Last updated: July 2026 — XDinamic Engineering, Madrid, Spain
XDinamic Engineering ("we", "us") operates DoXroute. Contact: info@doxroute.com
Account data: email, name, hashed password. Usage data: documents processed (count), API key metadata, extraction results (retained 30 days then auto-deleted). Technical data: IP addresses in server logs (retained 14 days).
To provide the document extraction service, authenticate your account, enforce plan limits, send transactional emails, and improve our service.
Contract performance (service delivery), legitimate interest (security, fraud prevention), and consent (optional communications).
Account data: until you delete your account. Extraction results: 30 days (auto-cleaned). Server logs: 14 days. Database backups: 14 days.
Anthropic Claude API (document extraction, US-based). Infrastructure provider (Contabo, EU). No data is sold to third parties.
Under GDPR you have the right to: access your data (Settings > Export Data), rectify your data (Settings), delete your account and all data (Settings > Delete Account), restrict processing, data portability (JSON export), and object to processing. To exercise these rights, use the self-service tools in Settings or contact info@doxroute.com.
Passwords are bcrypt-hashed. API keys are hashed with prefix-only storage. All traffic is HTTPS/TLS. JWT tokens are httpOnly+Secure+SameSite. Rate limiting and brute-force protection are active.
We use one essential cookie (dxr_token) for authentication. No tracking or analytics cookies. No third-party cookies.
Document content is sent to Anthropic's API (US) for extraction. Anthropic processes data under their DPA and does not use customer data for training.
We may update this policy. Changes will be posted on this page with an updated date.
XDinamic Engineering, Madrid, Spain. Email: info@doxroute.com