Data Privacy Policy

1. Purpose

This policy describes how Docwright Software LLC ("DocWright," "we," "us") handles data in connection with the DocWright software application. It is intended for institutional customers, IT departments, and accessibility coordinators evaluating DocWright for deployment.

2. How DocWright Processes Data

DocWright is a locally installed desktop application. Documents (DOCX, PPTX, and PDF files) are processed entirely on the end user's own machine. There is no central DocWright server, no shared infrastructure, and no document upload to any DocWright-controlled system at any point during normal use.

2.1 What Never Leaves the Local Machine

• The full content of any document processed by DocWright, including any student, faculty, or institutional data it contains
• File metadata (author, institution name, file paths, etc.)

2.2 What Is Transmitted, and to Whom

Two limited, specific data flows occur:

• License validation: On each application launch, the software sends a license key (no document content) to DocWright's licensing backend, hosted on Vercel, to confirm the license is active. This confirms institutional entitlement only.
• Optional AI image description: If a user opts into the AI-assisted alt-text feature, individual cropped images extracted from a document (e.g., a chart, figure, or equation) are sent directly to the Anthropic Claude API for description generation. The surrounding document text, file, and any other content are never included in this transmission. This feature uses an Anthropic API key supplied and controlled directly by the institution — DocWright does not provide, proxy, or have visibility into this key, and does not receive the images or descriptions itself.

3. Data Retention

DocWright does not retain document content, student data, or institutional data on any DocWright-controlled system, because such data is never transmitted to DocWright in the first place. The only data Docwright Software LLC retains centrally is administrative license information: institution name, license key, tier, term, and contact details necessary to administer the license relationship.

4. Third-Party Sub-Processors

DocWright relies on the following third-party services in connection with the limited data flows described above:

• Vercel — hosts the license validation backend (license key only; no document data).
• Anthropic (Claude API) — used only for the optional AI image-description feature, under the institution's own API key and agreement with Anthropic. DocWright recommends institutions review Anthropic's commercial API terms directly, particularly regarding data retention, for documents that may contain student work or personally identifiable information.

5. FERPA and Institutional Data Protection

Because document content is never transmitted to or stored by DocWright, and the optional AI feature operates under the institution's own Anthropic account, DocWright's architecture is designed to minimize exposure under FERPA and similar data protection requirements. The AI feature can be disabled entirely at the institution's discretion; all other accessibility remediation functions operate with no network transmission of any kind.

6. Security of License and Configuration Data

The license key and (if configured) the institution's Anthropic API key are stored locally in a configuration file on each installed machine, encrypted at rest using the operating system's built-in data protection (Windows DPAPI, scoped to the logged-in user account). License validation and AI-feature requests are transmitted via HTTPS. Institutions are responsible for the physical and account-level security of machines on which DocWright is installed, consistent with their own device management policies.

7. Changes to This Policy

Docwright Software LLC may update this policy as the product or company evolves. Material changes affecting how institutional or student data is handled will be communicated to licensed institutions directly.

8. Contact

Questions about this policy or DocWright's data practices may be directed to: