Effective October 30, 2026
This policy explains how MaxDok ("we", "us") handles information in DokLocker: the hosted service, the self-hosted software, the live demo and the doklocker.com and maxdok.com websites. If anything here is unclear, email us at [email protected].
The short version
- The documentation you keep in DokLocker belongs to you. We store it to run the service for you and for no other purpose.
- We don't sell personal information, show ads, or use advertising or tracking cookies.
- Saved passwords and other secrets are encrypted before they are stored, and only people you allow can reveal them. Every reveal is logged.
- A few outside companies help us run the service (hosting, payments, email). They are listed below.
- If you run DokLocker yourself, your data stays on your own servers and never reaches us.
Two kinds of information
Information about you, our customer. Your name, work email, company name and how you use your account. We decide how this is used, so for privacy laws we are its controller.
Your content. Everything your team documents: clients, sites, contacts, devices, networks, passwords, notes, photos and files. Much of it is about your clients and their people. You decide what goes in and why, so you are its controller and we act as your processor, only on your instructions. If you're someone whose details an IT provider keeps in DokLocker, please contact that provider; we'll help them answer you.
What we collect
- Account details: name, email, company, profile photo if you add one, and your password (stored only as a one-way hash). If you turn on two-factor sign-in, the authenticator secret is stored encrypted.
- Billing details: your plan and payment history. Card details go straight to our payment provider, Stripe; we never see or store full card numbers.
- Your content: whatever your team adds, imports or syncs from services you connect.
- Security and activity records: sign-ins, IP addresses, browser type, and an audit log of changes, password views, exports and share-link views. These protect your account and let your admins see who did what.
- Messages to us: issue reports and support emails.
- Cookies: only the ones DokLocker needs to work: a sign-in session cookie, a security (CSRF) cookie, and a setting that remembers light or dark mode. No advertising or cross-site tracking cookies.
How we use it
To run, secure and support DokLocker; to bill for it; to send emails you need (sign-in links, invitations, alerts you set up, receipts and important service notices); to fix problems and improve the product; and to meet legal obligations. We don't use your content to train AI models, and we don't look at it unless you ask us to for support, or we must to keep the service secure or obey the law.
Who else handles information
We share information only with companies that help us run DokLocker, under contracts that require them to protect it, or when the law requires it.
- Microsoft Azure: hosts the DokLocker service and its database and files in the United States.
- Cloudflare: DNS and network protection for our websites and the service.
- Stripe: payments and invoices.
- An email delivery provider: sends the service's emails.
- GitHub: hosts the software images self-hosted installs download.
Some features talk to outside services only when you use them:
- DokBot Max sends your questions, and the records it looks up to answer them, to the AI provider you connect (for example Anthropic, OpenAI, Microsoft Azure OpenAI or Google). Saved passwords are never sent. If you use a local AI model, nothing leaves your network.
- Domain and certificate checks send domain names to public lookup services (rdap.org and Cloudflare's DNS service) and connect to the websites you track.
- Find address sends the name or address you're looking up to OpenStreetMap, or to Google if you connected Google Places.
- Integrations you connect (for example NinjaOne, HaloPSA, Microsoft 365, UniFi, HubSpot or RingCentral) exchange data with those services as you configure them. Their own privacy policies apply on their side.
We never sell or rent personal information, and we don't share it for advertising.
How long we keep it
We keep your account and content while your subscription or trial is active. When it ends, nothing is deleted straight away: your workspace stays read-only so you can look things up and export everything. You can ask us to delete it at any time. If we ever remove inactive workspaces, we'll email the admins at least 30 days first, and never sooner than 90 days after the trial or subscription ended. Once a workspace is deleted, backup copies roll off within 35 days. We may keep billing records and a minimal record of the account for as long as tax and accounting law requires.
How we protect it
Connections are encrypted with HTTPS. Passwords and other secrets are encrypted before they're stored, with keys kept separate from the database. Access is limited by role and security group, and every password view is logged. Two-factor sign-in, sign-in lockout, idle timeouts and trusted-network limits are available to every workspace. No system is perfectly secure; if we learn of a breach affecting your information, we will tell you without undue delay. To report a security issue, see doklocker.com/security.
Your choices and rights
You can see, correct and export your information at any time (Account, and Admin › Import / Export). You can ask us to delete your account. Depending on where you live, you may also have the right to object to or restrict some uses, or to complain to a data protection authority. Email [email protected] and we'll respond within 30 days. We won't treat you differently for using these rights.
Self-hosted installs
When you run DokLocker on your own server, your content and account information stay there. We don't receive it. Your server downloads updates from GitHub's container registry, and features you turn on (above) contact those services directly from your server.
The live demo
The demo at demo.doklocker.com contains only made-up companies and people, and it resets every night. Please don't type real information into it.
Children
DokLocker is a business tool and isn't meant for anyone under 16.
Changes
If we change this policy in a way that matters, we'll tell account admins by email or in the app before the change takes effect. The date at the top shows when it last changed.
Contact
MaxDok · [email protected]