Docxedo
How Docxedo collects, uses and protects personal information under New Zealand's Privacy Act 2020, including why the documents your firm uploads are processed in real time and never retained.
Effective date: 1 July 2026
This Privacy Statement explains how Docxedo collects, uses, stores, and protects Personal Information in accordance with the Privacy Act 2020. Docxedo is committed to protecting the privacy of Law Firm Users and ensuring that its practices support the confidentiality obligations that law firms owe to their clients. This Privacy Statement provides transparency about data handling practices, particularly regarding account management information and documents uploaded for styling purposes.
This Privacy Statement applies to Personal Information collected through the Docxedo Platform and the Docxedo website. It distinguishes between information collected for platform use, which is limited to account management and real-time document processing, and information collected through website analytics tools. This Privacy Statement does not apply to information collected by law firms from their own clients.
Docxedo recognises that law firms using the Docxedo Platform have professional and legal obligations to maintain client confidentiality and legal professional privilege under the Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008. This Privacy Statement is designed to support law firms in meeting those obligations by implementing strict real-time processing with immediate data discard, ensuring that no client document content is retained or used for any secondary purposes.
In this Privacy Statement the following terms have the meanings set out below:
Account Data means the names, email addresses, firm names, office locations, and roles collected for account management.
Document Data means the content of documents uploaded by Law Firm Users for styling purposes.
Docxedo Platform means the software application provided by Docxedo for document styling, automation and formatting.
Law Firm User means an individual authorised by a law firm to access and use the Docxedo Platform.
Personal Information means information about an identifiable individual as defined in the Privacy Act 2020.
Processing means any operation performed on Personal Information or Document Data, whether automated or not.
Third Party Service Providers means Microsoft Azure and Gemini, engaged under contractual arrangements to support platform hosting and real-time processing functions.
These definitions align with the Privacy Act 2020 where applicable and are used consistently throughout this Privacy Statement.
Docxedo collects full names, email addresses, firm names, office locations, and professional roles from Law Firm Users. This Account Data is collected during registration, profile updates, and ongoing account administration. Collection is limited to what is necessary for providing and managing access to the Docxedo Platform.
Law Firm Users may upload entire documents to the Docxedo Platform for styling and formatting. Document Data is processed solely to apply styling rules. No Document Data is retained beyond the immediate real-time processing period.
On the Docxedo website only (and not within the Docxedo Platform), analytics data is collected through LinkedIn, Meta, Google pixels, and PostHog. This includes IP addresses, browser information, pages visited, and general user behaviour patterns. These tools are not used within the Docxedo Platform itself.
Docxedo collects limited technical information such as device type, login times, feature usage, and system logs. In relation to documents submitted for styling, the only information retained is limited metadata such as a file hash, document length (number of pages), and an inferred approximate word count; the content of documents is not retained. This information supports the security, functionality, and performance monitoring of the Docxedo Platform. Collection is limited to what is required for secure operation of the Docxedo Platform.
Docxedo personnel do not access, view, or use the content of documents submitted for styling. The only circumstance in which Docxedo personnel may access a document is where a customer voluntarily sends a document to the Docxedo team and expressly requests that the team investigate or take action in relation to it. Otherwise, no Docxedo personnel have access to document content.
Account Data, including names, email addresses, firm names, office locations, and roles, is used to create and maintain user accounts, authenticate access, communicate about service updates, provide support, and manage billing. Use is strictly limited to these operational purposes.
Document Data is used solely to deliver real-time styling and formatting services. Documents are processed instantaneously and then immediately discarded. This ensures that Docxedo does not retain any client document content.
Data collected via LinkedIn, Meta, Google pixels, and PostHog on the website is used to analyse visitor interactions, improve website design and content, and support targeted professional marketing. These tools are not deployed within the Docxedo Platform.
All information collected may be used for security monitoring, fraud prevention, breach investigation, and compliance with legal obligations under New Zealand law, including the Privacy Act 2020. This use is proportionate and necessary for protecting both Docxedo and its Law Firm Users.
When a Law Firm User uploads a document, it is processed in real-time by the Docxedo Platform's formatting engine. The system analyses the document, applies appropriate styling rules, and generates an output version. Upon completion the original Document Data is immediately discarded.
Docxedo engages Gemini as a Third Party Service Provider for certain processing functions. Documents are transmitted to Gemini solely for real-time styling assistance. No Document Data is retained by Docxedo or Gemini after processing is complete.
Neither Docxedo nor Gemini retains, stores, or uses any Document Data for training AI models, product improvement, analytics, or any secondary purpose. Document Data exists only for the duration of active real-time processing and is discarded immediately thereafter.
After processing, the styled document is returned to the Law Firm User through the secure Docxedo Platform interface. Law Firm Users retain complete control over the output, including downloading, saving, or deleting it from their own systems.
Account Data is stored on Microsoft Azure servers located in Australia and New Zealand. Storage is restricted to these jurisdictions. Document Data is not stored at all.
All data is protected using AES 256 encryption for both data at rest and data in transit. This industry-standard encryption ensures confidentiality and integrity of Account Data throughout its lifecycle.
Access to Account Data is strictly controlled through role-based authentication, multi-factor authentication for administrative access, regular security audits, and continuous monitoring. Access is segregated at firm level: each Law Firm User has a unique login, and Law Firm Users cannot access another firm's styles or data. Docxedo staff may access a firm's style guides for support and configuration purposes but are unable to access any documents submitted for styling. Only authorised personnel with a legitimate need may access Account Data, and all access is logged.
Contractual agreements with Microsoft Azure and Gemini require them to maintain equivalent security standards, including AES 256 encryption, zero data retention, and access controls. Docxedo conducts regular reviews of compliance by these Third Party Service Providers with such standards and controls.
In the event of a data breach, Docxedo will notify its privacy officer, take immediate action to contain and stop any further breach, and notify the Docxedo directors. Docxedo will also notify affected Law Firm Users without undue delay where a breach is likely to cause serious harm, consistent with the notifiable privacy breach regime under Part 6 of the Privacy Act 2020 and with the notification commitment in Docxedo's Terms and Conditions. This notification will include the nature of the breach, the information affected, and the steps taken or proposed to address it.
Account Data is retained for the duration of use by Law Firm Users of the Docxedo Platform plus three years after termination or cessation of the subscription. This period allows for resolution of billing, disputes, or legal requirements.
Document Data is never retained. It is processed in real-time and immediately discarded after styling is complete. No copies are kept by Docxedo or any Third Party Service Provider.
Law Firm Users may request deletion of their Account Data at any time by contacting the Privacy Officer. Deletion will occur promptly, subject only to any overriding legal retention obligations under New Zealand law.
Account Data may be disclosed to Microsoft Azure for hosting and to Gemini for real-time processing functions. Disclosures are limited to what is necessary for service delivery and are governed by strict contractual protections.
Docxedo does not sell, rent, or disclose Personal Information to other third parties for marketing or unrelated purposes. Disclosure occurs only as described in this Privacy Statement or as required by law.
Personal Information may be disclosed where required to comply with court orders, regulatory requests, or legal obligations under New Zealand law. In such cases, Docxedo will disclose only the minimum information necessary.
In the event of a merger, acquisition, or sale of assets, Personal Information may be transferred to the successor entity provided that the successor agrees to protect the information in accordance with this Privacy Statement.
LinkedIn, Meta, Google pixels, and PostHog are used exclusively on the Docxedo website and never within the Docxedo Platform. This distinction ensures that no tracking occurs during actual document processing activities.
The LinkedIn pixel on the website collects professional demographic and engagement data for marketing analysis. Law Firm Users may manage preferences through their LinkedIn account settings.
Meta pixels collect website traffic and interaction data for advertising optimisation. Law Firm Users can adjust related advertising preferences in their Facebook or Instagram settings.
Google pixels and related services collect IP addresses, page views, and behaviour data to improve website performance. Law Firm Users may opt out using Google's browser add-on or account settings.
PostHog collects anonymised product and website usage data for experience optimisation. Controls are available through standard browser privacy settings.
Cookies associated with these analytics tools are used on the website. You can manage or disable cookies at any time through your browser settings.
Individuals may request access to their Personal Information held by Docxedo. Requests should be made to the Privacy Officer and will be responded to within 20 working days in accordance with the Privacy Act 2020.
Individuals may request correction of Personal Information that is inaccurate, incomplete, or misleading. Docxedo will correct the information or attach a statement of correction as required by the Privacy Act 2020.
Where appropriate under the Privacy Act 2020, individuals may request deletion of their Personal Information. Such requests are considered in light of any legal retention obligations.
Complaints about handling of Personal Information may be made to Docxedo's Privacy Officer. If unsatisfied, individuals may complain to the Office of the Privacy Commissioner under the Privacy Act 2020.
All privacy enquiries, access requests, correction requests, or complaints should be directed to the Privacy Officer at B.burgess@docxedo.ai. This is the designated contact for all matters concerning this Privacy Statement.
Docxedo will respond to privacy requests within 20 working days, consistent with the timeframes in the Privacy Act 2020. Extensions will only be sought where permitted by law and after notifying the requester.
Docxedo acknowledges that law firms are subject to strict confidentiality duties under the Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008 and common law. The Docxedo Platform has been designed to avoid interfering with these obligations.
By processing documents in real-time only and immediately discarding all Document Data, Docxedo ensures that client information never resides on its systems. This model supports law firms in maintaining their professional responsibilities.
The real-time, non-retention approach minimises any risk to legal professional privilege. Docxedo does not access, review, or retain document content in any form that could affect privilege.
Document Data is not used for any purpose beyond immediate styling. There is no analysis, training, marketing use, or product development involving client documents.
Some Account Data is stored on Microsoft Azure servers in Australia. Although Australia is not currently prescribed as having privacy laws that provide comparable safeguards under the Privacy Act 2020, contractual safeguards, AES 256 encryption, and security standards are relied upon for protection.
Gemini processes document content in real time only, solely for the purpose of applying styling labels. No Document Data is retained by Docxedo or Gemini after processing is complete, regardless of where processing occurs. Transmission to Gemini occurs under its zero data retention agreement, which prohibits retention or any secondary use of the transmitted content. Where transient transmission to Gemini occurs outside Australia and New Zealand, no data is retained by Gemini following that processing, and the transmission is governed by contractual terms that prohibit any secondary use. This disclosure is made to ensure consistency with the data-sovereignty assurance provided elsewhere in this Privacy Statement.
Docxedo complies with Information Privacy Principle 12 by taking reasonable steps to ensure that overseas recipients protect information consistently with New Zealand standards. Contractual measures and real-time discard protocols support this compliance.
Docxedo may update this Privacy Statement to reflect changes in law, business practices, or features of the Docxedo Platform. The current version is always available on the website.
Material changes will be notified to registered Law Firm Users by email or prominent notice on the Docxedo Platform. Changes take effect after reasonable notice is provided.
This Privacy Statement is effective from the Effective Date specified below. Law Firm Users should regularly review the latest version available on the Docxedo website.
This Privacy Statement and all privacy practices of Docxedo are governed by the laws of New Zealand, including the Privacy Act 2020.
Any disputes regarding this Privacy Statement shall first be addressed through the Privacy Officer. Unsatisfied parties may refer matters to the Privacy Commissioner or pursue remedies available under New Zealand law.
By accessing or using the Docxedo Platform or website, Law Firm Users acknowledge that they have read, understood, and agree to the practices described in this Privacy Statement. Continued use following any notified updates constitutes acceptance of the revised terms.
Docxedo is operated by Stratos Technology Partners Limited, headquartered at Level 1, 518 Colombo Street, Christchurch, New Zealand.