Privacy Policy
This policy explains what personal information DC Workflow collects, why, who it's shared with, and the choices you have.
Who we are and what this covers
DC Workflow is a document-control service for project teams, operated by Piksort Pty Ltd. This policy covers the DC Workflow app at app.dcworkflow.com, including when it is opened inside Microsoft Teams.
Information we collect in the app
Your account
- Your name and work email address, and your password — which we store only as a one-way hash, never as the password itself.
- If you sign in with a Microsoft work account: your name, email address, and the identifiers of your Microsoft account and organisation.
- Your profile: initials, avatar colour, an optional profile photo, and your email notification choices.
- Signatures you save to reuse — drawn, uploaded or typed — and, each time you sign a document, your name, email address, the time and your time zone.
What you and your team put into DC Workflow
- Documents and files, their names and revisions, and the markups, comments, review decisions and sign-offs made on them.
- Transmittals and their messages, document number requests, and requests for access to a review, including any message written with them.
- A log of activity on each document — who did what, and when — including who deleted something and the reason they gave.
Information about other people
When you invite someone, add them as a reviewer, send them a transmittal or list them as a company contact, we store their email address and, where given, their name and company. Organisation settings can include your company's name, address, phone, email and website.
Emails sent to DC Workflow
Transmittals can be emailed to a DC Workflow capture address. When one arrives, we keep the sender's name and email address, the subject, the recipients, the message itself (as a record of what was received), its attachments, and files from download links in it.
Sign-in and device information
For each browser you sign in on, we record its IP address, its browser description (user agent), and when it signed in and was last used. You can see this list in your account settings.
Activity on shared links
When someone opens or downloads from a transmittal link, we record what they opened and when, against the recipient the link was sent to, and the sender is notified of downloads. Shared links also record when they were last used.
Usage analytics
We use PostHog to understand how DC Workflow is used. It records the address of each page you view, your clicks and other interactions, and when you leave a page. Once you're signed in, this is linked to your account, including your name and email address. Visits to this Privacy Policy and to the Terms of Use aren't tracked.
How we use it
- To sign you in, keep you signed in, and let you end sessions on other devices.
- To run the service: storing your content, showing it to the people who have access, and producing review records, registers, stamped copies and transmittals.
- To send email you need: sign-in codes, invitations, review and transmittal notices, download notices, access requests, and receipts for transmittals emailed to a capture address. Also a daily summary of new revisions — on once you've signed in, and you can turn it off — and notices about documents you choose to follow.
- To suggest a title and description for each document, using AI (see below).
- If your organisation has connected Microsoft 365, to copy documents and registers into its SharePoint.
- To keep the service secure and to understand and improve how it's used.
AI document descriptions
When a document is added to a project — uploaded, submitted through a portal or received by email — DC Workflow sends part of it to Anthropic's Claude AI to suggest a title and description. What's sent is the first pages of a PDF (up to six), an image, or an excerpt of a spreadsheet or text file, together with the project name, the document's number, title and file names, and the titles of other documents in the project.
Anything visible on those pages — such as names, signatures or company details in a title block — is included. This happens automatically, and there is currently no setting to turn it off for a project.
Where your information is stored
Your account information, content and files are stored with Microsoft Azure. Analytics are processed by PostHog in the United States, and AI descriptions by Anthropic.
If your organisation connects Microsoft 365, copies of documents and registers are also stored in its own SharePoint, under its control. They stay there if the connection is later removed.
How long we keep it
- Your content is kept until it's deleted in DC Workflow. Deleting a document removes its files, but the document's activity log is kept as a record of what happened, including the deletion. Finalised review records are kept as permanent records. Archiving or deleting a project hides it but does not erase its content.
- Saved signatures: when you delete one, its image is kept so that documents already signed with it stay intact.
- Sign-in records for a device are deleted once the session expires, or 30 days after it's signed out.
- Sign-in codes expire after 15 minutes, and invitation links after 30 days.
How we protect it
- Passwords and sign-in codes are stored only as one-way hashes.
- Sign-in codes expire after 15 minutes and stop working after five wrong attempts.
- Your session cookie can't be read by page scripts, and you can end sessions on other devices at any time.
- Files are kept in private storage and delivered only through access-checked requests or links that expire within an hour.
- Microsoft 365 connection credentials are stored encrypted.
Your choices
In your account settings you can:
- change your profile photo, initials and avatar colour;
- turn the daily email summary on or off, and stop following documents;
- see where you're signed in, and sign out other devices.
You can reset your password from the sign-in page. To ask for a copy of your information, to correct it, or to have your account deleted, contact us at privacy@dcworkflow.com— these can't yet be done in the app itself.
Contact us
Privacy questions and requests: privacy@dcworkflow.com. DC Workflow is operated by Piksort Pty Ltd, Western Australia.