docketbeta
Create your account

Privacy Policy

How we collect, use, store, disclose and protect personal data.

Last updated: July 8, 2026

1. Introduction

This Privacy Policy explains how Evernow GmbH ("docket", "we", "us", or "our") collects, uses, stores, discloses, and protects personal data when you visit our website, create an account, use the docket platform, communicate with us, or otherwise interact with our services.

Docket is a cloud-based agency management platform for professional users, including agencies, freelancers, consultants, and other businesses. The platform enables users to manage projects, tickets, customer and contact data, time tracking, quotations, invoices, file uploads, reports, and AI-assisted workflows.

This Privacy Policy applies to:

  • visitors of our website;
  • account administrators and users of the docket platform;
  • customers, prospective customers, suppliers, and business contacts;
  • individuals whose personal data is entered into docket by our customers.

2. Controller

Evernow GmbH
Dreieichstraße 59
60486 Frankfurt am Main
Germany

Commercial Register: AG Frankfurt am Main, HRB 54195
VAT ID: DE220772379
Email: info@godocket.app

3. Data Protection Officer

We have not appointed a data protection officer at this time. If we become legally required to appoint one, we will update this Privacy Policy accordingly.

4. Roles Under Data Protection Law

4.1 Where We Act as Controller

Evernow GmbH generally acts as controller for personal data that we process for our own purposes, including:

  • website operation;
  • account registration and administration;
  • customer relationship management;
  • billing and payment administration;
  • transactional communication;
  • support requests;
  • security monitoring;
  • service improvement;
  • legal and compliance purposes.

4.2 Where We Act as Processor

For personal data that customers upload, enter, store, or otherwise process within docket as part of their own business workflows, the customer generally acts as controller and Evernow GmbH acts as processor.

Such processing is governed by our Data Processing Agreement (DPA), unless a separate written data processing agreement has been concluded.

5. Professional Use Only

Docket is intended for professional and commercial use by businesses, agencies, freelancers, consultants, and similar professional users. It is not intended for private consumer use.

6. Categories of Personal Data We Process

Depending on your interaction with us and the platform configuration, we may process the following categories of personal data.

6.1 Account and User Data

  • name;
  • email address;
  • password hash;
  • user role;
  • organization or workspace membership;
  • authentication and login records;
  • account settings.

6.2 Organization and Billing Data

  • company or business name;
  • business address;
  • billing address;
  • VAT or tax information;
  • subscription plan;
  • payment status;
  • invoice and billing records.

6.3 Customer and Contact Data Entered Into Docket

Customers may enter personal data relating to their own customers, prospects, suppliers, contractors, employees, or other contacts, including:

  • names;
  • business email addresses;
  • telephone numbers;
  • company details;
  • addresses;
  • notes;
  • communication history;
  • project-related information.

6.4 Project, Ticket, Time Tracking, Quotation, and Invoice Data

Docket may process personal data contained in:

  • projects;
  • tickets;
  • ticket comments;
  • internal notes;
  • time entries;
  • work logs;
  • employee records;
  • quotations;
  • invoices;
  • reports;
  • project budgets and billing information.

6.5 Uploaded Files

Users may upload files such as:

  • PDF files;
  • invoices;
  • contracts;
  • spreadsheets;
  • images;
  • documents;
  • attachments to tickets or projects;
  • other business-related files.

Uploaded files may contain personal data or confidential business information depending on the customer's use of the platform.

6.6 Transactional Communication Data

We may process data necessary to send transactional emails, including:

  • account invitations;
  • password reset emails;
  • login or security notices;
  • billing notices;
  • invoices;
  • subscription notices;
  • system notifications;
  • ticket or comment notifications;
  • administrative notifications to account administrators.

6.7 Payment Data

Payments are processed by Stripe. We generally do not store full credit card numbers ourselves. Stripe may process payment details, billing information, cardholder information, transaction data, and related fraud prevention information.

6.8 Technical, Log, and Diagnostic Data

We may process technical data such as:

  • IP address;
  • browser type and version;
  • operating system;
  • device information;
  • timestamps;
  • authentication logs;
  • application logs;
  • error reports;
  • crash reports;
  • diagnostic information;
  • security-relevant events.

Application logs and error data may be processed by our monitoring provider for approximately 30 days unless a shorter or longer period is required for security, troubleshooting, or legal purposes.

7. Purposes and Legal Bases of Processing

We process personal data for the purposes and legal bases described below.

7.1 Website Operation

We process technical data to provide the website securely and reliably.

Legal basis: legitimate interests in operating a secure and functional website.

7.2 Account Registration and Platform Access

We process account and user data to create accounts, authenticate users, manage workspaces, assign roles, and provide access to the platform.

Legal basis: performance of contract or steps prior to entering into a contract.

7.3 Provision of the Docket Platform

We process customer content and operational data to provide the platform functionality, including projects, tickets, time tracking, quotations, invoices, reports, file storage, and collaboration features.

Legal basis: performance of contract where we act as controller; documented customer instructions where we act as processor.

7.4 Billing and Payments

We process billing and subscription data to administer subscriptions, process payments, generate invoices, and manage payment status.

Legal basis: performance of contract and compliance with legal obligations.

7.5 Transactional Emails

We process contact and account data to send transactional emails required for platform operation and account administration.

Legal basis: performance of contract and legitimate interests in operating the service.

7.6 Support

If you contact us for support, we process the information you provide to respond to and resolve your request.

Legal basis: performance of contract and legitimate interests in customer support.

7.7 Security, Fraud Prevention, and Abuse Prevention

We process technical logs, authentication records, and security events to protect the platform, detect abuse, prevent unauthorized access, and ensure system integrity.

Legal basis: legitimate interests and, where applicable, legal obligations.

7.8 Legal Compliance

We process certain data to comply with accounting, tax, commercial, regulatory, and legal obligations.

Legal basis: compliance with legal obligations.

7.9 Product Improvement

We may use limited technical, aggregated, or statistical information to understand and improve service reliability and usability. We do not use customer content for AI model training unless explicitly agreed otherwise.

Legal basis: legitimate interests in improving the service.

8. AI Functionality

Docket includes AI-assisted functionality, including a chatbot-style assistant that can answer questions about content within the customer's workspace and assist users with tasks such as drafting quotations or creating time entries.

When AI features are used, relevant customer content may be transmitted to our AI service provider, Mistral AI, for the purpose of generating responses or performing the requested task.

Depending on the user's prompt and the selected context, the information processed by the AI functionality may include:

  • project information;
  • ticket content;
  • comments and notes;
  • time entries;
  • customer contact data;
  • quotations;
  • invoices;
  • uploaded file content;
  • other user-generated content.

AI-generated outputs may be inaccurate, incomplete, outdated, or unexpected. Users are responsible for reviewing all AI-generated output before relying on it, sending it externally, creating invoices or quotations from it, or using it for business decisions.

Customer content is not used by Evernow GmbH for training AI models. Customer content is also not intended to be used by our AI provider for training models unless explicitly agreed otherwise or required under the applicable provider terms with appropriate safeguards.

Customers should not submit special categories of personal data to the platform or AI functionality unless they have a lawful basis and appropriate safeguards for doing so.

9. Cookies and Similar Technologies

Our website and application currently use only technically necessary cookies and similar technologies required for:

  • authentication;
  • session management;
  • security;
  • load balancing;
  • platform operation.

We do not currently use advertising cookies, marketing cookies, retargeting pixels, or non-essential analytics cookies.

If we introduce non-essential cookies or similar technologies in the future, we will update this Privacy Policy and, where required, obtain consent before using them.

10. Recipients and Service Providers

We use carefully selected service providers to operate docket. These providers may process personal data on our behalf or as independent controllers depending on their role.

Current providers include:

  • Fly.io for application hosting and infrastructure;
  • Amazon Web Services S3 for file and attachment storage;
  • Redis Cloud for caching and session-related infrastructure;
  • Mistral AI for AI processing;
  • Stripe for payment processing and billing;
  • Postmark for transactional email delivery;
  • AppSignal for monitoring, diagnostics, logging, and error tracking.

A current Subprocessor List is maintained at docket.app/legal/subprocessors.

11. International Data Transfers

Some service providers may process personal data outside the European Economic Area, including in the United States or other countries that may not provide the same level of data protection as the European Union.

Where required, we rely on appropriate safeguards such as:

  • adequacy decisions;
  • the EU-U.S. Data Privacy Framework where applicable;
  • Standard Contractual Clauses;
  • data processing agreements;
  • supplementary safeguards where appropriate.

12. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy.

Typical retention criteria include:

  • account data is retained for the duration of the customer relationship;
  • customer content is retained while the customer account is active;
  • after termination, customer content is generally made available for export for a limited period, typically 30 days;
  • after the export period, customer content may be deleted from active systems;
  • backup copies are deleted or overwritten according to our regular backup cycles;
  • billing, accounting, and tax records are retained according to statutory retention requirements;
  • logs and diagnostic data are retained for limited periods necessary for security, troubleshooting, and reliability.

13. Data Subject Rights

Subject to applicable law, individuals may have the right to:

  • request access to their personal data;
  • request correction of inaccurate personal data;
  • request deletion of personal data;
  • request restriction of processing;
  • object to processing;
  • receive personal data in a portable format;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with a supervisory authority.

Requests may be sent to info@godocket.app.

If the request concerns personal data processed in a customer workspace, we may refer the request to the relevant customer, as the customer may be the controller of that data.

14. Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

Measures may include:

  • encryption in transit;
  • access controls;
  • authentication mechanisms;
  • role-based permissions;
  • logical tenant separation;
  • monitoring and error tracking;
  • backup procedures;
  • restrictions on internal access;
  • confidentiality obligations.

No system can be guaranteed to be completely secure. Customers are responsible for maintaining secure credentials, configuring user access appropriately, and ensuring that their users handle data lawfully.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes may be communicated by email, in-app notice, or publication on our website.