DocMark

Privacy policy

Last updated: 11 October 2026.

Introduction

This privacy policy explains how Xcelerent (“Xcelerent”, “we”, “us”) handles personal information in connection with DocMark, our AI document-generation product, and the DocMark website and cloud portal. It is written in plain English so that you can understand what we do and, just as importantly, what we do not do.

DocMark ships in three deployment modes, and how your data is handled depends heavily on the mode you use. The section below sets out that distinction first, because it is the single most important thing to understand about privacy and DocMark.

If you have any questions about this policy, contact us at hello@docmark.md.

How this depends on your deployment mode

DocMark is available in three deployment modes. Data handling differs by mode.

  • On-prem. DocMark runs on your own hardware and network, and once installed it runs offline. As we install and hand it over, this mode is “zero-egress” and runs no AI: DocMark sends nothing off your premises, and Xcelerent receives and processes no client content of any kind. We are not in the data path. Two limits. First, whoever administers the box can enable an AI engine. The watched-folder intake starts one only after the operator attests that a signed data-processing agreement is in place. The documents it produces are labelled as contract-protected, never as zero-egress, and that processing is governed by that agreement. Second, other software on the box, such as Docker, follows its own vendor’s settings.

  • Client cloud. DocMark runs inside your own cloud tenant and is managed by you. Your content stays within your cloud boundary. In this mode you use your own large language model (LLM) subscription; we only recommend options. Xcelerent is not in the data path and does not receive your content.

  • DocMark cloud. This is our managed software-as-a-service offering at app.docmark.md, run by us on Microsoft Azure with DocMark-managed AI. In this mode we do process the content you submit, as described in the rest of this policy.

In short: for on-prem and client-cloud deployments, we process nothing. The collection, use, retention, sub-processor and transfer sections below apply to the DocMark cloud service unless stated otherwise.

What we collect

For the DocMark cloud service, we collect:

  • Account and contact information. Your email address, which we use for magic-link sign-in to the cloud portal, and any contact details you provide when you reach out to us.
  • Submitted content. The prompts and files you submit to generate documents.
  • Generated documents. The documents DocMark produces from your submissions.
  • Usage and operational logs. Basic technical and operational logs needed to run and secure the service, such as request metadata, timestamps and error information.

How we use it

We use the information above to:

  • render and deliver the documents you request;
  • operate, maintain and secure the service;
  • provide support and respond to your enquiries; and
  • meet our legal and regulatory obligations.

We do not sell your personal information.

Website analytics and cookies

Our marketing website (docmark.md) uses three analytics tools. One runs for every visitor, sets no cookies and stores nothing else in your browser. The other two run only if you choose Accept in the cookie banner.

Always on, and cookieless: Azure Application Insights. We use Microsoft’s Azure Application Insights in cookieless mode for page-view and page-load statistics, with no identifier that links a view to you or to your other views. It sets no cookies, keeps nothing in your browser’s storage, and does not track you across other websites. With each page view, Microsoft records an approximate location (city, region and country) worked out from your IP address, without storing the address itself, and your browser and operating system as your browser reports them. Microsoft provides the service; the data is processed and stored in Azure’s East Asia region (Hong Kong) and kept for 30 days.

Only with your consent: Google Analytics 4 and Microsoft Clarity. Until you make a choice, neither tool loads and neither sets a cookie. If you choose Reject, that remains the case. If you choose Accept:

  • Google Analytics 4 (provided by Google) records the pages you visit, the site you came from, how long you stay, and interactions such as scrolling and clicks on links to other sites, together with your device type, browser and approximate location. Google derives the location from your IP address; Google Analytics does not store the IP address itself. It sets the cookies _ga and _ga_SBXQXLBZ9S, which tell visits and sessions apart and last up to two years.
  • Microsoft Clarity (provided by Microsoft) records how you use our pages — clicks, scrolling, mouse movement and the page as it appeared to you — and turns this into session replays and heatmaps. Everything you type into our contact form is masked in full, so it does not appear in a replay. Clarity sets the cookies _clck (up to one year) and _clsk (one day) on our site, and may set cookies on Microsoft’s own domains, such as MUID and CLID.

No advertising use. Both tools run with advertising storage denied: in Google Analytics, ad_storage, ad_user_data and ad_personalization are denied and Google signals and ad personalisation are switched off; in Clarity, ad_Storage is denied. We do not use either tool for advertising, remarketing or advertising profiles.

Where it is processed. Google and Microsoft process this analytics data on their own systems, including in the United States.

Changing your mind. Your choice is kept in your browser’s local storage on this device, not in a cookie. To withdraw consent at any time, select Cookie settings in the website footer and choose Reject. Both tools stop loading, and we delete the _ga, _ga_SBXQXLBZ9S, _clck and _clsk cookies from our site; cookies on Microsoft’s own domains can be cleared in your browser settings. Clearing your browser’s data for docmark.md also clears your choice, and the banner will ask again.

(Signing in to the cloud portal uses a strictly-necessary session mechanism to keep you logged in — that is separate from website analytics.)

Privacy by design: no PII to the execution plane

The DocMark cloud service is built so that your identity and personal information stay in the control plane and never reach the execution and rendering plane where documents are generated. In practice, the part of the system that processes prompts and renders documents does not receive your identifying personal information. This design reduces the exposure of personal data during processing and is a core part of how we protect you.

Sub-processors

For the DocMark cloud service we rely on a small number of third-party providers (“sub-processors”), described here by category:

  • Cloud hosting — Microsoft Azure, which hosts the service.
  • AI model provider — Anthropic, which provides the AI model used to generate documents.
  • Email delivery — a third-party email delivery provider, used to send magic-link sign-in and service emails.

On-prem and client-cloud deployments use none of DocMark’s sub-processors. In those modes, hosting and any AI provider are entirely under your control.

Data retention

For the DocMark cloud service, we retain submitted jobs and generated documents for as long as needed to provide the service to you. You can request deletion of your content by contacting hello@docmark.md. Specific retention periods are being finalised and will be stated here once confirmed.

For on-prem and client-cloud deployments, retention is governed entirely by your own systems and policies; we hold nothing.

Security

We apply appropriate technical and organisational measures to protect the DocMark cloud service, including:

  • encryption of data in transit;
  • tenant isolation between customers;
  • least-privilege access controls; and
  • scoped credentials for system components.

No system can be guaranteed perfectly secure, but we take protecting your information seriously and design the service accordingly.

International transfers

The DocMark cloud service is hosted in a Microsoft Azure region. Depending on your location, your information may be processed in a region outside your own country. Where we transfer personal information, we take steps to ensure it remains protected to an appropriate standard.

Your rights

Subject to applicable law, you may have the right to access, correct or delete the personal information we hold about you in connection with the DocMark cloud service. To exercise these rights, contact us at hello@docmark.md and we will respond in line with applicable law.

Children

DocMark is an enterprise product and is not directed at children. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be communicated through the service or by other appropriate means.

Contact

For any privacy questions or requests, contact us at hello@docmark.md.