Docket

Privacy policy

Docket is operated by Baan Software. Last updated August 2026.

The short version

  • Your documents are stored in your own Google Drive, not on our servers.
  • We request the narrowest Google Drive permission that exists, and it cannot see files we did not create.
  • We keep the details we read off a document — vendor, total, date, category — so that spend reports work.
  • We never sell your data, and your documents are never used to train an AI model.

What we access in your Google Drive

We request a single Google Drive scope, drive.file. It grants access only to files and folders this application itself creates. It does not allow us to list, read, open or search anything else in your Drive, including documents you upload yourself, files shared with you, or anything that was there before you connected.

We use it to create the folder you name during setup, create the month and category folders inside it, and write your documents and CSV exports into them.

What happens to a document you send

  1. WhatsApp delivers it to us through Twilio, our messaging provider.
  2. The file is sent to Google's Gemini API to be read: its category, vendor, total, currency and the date printed on it.
  3. It is uploaded to your Google Drive.
  4. Our copy is discarded. We do not retain the file itself.

What we store

  • Your WhatsApp phone number, which is how we recognise you.
  • Your Google OAuth tokens, so documents can be filed without asking you to sign in every time. These are held only to write to your Drive.
  • The name of your destination folder and your subscription status.
  • For each document: category, filename, vendor, total, currency, the date on the document and the date it was received. This ledger is what report and export read from. It does not include the document itself.
  • A monthly count of documents filed, to enforce your plan's limit.

Who else processes your data

  • Twilio — delivers WhatsApp messages and media to and from you.
  • Google (Gemini API) — reads the document. Content sent to the API is not used to train Google's models under its paid terms.
  • Google Drive — your own account, where documents are stored.
  • Stripe — takes payment. We never see or store your card details.
  • Amazon Web Services — hosts the service.

We do not sell personal data, and we do not share it with anyone beyond the processors above.

Cookies and tracking

This website sets no cookies and includes no analytics, advertising or third-party scripts of any kind. The setup page uses no cookies either; it identifies your session from the link you were sent.

Revoking access and deleting your data

Send logout to the bot to disconnect Google Drive; we delete the stored tokens. You can also revoke access at any time from your Google Account's security settings.

To delete your account and the ledger we hold, email docket@baansoftware.com from, or naming, the phone number you use with the bot. Documents already written to your Google Drive belong to you and are unaffected — we could not delete them if we wanted to.

Your rights

Depending on where you live you may have rights to access, correct, export or erase the personal data we hold. Email docket@baansoftware.com and we will action it.

Children

This service is not intended for anyone under 16 and we do not knowingly collect their data.

Changes

If this policy changes materially we will update the date at the top of this page before the change takes effect.

Contact

Baan Software — docket@baansoftware.com