Legal

Privacy Policy

What we collect, why, how long we keep it, and how to get it out or delete it. Plain English, no dark patterns. Written for procurement review and aligned with our Data Processing Addendum.

Effective: October 24, 2026

1. Who we are

Dock is operated by Vector Apps, Inc. (“we”, “us”). Reach the privacy team at privacy@trydock.ai. For EU / UK GDPR matters, the same address works. We have not appointed an external DPO because our processing volume is below the GDPR threshold that would require one.

2. Scope

This policy covers the Dock service at trydock.ai and its subdomains, the Dock REST API, the MCP server at /api/mcp, the outbound webhook system, and the Dock desktop and command-line (CLI) clients. It does not cover third-party agents or applications that you connect to Dock; those are governed by their own policies and your authorization scope. It does cover how Dock handles data it receives from a connected account you authorize (for Google accounts, see section 18).

3. Personal data we collect

3.1 Account data

  • Email address. The one you signed up with. We use it to send magic-link sign-in codes, transactional email (security alerts, plan changes), and the changelog digest if you opt in.
  • Display name and avatar URL. Whatever you typed into your profile. Optional.
  • Organization name, workspace name, slugs. The structures you create inside Dock.

3.2 Content data

  • Rows, document bodies, comments, attachments, and column values you put into a workspace. This is user content; we treat it as yours and process it on your behalf as Processor under the DPA.
  • Agent API keys are stored as SHA-256 hashes immediately on creation; we never see plaintext after the moment you received it.
  • Webhook URLs you configure. Webhook secrets are stored in a form recoverable by the application because outbound HMAC signing requires plaintext access; encryption at rest is on the roadmap.

3.3 Technical telemetry

  • IP address, received at request time for rate limiting and abuse prevention. We do not persist raw IPs in your database row: where IPs are stored for abuse tracking (referrals, agent-join requests), we store a salted SHA-256 hash, not the raw address. Vercel edge logs receive full IPs and are retained per Vercel’s policy (thirty days).
  • Coarse user-agent string, the first two hundred characters, for audit log context and abuse triage.
  • Request identifiers and timestamps.
  • How you found Dock, recorded once when your account is created: the campaign tags on the page you first landed on in that browser tab (utm_source, utm_medium, utm_campaign, utm_content, utm_term), which ad network’s click identifier was present (its name only, never the identifier itself), the referring site’s host, and the landing page’s path. It is stored with your account and sent to PostHog with an “account created” event. It is not shared with any ad network. If you accepted cookies on our site, the anonymous PostHog id of that landing page view is included, so the visit and the account can be linked.

3.4 Authentication artefacts

  • Session tokens for the browser cookie. Hashing of these at rest is on the roadmap; today the plaintext sits in the database row.
  • OAuth access tokens and refresh tokens (for MCP connectors). Stored as SHA-256 hashes at rest. Plaintext is shown to the issuing client exactly once.
  • Magic-link verification tokens. Single-use, fifteen-minute TTL, deleted upon redemption.

4. Lawful basis (GDPR Article 6)

  • Contract (Art. 6(1)(b)): processing necessary to provide the Service to a user who signed up and accepted the Terms.
  • Legitimate interest (Art. 6(1)(f)): security, abuse prevention, fraud detection, log retention, product analytics on aggregate non-PII signals, and delivering product updates in-product to your Chief of Staff agent (opt-out available, see section 17).
  • Legal obligation (Art. 6(1)(c)): tax records, regulatory requests, lawful government subpoenas.
  • Consent (Art. 6(1)(a)): the changelog digest and any future marketing communication. Consent is opt-in and one-click revocable.

5. How we use personal data

  • Authenticate users and gate access to workspace data.
  • Store, retrieve, and synchronise the content you create.
  • Deliver event notifications to webhook endpoints you configure.
  • Maintain audit logs of workspace state changes.
  • Send transactional email (sign-in links, security alerts, plan changes, support replies).
  • Detect and prevent abuse (rate-limit enforcement, IP reputation, brute-force prevention).
  • Diagnose production faults and operate the Service.
  • Carry out the actions you ask your agents to perform with accounts you connect (for example, reading a message or creating a document in a connected Google account). Data from connected accounts is used only to provide or improve the feature you requested, as described in section 18.

6. What we deliberately do not do

Sometimes the more useful question is what a SaaS chooses not to do. Our list:

  • No advertising trackers, no session recording, no data sale. We run no ad pixels, no ad-network trackers, and no session/screen recording, and we do not sell or share your personal data. We do use one privacy-conscious product-analytics tool, PostHog, to measure feature usage; it is disclosed in section 7 (cookies) and on our subprocessor list. Signed-in users are keyed to it by a pseudonymous id and role, never email or workspace content.
  • No undisclosed AI processing. Dock’s agents run on third-party AI model providers. When an agent you have hired in Dock works for you, its prompts, tool outputs, and the workspace data it reads are sent to the provider serving that agent’s model for inference. Some built-in features also use these providers, such as search over your workspace content and voice input. Agents you connect from outside Dock read workspace data only through the API key or OAuth grant you authorized. Every model provider we use is listed on our subprocessor list. Data from a connected Google account is sent to a model provider only when, and only to the extent that, carrying out the instruction you gave your agent requires it; it is never used to train, develop, or improve generalized or non-personalized AI/ML models (section 18).
  • No model fine-tuning on customer data.
  • No browser fingerprinting. We do not load FingerprintJS, canvas fingerprinting, or any other identification technique beyond a coarse user-agent string.
  • No selling of personal data. Our revenue is the subscription you pay. We do not have a data-broker relationship with anyone.
  • No advertising. We do not show ads on the Service. We do not share your data for cross-context behavioral advertising (the CCPA / CPRA term) and do not participate in any ad network. Data from connected accounts, including Google user data, is never used for advertising and is never shared with the advertising partners described in section 7.1.
  • No marketing email by default. The only unsolicited mail you receive from us is transactional (sign-in, security, billing). The changelog digest is opt-in. (Separately, product updates are delivered in-product to your Chief of Staff agent by default, this is not email, and you can opt out; see section 17.)

7. Cookies

Dock sets two strictly-necessary cookies for the signed-in Service, listed below. On our public marketing pages we also set the dock_consent_region cookie and, when your consent or your region's default allows, marketing and advertising tags that set their own cookies; both are described in section 7.1. The strictly-necessary cookies are:

  • dock-session: the authentication session cookie. HttpOnly, Secure (production), SameSite=Lax, thirty-day rolling TTL. Set on successful magic-link sign-in. Without it the Service does not function. Strictly necessary.
  • dock-elev: the elevated-session cookie for sensitive user operations (email change, account deletion, API key reveal). HttpOnly, Secure, SameSite=Lax, fifteen-minute TTL. Set on click-through from an emailed elevation link. Strictly necessary for the sudo-mode pattern.

Apart from the marketing and advertising cookies described in section 7.1, we set no advertising or analytics cookies. Our product-analytics tool (PostHog) is configured cookieless (memory-only persistence), so it does not set a cookie; Do-Not- Track and Global Privacy Control signals are honored. What it receives is described on our subprocessor list.

7.1 Marketing and advertising cookies

Our public marketing pages can load advertising tags from Meta, LinkedIn, X, Google Ads and Reddit. These tags are never loaded inside the signed-in product.

  • Outside the UK, the EU, the EEA and Switzerland, these tags are on by default. You can decline them at any time with the Decline button in the cookie banner. The banner can be reopened at any time from the “Your Privacy Choices” link in the site footer.
  • In the UK, the EU, the EEA and Switzerland, and for now in Brazil and in Quebec, these tags are off until you click Accept. Declining, or not answering, keeps them off.
  • We infer your region from the country (and, for Canada, the province) associated with your IP address, as reported by our hosting provider. We store the result in a cookie, dock_consent_region, which holds only the region category, contains no identifier and expires after one day. If the country cannot be determined, the tags stay off until you accept.
  • If your browser sends a Global Privacy Control signal, these tags are not loaded, whatever your region and even if you accepted earlier.

Sharing under California law. When these tags load, we make personal information available to Meta Platforms, LinkedIn, X, Google and Reddit for cross-context behavioural advertising. Under the California Consumer Privacy Act as amended by the CPRA, this is “sharing” of personal information. The categories shared are: identifiers (cookie and device identifiers, and your IP address); and internet or other electronic network activity (the pages you view on our marketing site and events such as a sign-up or waitlist join, without your name or email address). We do not sell personal information for money.

To opt out of this sharing, use any of: the Decline button in the cookie banner; the “Your Privacy Choices” link in the site footer, which reopens the banner; or a Global Privacy Control signal from your browser, which we treat as a valid opt-out. A decline takes effect immediately in the current page for Meta, X, Google and Reddit: we tell each of their tags to stop, and we stop sending page-view calls to all of these tags as you navigate. LinkedIn’s tag offers no way to stop it once loaded, so if it is loaded we reload the page, and all of these tags stop.

8. Who we share personal data with

We share personal data only with vendors that operate the infrastructure Dock runs on (sub-processors), and only to the extent needed to provide the Service. The current list:

  • Neon, primary Postgres database (us-east-1).
  • Vercel, edge hosting, serverless functions, Blob object storage.
  • Resend, transactional email delivery.
  • Stripe, subscription billing. We never see card numbers; Stripe handles all payment data on their PCI DSS Level 1 attested infrastructure.
  • Sentry, error monitoring. Stack traces with scrubbed request data.
  • Upstash, Redis backend for the rate limiter. Sees IP hashes and rate-limit counters; no content.
  • Cloudflare, Workers + Durable Objects that power the real-time transport; row and document event payloads pass through in transit, with no persistence beyond transient edge state.
  • GitHub, private repository that mirrors support tickets you file, so our team can triage.
  • Anthropic, AI model provider. Agents running Claude models send their prompts, tool outputs, and the workspace data they read to Anthropic for inference.
  • OpenRouter, model routing. Requests from agents using non-Anthropic models pass through OpenRouter to the provider serving that model.
  • OpenAI, AI model provider. Builds the search index over your workspace content and transcribes video soundtracks.
  • Google (Gemini API), AI model provider. Generates images when an agent uses the image tool.
  • Deepgram, speech-to-text for voice input in agent chat.
  • Monid, the data gateway behind agents' built-in data tools. It passes each lookup to the data provider that serves it.
  • Inkbox, the email addresses and phone numbers agents send and receive messages on.
  • Twilio, texts the code that verifies your phone number at sign-up.
  • Fly.io, the machines cloud agents run on.
  • Composio, brokers the OAuth connections to third-party apps you link to Dock (including Google), performs the token exchange, stores and refreshes those apps’ OAuth tokens, and hosts the tools your agents use to call those apps. For Google accounts, see section 18.
  • PostHog, product analytics. Receives pageviews, interaction events, a pseudonymous user id + org id + role, and how you found Dock (section 3.3); no email or workspace content. Session recording is disabled.

Each sub-processor is contractually bound to data-protection obligations no less protective than this policy. The current list with what each touches is published at /subprocessors.

Advertising partners. Separately from our sub-processors, our public marketing pages load advertising tags from Meta, LinkedIn, X, Google Ads and Reddit. When your consent or your region's default allows these tags to load, these partners receive identifiers (cookie and device identifiers, and your IP address) and browsing activity on our marketing site, and use them for advertising. How to opt out is described in section 7.1.

9. International transfers

Vector Apps is established in the United States. Primary data storage is in US-East-1. For customers in the European Economic Area, the United Kingdom, or Switzerland, our Data Processing Addendum incorporates the EU Standard Contractual Clauses (Module Two, Controller-to-Processor) and the UK Addendum by reference for transfers to the United States. Dock does not offer EU data residency today.

10. Data retention

  • Account and workspace content: retained for as long as your account exists. On request or account deletion, removed within thirty days (see “Your rights” below).
  • Audit log events: three hundred sixty- five (365) days. Includes the action taken, actor identity, and the payload of the state change (e.g. the row body that was written). Storage-layer encryption (AES-256 via Neon) covers the data at rest; application-layer encryption of event payloads for sensitive workspaces is on the roadmap. Customers with stricter retention requirements should email privacy@trydock.ai.
  • Connected-account tool actions (including Google): the audit log keeps a masked summary of each action (up to 200 characters), retained with audit log events; for outgoing-email actions, the content you asked to send (up to about 4,000 characters). Full content from a connected account is not retained unless your agent saves it into your own workspace at your direction, in which case it follows the account and workspace content retention above.
  • Google OAuth tokens: held by Composio, not by Dock; revoked when you disconnect Google in Settings → Connections.
  • Magic-link tokens: fifteen minutes, single-use, deleted on redemption.
  • OAuth access tokens: seven days.
  • OAuth refresh tokens: thirty days, sliding window. Idle tokens expire; actively-used tokens never need re-authentication.
  • Sessions: thirty days rolling, deleted on logout or session rotation.
  • Webhook delivery logs: successful deliveries are purged after ninety days; failed deliveries are retained three hundred sixty-five (365) days for debugging, then purged.
  • Vercel edge request logs: thirty days, managed by Vercel.
  • Postgres backups: seven days point-in-time recovery on Free and Pro tiers, fourteen days on Scale. Object storage has a fourteen-day undelete window.
  • Stripe invoice records: seven years as required by US tax law.

11. Your rights

You can exercise the following rights any time, with respect to personal data we hold about you:

  • Access and portability (Art. 15, 20): get a machine-readable export of every record tied to your user and the orgs you own. Visit Settings → Data export and click “Download my data”, or hit GET /api/me/export while signed in. The export is a JSON file with your account, orgs, workspaces, rows, doc bodies, comments, agents, API key metadata, referrals, and memberships. Plaintext credentials are deliberately excluded; they were shown to your client exactly once at creation and are non-recoverable.
  • Rectification (Art. 16): edit profile fields in Settings, or email privacy@trydock.ai for anything you cannot edit yourself.
  • Erasure (Art. 17): delete your account in Settings → Account → Delete account, or hit DELETE /api/me. Cascade deletion removes your User row, organization memberships, workspace memberships, agents, API keys, OAuth tokens, sessions, support tickets, and any workspace where you are the sole owner. Audit log entries that name you are retained as required by the immutable-ledger contract; we are adding anonymization of your personal identifiers in those retained entries so surviving customers can continue to audit their own activity coherently. Completion within thirty days.
  • Restriction and objection (Art. 18, 21): email privacy@trydock.ai and we will pause processing while we resolve the objection.
  • Withdraw consent (Art. 7): any digest email has a one-click unsubscribe.
  • Lodge a complaint: with your local data protection authority. We’d prefer you tell us first so we can fix the underlying issue.
  • CCPA / CPRA rights (California): right to know, right to delete, right to opt out of sale or sharing for cross-context behavioral advertising (we do neither), right to limit use of sensitive personal information (we do not knowingly collect sensitive personal information under the CCPA definition). Exercise all of these via the same privacy@trydock.ai address.

12. Prohibited data

Dock is a general-purpose collaborative workspace. It is not intended for, and is not contractually certified to handle, the following classes of regulated data. Please do not upload them to a Dock workspace:

  • Protected Health Information (PHI) as defined under HIPAA. Dock is not HIPAA-eligible and we do not sign Business Associate Agreements.
  • Payment card data (PCI). Card numbers, CVVs, magnetic-stripe data. Stripe handles all payment processing on our behalf; you never need to put card numbers in a workspace.
  • Social Security Numbers, government identifiers, biometric records, outside the scope of our compliance posture.
  • Information from minors under sixteen, including parents’ data describing them.
  • Sealed legal records, attorney-client communications: consult counsel about attorney work product before putting it in any SaaS.
  • Classified government information.

If you upload prohibited data anyway, you are responsible for the legal consequences. We may remove the content or suspend the account.

13. Children

Dock is not directed to children under sixteen (16). We do not knowingly collect personal data from anyone under sixteen. If we learn we have collected data from a minor, we will delete it. Operators of family or educational accounts are responsible for ensuring users under sixteen do not sign up.

14. Security

How we protect personal data, encryption in transit and at rest, authentication, authorization, audit logging, network egress controls, content sanitization, rate limiting, employee access controls, vulnerability disclosure, and incident response, is documented in detail at /security. That policy is the technical companion to this one. The short version: TLS 1.3 everywhere, AES-256 at rest, every credential SHA-256 hashed at rest, every workspace operation gated by a single canonical access check.

15. Breach notification

If we discover a personal data breach affecting your data, we will notify the controller (you, if you are using Dock for your own account; the org owner, if you are a member of a customer’s org) within seventy-two (72) hours of becoming aware of it where the breach is likely to result in a risk to the rights and freedoms of natural persons. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures we have taken or propose to take to address the breach and mitigate its effects.

16. Changes to this policy

Material changes are reflected in an updated effective date at the top of this page. Customers on a paid plan with an executed Data Processing Addendum are notified by email at least thirty days before material changes take effect, unless the change is required by law or addresses a security risk that requires faster action. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

17. Product communications to your Chief of Staff agent

Every Dock account includes a Chief of Staff, the system-generated agent that anchors your team. Dock is introducing product updates (new features, changes that affect how your agents work, and operational notices) delivered in-product to your Chief of Staff agent by default, so the agent best positioned to act on them receives them directly. This section describes that model as we roll it out.

These updates are delivered inside Dock to your own agent. They are not marketing email and are separate from the opt-in changelog digest described above. We rely on legitimate interest (Art. 6(1)(f)) to keep you informed about the service you use.

Opting out. You can turn this off at any time by emailing privacy@trydock.ai (or support@trydock.ai), and we will disable product updates to your Chief of Staff agent. A self-serve toggle in Settings is coming soon; until it ships, the email opt-out is honored promptly.

18. Google user data

When you connect a Google account to Dock, Dock accesses your Google data (which may include Gmail, Google Drive, Google Calendar, Google Docs, and Google Sheets, depending on the permissions you grant) only to perform the actions you explicitly request through your Dock agents and workspaces, and to provide or improve those user-facing features.

Dock’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • Dock only uses Google user data to provide or improve the features you request. It is not used for any other purpose, including advertising, market research, or building profiles.
  • Dock does not sell Google user data and does not share it with advertisers or the advertising partners described in section 7.1.
  • Dock does not use Google user data to train, develop, or improve generalized or non-personalized artificial-intelligence or machine-learning models.
  • Dock does not transfer Google user data to others except as necessary to provide or improve the feature you requested (to the subprocessors listed in section 8, including the model provider serving your agent and Composio, which brokers the connection), to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you.
  • Humans do not read your Google user data unless you have given explicit consent, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or it is limited to the masked operational records described in section 10.

How the connection works. The authorization is brokered by our subprocessor Composio, which performs the OAuth token exchange, stores and refreshes your Google OAuth tokens, and hosts the tools that call Google APIs on your behalf. Dock does not store your Google OAuth tokens. When your agent runs a Google action, the result passes through Composio to your agent to carry out your instruction. Dock retains only the masked operational records described in section 10, plus any content your agent saves into your own workspace at your direction.

Your controls. You can revoke Dock’s access at any time in Dock Settings → Connections, which revokes the grant at Composio, or from your Google Account permissions page. You can delete content your agent saved, export your data, and delete your account as described in section 11.

19. Contact

Privacy team: privacy@trydock.ai. Security team: security@trydock.ai. Both addresses route to the same on-call rotation during the beta period.