Privacy notice
Last updated: 18 October 2026
Who we are
DocuWeave is a trading name of Rabblepop Ltd, a company registered in England and Wales (company no. 17361712), registered office 320 Firecrest Court, Centre Park, Warrington, WA1 1RG.
Contact: support@docuweave.ai
Two different roles
- Your account. For your name, email, organisation membership, billing and how you use DocuWeave, Rabblepop Ltd is the controller, and this notice applies.
- Your documents. For the templates, source documents and extracted values your organisation uploads, your organisation is the controller and we process them on its behalf, under our terms and data processing agreement. If a document names you and you have a question about it, ask the organisation that uploaded it. We will help it answer.
What we collect, why, and our lawful basis
| What | Why | Lawful basis |
|---|---|---|
| Your name, email address, organisation and role | To create and run your account and sign you in | Contract |
| Which version of our terms you accepted at sign-up, and when | To know which terms apply to your account, and to show what was agreed | Contract, and legitimate interests: being able to show what was agreed |
| An invited colleague's email address, given to us by you | To send them the invitation | Legitimate interests: letting organisations add their team |
| Your plan, subscription and payment history (card details go to Stripe, not us) | To bill you and keep accounting records | Contract, and legal obligation for accounting records |
| Your billing address and, if you give one, your VAT number, collected by Stripe at checkout | To work out and charge the right VAT, and to put them on your invoices | Contract, and legal obligation for VAT records |
| A record of key actions in your organisation's account: when an account was created and which terms were accepted, changes to its plan and payment status, templates imported, document packs bought and pack documents used. Who did it, when, and identifiers only, never the content of your documents | To show what happened in an account, to resolve questions about billing, and to keep the service secure | Contract, and legitimate interests: accountability and security |
| Which DocuWeave features your account uses, the steps you take and how long they take, errors you meet, and, if you tell us at sign-up, the kind of business you are in. Never the content of your documents or fields | To fix problems and decide what to improve | Legitimate interests: improving DocuWeave. You can switch this off in Settings |
| Roughly how you found us (for example a search engine or an AI assistant), recorded once when you sign up | To learn which channels bring people to DocuWeave | Legitimate interests |
| Technical details of errors: the page, browser and device type, and what went wrong | To find and fix faults | Legitimate interests: keeping the service working |
| How visitors use this website, through Google Analytics | To improve the website | Consent, through the cookie banner |
| Emails you send us | To answer you | Legitimate interests |
You need to give us your name and email address to have an account; without them we cannot provide the service.
AI extraction. To fill a template, DocuWeave sends the text of your source documents and your field instructions to an AI model, which suggests a value for each field. You review every value before a document is generated. We make no decisions about you by automated means.
Who we share it with
These providers process data for us under written terms. They may not use it for their own purposes.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services (Amazon Web Services EMEA SARL) | Hosting the app, its database and your files; reading document text to suggest field values and placeholders, on Amazon Bedrock | London (eu-west-2) |
| Amazon CloudFront (part of Amazon Web Services) | Delivering the app to your browser from the nearest of Amazon's worldwide servers. Nothing is stored there | Worldwide |
| Resend (Plus Five Five, Inc.) | Sending sign-in links and invitations, and internal billing alerts to our staff, which carry account and payment identifiers only | European Union (Ireland) |
| Stripe (Stripe Payments Europe, Limited, with processing in the US by Stripe, LLC) | Payments and subscriptions, and working out VAT (Stripe Tax). Stripe collects your billing address and any VAT number at checkout | European Union (Ireland) and United States |
| PostHog (PostHog, Inc.) | Recording how signed-in accounts use features, sent through a relay run by PostHog on Cloudflare | European Union (Germany) |
| Sentry (Functional Software, Inc.) | Error monitoring | European Union (Germany) |
| Vercel | Hosting this website | London, with a global network |
| Website analytics, only if you accept | United States | |
| GoDaddy | Domain name system for docuweave.ai (which address a name points to) | Worldwide |
The AI models are Claude Sonnet 4.6, made by Anthropic, and Amazon Nova Lite and Amazon Nova Pro, made by Amazon. They run inside Amazon Web Services in London, through Amazon Bedrock. Their makers have no access to what is sent to them, and nothing sent to them is used to train any model.
Where your documents are kept. Your documents and everything in them, meaning the text read from your paperwork, the values and passages we keep, your templates and logos, and the finished documents, are stored and processed only in the UK, on Amazon Web Services in London (eu-west-2). The AI models read them there too. If you use DocuWeave from outside the UK, your documents travel between your browser and London through Amazon's nearest server, encrypted, and are never kept there. The other providers in the table above handle account, billing, usage, error and delivery information, not the content of your documents, and some of them are outside the UK. Each is listed, with where it is, at docuweave.ai/sub-processors.
The companies that process your organisation's documents for us are listed, with what each does and where, at docuweave.ai/sub-processors.
We also share information with our accountant and, if needed, our insurers or legal advisers. We do not sell personal information.
Transfers outside the UK. Where a provider processes data in the European Union, we rely on the UK's adequacy regulations. Where it is a US company or processes data in the United States, we rely on the UK extension to the EU–US Data Privacy Framework, with the International Data Transfer Addendum to the EU standard contractual clauses as the fallback. None of these transfers includes the content of your documents. Ask us for a copy of the safeguard that applies.
How long we keep it
| Your account | While your account is open, then 30 days, after which it is deleted |
| Billing and accounting records, including your invoices, billing address and VAT number | 6 years from the end of the financial year they relate to |
| Which terms you accepted, and when | As your account: while it is open, then 30 days, after which it is deleted |
| The record of key actions in your organisation's account | As your account |
| Feature usage | 12 months |
| Error reports | 30 days |
| Website analytics | 14 months |
| Your organisation's documents | Until your organisation asks us to delete them, by emailing support@docuweave.ai, and no later than 30 days after its account closes |
| Emails with us | 12 months from the last message, or as long as your account if they are about it |
Cookies
In the app we use only cookies needed to run it: your sign-in session (authjs.session-token, 30 days), security cookies set while you sign in, the organisation you last chose (activeOrgId, 1 year), and, if you collapse the sidebar, that choice (sidebar_state, 7 days). No analytics cookies.
On this website, Google Analytics runs only if you press Accept.
| Name | Purpose | How long |
|---|---|---|
dw_consent | Remembers your cookie choice | 12 months |
_ga, _ga_ followed by an ID | Google Analytics: counting visits and how people arrive | Up to 2 years |
You can change your mind at any time with Cookie settings at the bottom of every page, which also deletes the Google Analytics cookies.
Your rights
You can ask us for a copy of your personal information, and ask us to correct it, delete it, restrict how we use it, or send it to you in a portable form. You can object at any time to anything we do on legitimate interests, including feature usage, which you can also switch off yourself in Settings. Where we rely on consent, you can withdraw it at any time.
Email us at the address above. We reply within one month, and there is no charge.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, or 0303 123 1113.
Changes
We will update the date at the top when this notice changes, and email account holders first if a change affects them significantly.