Privacy Policy

Introduction

DocBeam (“we,” “us,” or “our”) is a product of Honest Fox, an Australian company. We built DocBeam to give Webflow builders proper file infrastructure — and that means being straightforward about how we handle your data.

This policy explains what we collect, why we collect it, and what we do with it. We’ve written it in plain language, not legalese. If something is unclear, email us at [email protected] and we’ll explain it.

What We Collect

(a) Authentication. DocBeam has two access surfaces. The Webflow Designer extension authenticates via Webflow OAuth — Webflow shares your user ID, name, email address, site IDs, and an access token; we never see your Webflow password. The web dashboard (app.docbeam.io) uses a separate email and password account managed by Clerk — we collect your email address and Clerk stores your credentials.

(b) Files you upload. Documents and assets you upload are stored in Cloudflare R2. We store associated metadata: filename, file size, MIME type, upload timestamp, and any labels you apply.

(c) Usage data. We track download counts, storage consumed, and feature usage. This is how we enforce plan limits and show you accurate usage stats in the extension.

(d) Billing information. Payments are processed by Stripe. We receive your subscription status, plan tier, and billing email. We do not receive or store your full card details — those stay with Stripe.

(e) Technical data. IP addresses, browser and client type, request timestamps, and error logs are collected for security and debugging purposes.

How We Use It

We use the data we collect to:

• Authenticate you and operate your account
• Store, serve, and manage your files via Cloudflare R2 and our CDN
• Enforce plan limits and display accurate usage information
• Process payments and manage your subscription via Stripe
• Send transactional emails (account activity, including setup help after you install the Webflow app, billing receipts, material policy changes) — we do not send marketing email without your explicit consent
• Monitor for abuse, investigate errors, and debug issues
• Improve the product using aggregate, anonymised usage patterns

We do not sell your personal data. We do not use your uploaded content to train AI models.

Visitors to Our Customers’ Sites (Lead Capture)

This section is for people who download a file from a website that uses DocBeam, not for DocBeam customers. A DocBeam customer can mark a document “Require email”. When they do, opening that document’s link shows a short form before the file downloads.

What we collect. Your email address. Your name and company, if you choose to enter them. The time you gave consent. The page that linked you to the file (the referrer), if your browser sends it. Your country, estimated from your connection. We do not collect anything else through the form.

Who is responsible. The website owner (our customer) is the controller of this information. They decide to collect it and what to do with it. DocBeam is the processor: we collect and store it on their behalf and under their instructions.

Why we collect it. Only to deliver it to that website owner, through their DocBeam dashboard, exports and summary emails. The form states the site you are sharing your details with, and the consent box is never ticked for you. DocBeam does not email you, does not add you to any list, does not sell your details, and does not use them for its own purposes.

How long we keep it. Until the website owner deletes it. It is also deleted automatically when they delete that document, and it is removed along with their DocBeam Library or account under the same windows described in Data Retention below.

Your rights. Because the website owner is the controller, please send requests to access, correct or delete your details to them first. They can see what you submitted. If you cannot reach them, or they do not respond, email [email protected] and we will pass your request on and help them act on it.

Cookie. After you submit the form, a cookie is set for that one file, so you are not asked again for 30 days. See Cookies.

Legal Basis for Processing (GDPR)

If you are in the European Economic Area or United Kingdom, we process your data under the following legal bases:

Purpose	Legal Basis
Providing the service	Contract performance
Billing and payments	Contract performance
Security and abuse prevention	Legitimate interest
Product improvement (aggregate)	Legitimate interest
Legal and tax compliance	Legal obligation
Marketing communications	Consent

Third-Party Services

We work with a small number of sub-processors to operate DocBeam. We do not use advertising networks or social media tracking pixels. We use a single privacy-respecting product-analytics provider (PostHog, hosted in the EU) for anonymized usage measurement and error tracking — see the Product Analytics section below.

Sub-processor	Purpose	Location	Privacy Policy
Cloudflare Inc	File storage (R2), CDN, compute (Workers), database (D1)	Global (US HQ)	cloudflare.com/privacypolicy
Stripe Inc	Payment processing	US	stripe.com/privacy
Webflow Inc	Authentication (OAuth) for the Designer extension	US	webflow.com/legal/privacy
Clerk Inc	Authentication and identity management for the web dashboard	US	clerk.com/privacy
Resend Inc	Transactional email delivery	US	resend.com/privacy
PostHog Inc	Anonymized product-usage analytics and error tracking	EU (Frankfurt)	posthog.com/privacy
Google LLC (YouTube)	Hosts our product walkthrough video — only if you press play	US	policies.google.com/privacy

The walkthrough video on our home page is hosted on YouTube, because the Webflow Marketplace requires listing videos to be hosted there. Nothing is requested from Google, and no cookie is set by them, unless you click play. Until you do, you are looking at a still image served from our own domain. If you do press play, the video is loaded from youtube-nocookie.com, YouTube's reduced-tracking domain, and Google's privacy policy applies from that point. If you would rather not load it at all, the video is also on YouTube directly.

Product Analytics

We use PostHog, hosted in the European Union (Frankfurt), to understand how DocBeam is used so we can improve it. This covers our web dashboard, our Webflow Designer extension, and this landing page.

The Designer extension bundles no third-party analytics SDK and no tracking key, and talks to no analytics vendor directly. Two product events are sent from the extension to our own API over authenticated HTTPS, and forwarded to PostHog server-side:

• Link inserted — a counter recording that a DocBeam link was placed on the canvas, so we can measure whether new users reach a working setup.
• Crash report — if the extension throws, the error name, message, and stack trace (both length-capped), so we can fix it. We do not attach your document contents, file names, or page content.

This analytics is anonymized by design:

• We do not collect personal data through analytics — no names, no email addresses, no file contents.
• Events are keyed to opaque identifiers only (an internal site or account id), never to your email or personal details.
• Autocapture and session recording are turned off — we record only a small set of explicit product events (for example, that the dashboard or extension was opened).
• On the landing page we collect anonymous page views and the referrer/UTM parameters of your first visit, to understand where visitors come from.

We rely on legitimate interest (improving the product) as the legal basis for this anonymized analytics. A self-serve opt-out control is coming in a future release; in the meantime, if you would like us to exclude your activity, email [email protected].

Data Retention

• Account data: Retained for the life of your account, plus 30 days after closure.
• Billing records: Retained for 7 years to satisfy tax compliance requirements.
• Uploaded documents: When a DocBeam Library is deleted, files enter a 90-day grace period before permanent deletion. You may restore the Library and recover your files at any time during this window.
• Leads from gated downloads: Kept until you delete them. Deleting a document deletes its leads. Otherwise they are removed with the Library or the account, under the two windows above.
• Server logs: Retained for 90 days.

Your Rights

You can access, correct, delete, and export your files at any time from within the extension. You may also withdraw consent for any processing based on consent.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

If you are in the EEA or UK, you have rights under GDPR/UK GDPR including access, rectification, erasure, restriction, portability, and objection. We will honour these to the best of our ability. If you have unresolved concerns, you may contact your local data protection authority (DPA).

Webflow OAuth and Token Revocation

You can disconnect DocBeam from your Webflow account at any time via your Webflow account’s app settings. When you do, we immediately invalidate your access token and cease any further data collection from Webflow on your behalf.

Files you have already uploaded to DocBeam remain in storage until you delete them or close your account. Revoking OAuth access does not automatically delete your stored files.

Cookies

DocBeam uses minimal session cookies for authentication purposes only. We do not use advertising cookies, social media pixels, or third-party tracking cookies of any kind.

One more is set on file links, not on this site. When a customer requires an email before a download, and a visitor submits the form, the file’s link sets a signed cookie that only that file’s address can read. It lasts 30 days and exists only so the visitor is not asked again for the same file. It is not used for tracking or advertising, and it is not shared with anyone. See Lead Capture.

There is one thing you can opt into: if you press play on the walkthrough video on our home page, YouTube is loaded from youtube-nocookie.com and may use storage on your device from that moment, under Google’s privacy policy. Nothing from Google is loaded, and no such storage is used, unless you click. We set nothing on their behalf either way.

Data Security

Files stored in Cloudflare R2 are encrypted at rest. All data in transit is protected via HTTPS. Access to your files and account data requires valid authentication tokens. We apply access controls to limit who on our team can access production data.

That said, no system is perfectly secure. We work hard to protect your data, but we cannot guarantee absolute security. If you discover a vulnerability, please report it to [email protected] — we take security reports seriously.

Breach Notification

In the event of a confirmed data breach, we will notify affected users and relevant supervisory authorities within 72 hours, in accordance with GDPR and the Australian Notifiable Data Breaches (NDB) scheme.

Australian Privacy Act

DocBeam complies with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). The Notifiable Data Breaches scheme applies to our operations. If you wish to make a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

International Data Transfers

Our sub-processors Cloudflare and Stripe process data globally, including in the United States. Where required by applicable law, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards to govern international transfers of personal data.

Children

DocBeam is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us at [email protected] and we will delete it promptly.

Changes to This Policy

When we update this policy, we will update the effective date at the top. For material changes, we will email active users at least 30 days before the changes take effect. Continued use of DocBeam after that period constitutes acceptance of the updated policy.

Contact

Questions about this policy? Email us at [email protected].

DocBeam is a product of Honest Fox. docbeam.io

Last updated: October 2026