions, information required to prepare a response and, for logged-in Users, relevant summaries of Projects, errors and settings. When voice functionality is used, audio recordings and their transcripts are also processed.

We do not request passwords, API keys, session tokens, full payment card details, special categories of personal data, or data relating to criminal convictions and offences in telemetry data or conversations with the AI assistant. Clients should use the filtering and anonymisation mechanisms provided by the Integrations.

4. Purposes, Legal Bases and Requirement to Provide Data

• Creating and maintaining Accounts, authentication, providing the Service, processing Orders and providing support – performance of a contract or taking steps prior to entering into a contract (Article 6(1)(b) GDPR). For individuals representing a Client, the legal basis is our legitimate interest in performing the contract with the Client and communicating with its personnel (Article 6(1)(f) GDPR).
• Billing, invoicing, accounting and tax obligations – compliance with a legal obligation (Article 6(1)(c) GDPR) and performance of a contract.
• Protecting Accounts, preventing abuse, handling incidents, maintaining logs and audit trails – the legitimate interests of the Controller and Clients in ensuring the security, accountability and continuity of the Service (Article 6(1)(f) GDPR).
• Responding to forms, chat messages and correspondence – taking steps prior to entering into a contract, performing a contract or pursuing our legitimate interest in handling enquiries and maintaining business relationships.
• Establishing, exercising and defending legal claims – the Controller's legitimate interest (Article 6(1)(f) GDPR).
• Website analytics, usability research and measuring the effectiveness of promotional activities – the User's consent where the relevant tool stores information on or accesses information from the User's device (Article 6(1)(a) GDPR and applicable electronic communications laws).
• Sending the security and monitoring newsletter – the subscriber's consent (Article 6(1)(a) GDPR).
• Retaining subscription confirmations and information about consent withdrawal – the Controller's legitimate interest in documenting consent, ensuring accountability and preventing messages from being sent to individuals who have unsubscribed (Article 6(1)(f) GDPR).
• Handling questions submitted to the Lighter AI assistant – performance of a contract for features available to logged-in Users as part of the Service (Article 6(1)(b) GDPR). For individuals who are not logged in, the legal basis is the Controller's legitimate interest in providing assistance regarding the Service and its features (Article 6(1)(f) GDPR).

Independently of the newsletter, we may send existing Clients information relating to the operation or security of the Service they have purchased, where such information does not constitute marketing.

Providing data marked as required is necessary to create an Account, process an Order or respond to an enquiry. Subscribing to the newsletter and using the AI assistant are voluntary. Failure to provide data required for a particular feature may prevent its use.

5. Sources of Data

We obtain data directly from the individuals concerned, from Clients or other Users managing a team, from monitored applications through Integrations, from social login providers selected by Users, from payment service providers and automatically from devices when individuals use the Service.

We may also obtain information about representatives of businesses from public registers and company websites.

For the newsletter, we collect data during registration and subscription confirmation. For the Lighter AI assistant, data comes from the conversation and, for logged-in Users, from information available within their Accounts and Projects.

6. Data Recipients and Service Providers

6.1. Personal data may be disclosed only to the extent necessary to:

• providers of hosting, cloud infrastructure, databases, backups and search services;
• providers of email services, including the newsletter delivery provider, communication services and support systems;
• the AI service provider used to operate the Lighter assistant, including processing questions, generating responses and transcribing voice messages;
• the payment service provider Stripe, banks and payment processors when the relevant payment method is selected;
• Google, Facebook or GitHub login providers when the User chooses the relevant login method;
• Google in connection with reCAPTCHA, Google Tag Manager or services activated through it, where enabled;
• Hotjar, if the behaviour analytics tool is enabled;
• tawk.to, if the User uses the chat service available at the relevant time;
• providers of accounting, legal, auditing, security and software maintenance services;
• public authorities or other entities where disclosure is required by law.

6.2. Dock employees and contractors are granted access only to the extent necessary for their duties and assigned permissions and are required to maintain confidentiality.

6.3. Newsletter and AI service providers receive the data necessary to deliver the relevant functionality and act on our behalf under appropriate data processing arrangements.

6.4. The current configuration of the Service determines which optional tools are active. Listing a provider in this Policy does not mean that its tool is activated during every visit.

7. Transfers of Data Outside the EEA

Some technology providers, including email and AI service providers, may process personal data outside the European Economic Area (EEA), particularly in the United States.

In such cases, we ensure that an appropriate legal mechanism for the transfer is in place as required by Chapter V of the GDPR. This may include a European Commission adequacy decision, including the EU-US Data Privacy Framework for participating organisations, or Standard Contractual Clauses together with a transfer assessment and supplementary safeguards where necessary.

Information about providers, possible transfers outside the EEA and the safeguards applied can be obtained by contacting the Controller or the Data Protection Officer.

8. Data Retention Periods

• Account and User data – for the duration of the contract and, after its termination, until the expiry of applicable limitation periods for claims or the resolution of a dispute.
• Accounting and tax data – for the period required by applicable law.
• Orders, payment confirmations and billing documents – for the period necessary to fulfil legal obligations and defend against claims.
• Correspondence and support requests – for the time necessary to handle the matter and subsequently until the expiry of related limitation periods. Enquiries that do not result in a contract are generally retained for no longer than three years.
• Security logs and audit trails – for a period justified by security, auditing and accountability requirements, and no longer than necessary for those purposes.
• Data processed on the basis of consent – until consent is withdrawn or the data is no longer needed, unless another legal basis justifies further retention.
• Unconfirmed newsletter subscriptions – for seven days from the start of the subscription process, after which they are deleted.
• Active newsletter subscription data – until the subscriber unsubscribes or the newsletter is discontinued.
• Minimal records of newsletter consent and unsubscription – for up to 12 months after the subscription ends, to prevent further messages and document consent withdrawal.
• Newsletter delivery history – for 12 months.
• Lighter AI assistant conversation content – for 30 minutes within the conversation session.
• Voice recordings submitted to the AI assistant – for a maximum of 30 days in private data storage. Deleting a question or starting a new conversation results in earlier deletion of the associated recording.
• Raw telemetry data – for the retention period determined by the Client's Plan and Project settings, after which it is automatically deleted.
• Aggregated technical statistics that do not contain personal data – may be retained indefinitely.

After the applicable retention period, personal data is deleted or anonymised. Backups are overwritten according to their rotation schedule. Until then, they remain isolated and are not used for other purposes.

9. Data Subject Rights

Subject to the conditions set out in the GDPR, individuals have the right to:

• access their personal data and obtain a copy;
• rectify inaccurate data or complete incomplete data;
• request the erasure of personal data;
• request the restriction of processing;
• receive and transfer data processed by automated means on the basis of consent or a contract;
• object to processing based on legitimate interests for reasons relating to their particular situation, and object at any time to processing for direct marketing purposes;
• withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

Requests may be submitted to the Controller or the Data Protection Officer. We may request information necessary to securely verify the identity of the person making the request.

If a request concerns data transmitted to DockRay by a Client acting as the controller of a monitored application, we will forward the request to the relevant Client or explain how to contact them.

Individuals also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, uodo.gov.pl.

10. Automated Decision-Making

We do not make decisions concerning Users or newsletter subscribers based solely on automated processing that would produce legal effects or similarly significantly affect them.

Security mechanisms may automatically assess the risk associated with a request, limit the number of attempts or require additional authentication.

Where enabled, reCAPTCHA assesses the likelihood that a form is being used by an automated system. A rejected form submission can be challenged by contacting us through another communication channel.

The Lighter AI assistant automatically generates responses to questions but does not make decisions that produce legal or similarly significant effects for Users.

11. Security

We apply technical and organisational measures appropriate to the risks involved, including TLS encryption for data transmission, role-based access control, two-factor authentication, secure password hashing, encryption of selected secrets, separation of Client data, logging of significant operations, backups, updates and infrastructure monitoring.

Access to data used by the AI assistant is restricted according to the User's permissions. Voice recordings are stored in private data storage.

However, no method of data transmission or storage can guarantee absolute security.

12. Cookies and Similar Technologies

12.1. Cookies are small pieces of information stored on a User's device. The Service may use:

• Essential cookies – required to maintain sessions, enable login, protect forms, remember security settings, language and interface preferences. Without them, certain parts of the Service may not function.
• Analytics and functional cookies – used to measure traffic, analyse usability, remember additional preferences or support chat functionality where the relevant tools are enabled.
• Marketing cookies – used to measure campaigns or personalise communications, only where such tools are activated.

12.2. Essential cookies are used to provide the requested service and ensure security. Other cookies and similar identifiers may be used after obtaining consent where required by law. Consent can be withdrawn as easily as it was given. Withdrawal does not affect the lawfulness of previous processing.

12.3. Cookies may be session cookies, deleted when the browser is closed, or persistent cookies, stored until the expiry date specified in their settings or until manually deleted. If cookies other than essential cookies are activated, a detailed list of active cookies, providers and retention periods will be made available through the consent management tool.

12.4. Users can delete or block cookies through their browser settings. Blocking essential cookies may prevent login, form submission or use of the dashboard.

13. Third-Party Services on the Website

13.1. Registration, contact and Order forms may be protected by Google reCAPTCHA. When enabled, Google receives technical data necessary to assess whether a form is being used by a human, including the IP address and information about the device and behaviour on the website. Google's privacy policies also apply.

13.2. The website may use Google Tag Manager and tools activated through it, as well as Hotjar to analyse how visitors use the website. These tools are optional, and their activation must respect the User's cookie preferences.

13.3. A tawk.to chat service may be available during support hours. The chat script is loaded only when the chat is available. Outside these hours, the chat button redirects to a contact form. Starting a chat results in the transfer of technical data and conversation content to the provider.

13.4. Choosing to log in through Google, Facebook or GitHub redirects the User to the selected provider. The provider receives information about the login attempt, and Dock receives the data indicated on the authorisation screen. Users may alternatively log in using their email address and password.

13.5. The newsletter is delivered through an email service provider acting on our behalf. The provider receives the data necessary to send messages and manage their delivery.

13.6. The Lighter AI assistant uses an external AI service acting on our behalf. The scope of information transferred and the operation of the assistant are described in Section 15.

14. Security and Monitoring Newsletter

14.1. DockRay offers a voluntary newsletter covering application security, software vulnerabilities, monitoring, updates and topics related to the maintenance of IT systems.

14.2. The controller of subscribers' personal data is Dock sp. z o.o., Wały Piastowskie 1, Unit 1508, 80-855 Gdańsk, Poland. For newsletter-related matters, contact contact@dockray.io.

14.3. In connection with the newsletter, we process the subscriber's email address, preferred language, selected technologies and information relating to registration and subscription confirmation. We use this data to deliver messages relevant to the subscriber's selected interests.

14.4. The legal basis for processing personal data to send the newsletter is the subscriber's consent (Article 6(1)(a) GDPR). Subscription is voluntary and is not a condition for using other DockRay features.

14.5. Newsletter subscription requires email address confirmation. Unconfirmed subscriptions are deleted after seven days. Active subscription data is retained until the subscriber unsubscribes.

14.6. After a subscription ends, we may retain a minimal record of the consent given and withdrawn for up to 12 months. This is intended to prevent further messages from being sent and to document consent withdrawal. The legal basis is our legitimate interest (Article 6(1)(f) GDPR).

14.7. We retain newsletter delivery history for 12 months.

14.8. Data necessary to deliver newsletter messages is transferred to an email service provider acting on our behalf. Information about providers and possible transfers of personal data outside the European Economic Area can be obtained by contacting the Controller.

14.9. Consent to receive the newsletter may be withdrawn at any time using the unsubscribe link included in every message. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

14.10. Subscribers have the right to access, rectify and erase their personal data, restrict its processing, request data portability where provided by law, and object to processing based on legitimate interests. They also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office.

14.11. We do not make decisions concerning subscribers based solely on automated processing that would produce legal effects or similarly significantly affect them.

15. Conversations with the Lighter AI Assistant

15.1. Lighter is an artificial intelligence assistant available within the DockRay Service. Its purpose is to answer questions about the operation of the Service, its documentation and information available within the User's Account.

15.2. To prepare responses, Lighter retrieves relevant sections of publicly available DockRay instructions and documentation. For logged-in Users, it may also use summaries of their Projects, reported errors and settings, within the scope of their permissions.

15.3. We transfer the content of the current question, context covering up to four previous questions, and the information and summaries necessary to prepare a response to the AI service provider acting on our behalf.

15.4. Conversation content is stored within the session for 30 minutes. After the retention period expires, session data is deleted in accordance with our retention rules.

15.5. Lighter also allows Users to ask questions using voice messages. In such cases, the recording is transferred to the same AI service provider to transcribe the speech into text. The resulting transcript is then used to prepare a response.

15.6. Voice recordings are stored in private data storage for a maximum of 30 days. Deleting a question or starting a new conversation results in earlier deletion of the associated recording.

15.7. Lighter serves solely as an informational and support tool. It does not perform operations that modify data, configurations or settings within the User's Account or Projects.

15.8. The assistant's responses are generated automatically and may contain inaccuracies or errors. We recommend independently verifying information that may affect application security, system configuration or important decisions.

15.9. Users should not provide the assistant with passwords, API keys, access tokens, payment card details, special categories of personal data or other confidential information that is not necessary to answer their questions.

15.10. Use of the assistant is voluntary. For matters concerning the processing of personal data by Lighter, Users can contact the Controller at contact@dockray.io.

16. Changes to This Privacy Policy

This Privacy Policy may be updated, particularly in response to changes in applicable law, Service features, providers or data processing practices.

The current version is published on the Service together with its effective date. We may additionally notify Account holders of significant changes by email or through a notification in the dashboard.