Privacy policy

THIME Holding OÜ (VAT ID EE102715730), Kotkapoja tn 2a-10, 10615 Tallinn, Estonia, provides ShowMeTheDocs. We act in two roles:

• Controller for the data of the people who sign up and pay (account and billing data), for website visitors, and for security and abuse prevention.
• Processor for the vendor contact details and documents that our customers enter. For that data the customer decides why and how it is used, and our data processing agreement applies. If you are a vendor and want to see, correct or delete your data, ask the business that invited you; we will help them respond.

Privacy requests can be sent through our contact form. Please name your organization and describe the request.

• Account data (organization name, your name, work email, a hashed password, role, sign-in times). Purpose: create and secure your account. Legal basis: contract.
• Vendor contact details (company name, contact email, trade, notes) and compliance documents (certificates and licenses you or your vendors upload, with requirement, coverage amount and expiry date). Purpose: compliance tracking and reminder emails for the customer. Where automatic reading is switched on for your account, the images or text of an uploaded certificate, or a question you type in the in-app assistant, are sent to an AI model provider listed below, only to produce suggestions that you confirm; they are not used by us to train models. We act as processor.
• Activity records (who uploaded, edited, exported or changed roles, and when). Purpose: audit trail for the customer and security. Passwords and access tokens are never written to it. Legal basis: contract and our legitimate interest in security.
• Billing data (plan, subscription status, invoices, billing contact, VAT ID). Card details are entered with and held by Stripe; we never see or store card numbers. Legal basis: contract and legal obligation (accounting and tax).
• Emails and support (messages you send us, delivery and bounce status of reminder emails). Purpose: support and email deliverability. Legal basis: contract and legitimate interest.
• Technical data (IP address, browser type, request logs and error reports). Purpose: run, secure and fix the service. Legal basis: legitimate interest.

We do not sell personal data, we do not use it for advertising, and we do not use customer data to train AI models.

Vendors do not create an account. A vendor who opens their portal link can see their own requirement statuses and upload documents. The link is a private key to that vendor's page, so anyone holding it can use it. The customer that invited the vendor is responsible for sharing links only with the vendor's company, and a link can be replaced at any time. Reminder emails contain an opt-out link, and an opted-out address is not emailed again. We record the time a vendor last opened its portal link and last uploaded a document, so the customer can see whether a vendor has engaged; we do not record the vendor's IP address or device.

We use only the cookies needed to keep you signed in and to protect forms against forgery. We do not use advertising or cross-site tracking cookies.

• Account, vendor and document data: while your account is open. When you delete the account we delete it from live systems within 30 days, and it leaves backups within 35 days.
• Activity records: kept with the account and deleted with it.
• Billing and invoice records: for the period that accounting and tax law requires (in Estonia, seven years).
• Support messages: for as long as needed to handle the request and show what was done, then deleted or anonymized.
• Security and error logs: kept only as long as needed for security and fixing problems.

You can delete individual vendors in the app at any time, and you can ask us to delete your whole account from your account settings or through the contact form.

We use a small number of providers to run the service. Each is bound by a data processing agreement.

• Amazon Web Services (hosting, file storage, email sending and bounce notification, DNS, and, where that option is used, AI model processing through Amazon Bedrock), United States (us-east-1).
• Anthropic, PBC (AI model processing: reading uploaded certificate images and answering help questions in the in-app assistant, only for accounts where those features are switched on), United States.
• OpenAI, L.L.C. and affiliates (the same AI model processing, where that alternative provider is used instead of or besides Anthropic), United States.
• Stripe (payment processing and invoicing), Stripe Payments Europe, Ltd. and affiliates.

The current list is kept in the DPA. We may also disclose data where the law requires, to protect our rights, or in a business sale, with notice to you.

Our servers are in the United States and we are based in Estonia. Where personal data of people in the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's standard contractual clauses, as set out in our DPA and in our providers' own agreements.

Each organization's records and files are kept separate. Data is encrypted in transit and at rest. Sign-ins expire, password reset links work once, uploaded files are checked on arrival, access by our staff requires a second factor and is logged, and we take nightly backups. No system is perfectly secure; if a breach affects you we will tell you as described in the DPA. A plain-language overview is on our security page.

If you are in the EU, EEA, UK or Switzerland, you have the right to access your personal data, have it corrected or erased, restrict or object to its processing, receive it in a portable format, and withdraw consent where we rely on it. You can also complain to your data protection authority; in Estonia that is the Andmekaitse Inspektsioon (www.aki.ee). For vendor data that a customer entered, please contact that customer first.

California and other US states. We do not sell or share personal information as those terms are defined in state privacy laws. For customer data we act as a service provider. You may ask us to access, correct or delete personal information about you, and we will not discriminate against you for doing so.

The service is for businesses and is not directed at anyone under 16. We do not knowingly collect data from children.

We will update this page when our practices change and email account owners about material changes. Questions about your data can be sent through our contact form.