Last updated: October 9, 2026
DocuSmartly is a free online PDF tool suite, made in India. It is built and run by its founder, Pallavi Varshney, from Aligarh, Uttar Pradesh, India. Our website is https://docusmartly.com. For privacy enquiries, write to docusmartlyhelp@gmail.com.
Where your data is processed. Most of our tools run entirely in your browser, so your file never reaches any server. The few tools marked Server or AI send your file to our backend, which is hosted by Railway on servers in the United States, and AI features use the providers listed below. Being made in India does not mean your data is stored in India; this section tells you exactly where it goes.
Grievance Officer. In line with the Information Technology Act, 2000 and the rules under it, and the Digital Personal Data Protection Act, 2023, you can raise any concern about your data with our Grievance Officer: Pallavi Varshney, Founder, DocuSmartly, Aligarh, Uttar Pradesh, India — docusmartlyhelp@gmail.com. We aim to acknowledge every grievance within 48 hours and resolve it within 30 days.
We don't make blanket "everything stays in your browser" claims because that wouldn't be accurate for every tool. Here's the honest breakdown:
| Tool | Where processing happens | What we send |
|---|---|---|
| Split, Merge, Compress, Edit, Sign, Images to PDF, PDF to TIFF | 100% in your browser | Nothing — your file never leaves your device. |
| Word to PDF, PowerPoint to PDF, Excel to PDF, Protect PDF | On our server (LibreOffice / qpdf) | The file is uploaded, converted in memory, the result is returned to you, and the source file is discarded immediately. We do not log or back up uploaded files. |
| OCR PDF / Bulk Invoice Extraction | Text recognition in your browser; saved batches on our server | The OCR itself runs in your browser (Tesseract.js) — your scan isn't uploaded just to read it. If you save or extract a batch (multi-document results, templates, Excel export), the document and its recognised text are uploaded, stored, and automatically deleted within 24 hours. Never logged, never backed up. Aadhaar and PAN cards are read entirely on your device and are never sent to any AI provider — Section 3.4 sets out exactly what that does and does not mean. |
| CV Maker (form & templates) | In your browser | Your CV form data is saved only in your browser's localStorage. The PDF is generated client-side. Nothing is sent to our server unless you trigger an AI feature below. |
| Resume Import (CV Maker) | Server + Groq AI | Your uploaded PDF/DOCX is sent to our server, the text is extracted in memory and forwarded to Groq for AI parsing. The original file is discarded after the request; only the parsed structured fields are returned to your browser. |
| CV Tailor (JD-based) | Server + Google Gemini | The Job Description and CV text you provide are sent to our server and forwarded to Google Gemini for analysis. We don't store the inputs after the request completes. |
| Smart Extract (AI field extraction) | Server + Google Gemini (Groq fallback) | Your PDF text is sent to our server and forwarded to Google Gemini (or Groq as an automatic fallback) to read the fields you request. If you switch on “Also read the page images”, a rendered picture of each selected page (up to 4) is sent alongside the text so that table and column structure survives — this is off by default. The file is held in memory only — no copies are stored on disk, and we do not log document contents. Documents that look like an Aadhaar or PAN card are refused before anything is sent to an AI provider (see Section 3.4). |
| Pallavi AI (intent assistant) | Server + Groq AI | Only the natural-language command you type (e.g. "compress this PDF") is sent to Groq — never the file itself. Used to choose the right tool and parameters. |
We rely on contractual and policy commitments from our processors. Per their public privacy policies and API terms at the time of writing:
These providers may temporarily store request data for abuse prevention and service operation per their own retention schedules. We do not control those independent retention periods.
Aadhaar and PAN cards are handled differently from every other document, and deliberately so. Being precise about this matters more than making it sound impressive, so here is exactly what happens:
We take this position because Indian law places specific handling restrictions on Aadhaar in particular, and because an identity number is the one field where a leak cannot be undone by changing a password. We would rather refuse a document we could have processed than send one we should not have.
When Smart Extract reads a discharge summary, prescription, or similar clinical document, the result is assistive only. The result — drug names, strengths, frequencies, diagnoses — carries an explicit note that a person must check the values against the source document before they are used or acted on. The model is instructed to transcribe exactly what is printed and never to expand an abbreviation, correct an apparent misspelling, convert a unit, or infer a missing dose. Nothing from a medical document is auto-accepted anywhere in the product.
This is not medical advice and is not a substitute for reading the original document.
Account creation is optional. All free tools work without an account. If you do create one (required to buy or subscribe to premium CV templates), we collect:
Sign in with Google (optional): Instead of a password, you can sign in with your Google account. When you do, Google sends us a verified token from which we read only your email address and name to create or access your account — we never receive or store your Google password. This is entirely optional; email-and-password sign-in remains available. Google's handling of the sign-in is governed by Google's own Privacy Policy.
Payments are processed exclusively through Razorpay, a PCI-DSS Level 1 compliant payment gateway. We never see, store, or have access to your card numbers, CVV, bank account details, or UPI IDs. Razorpay handles all card data directly. We only receive a transaction reference (payment ID and signature) so we can mark your purchase as complete.
dsm_auth): A signed httpOnly cookie issued only after you sign in. Used to keep you logged in for 30 days. Not accessible to JavaScript.The companies below process some of your data on our behalf, strictly to provide the features described above:
Whether you're in India (Digital Personal Data Protection Act, 2023), the EU (GDPR), or anywhere else, you have the right to:
Our service is not intended for children under 13 (under 18 for users in jurisdictions where the Digital Personal Data Protection Act, 2023 requires parental consent for minors). We do not knowingly collect personal information from children. If you believe a child has provided us personal data, contact us and we will delete it.
Our backend is hosted by Railway in the United States, and some of our other service providers (Groq, Google) also operate servers outside India. By using our AI features, you consent to your input data being transferred to and processed in those jurisdictions, governed by the providers' own contractual safeguards (Standard Contractual Clauses where applicable).
We use industry-standard safeguards, including HTTPS for all traffic, bcrypt password hashing, httpOnly cookies for authentication, and least-privilege access to our database. No system can guarantee absolute security; if we ever suffer a breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law.
We may update this policy as our tools evolve. The "Last updated" date at the top reflects the most recent revision. Material changes (e.g. adding a new sub-processor or AI provider) will be highlighted by a banner notice on the site for at least 14 days.
For any privacy question, complaint, or data request, email docusmartlyhelp@gmail.com. We aim to respond within 7 business days.