Last updated: June 3, 2026
Docs to Design converts Word documents (.docx) into professionally formatted design layouts. Your documents are processed entirely on your device. File contents are never uploaded to our servers, and we do not use any third-party AI or LLM providers to process your documents.
To use Docs to Design, you activate your account with an email address. We send a one-time verification code (OTP) to confirm your email. This is the only personal data we collect.
| Data | Where Stored | Purpose | Legal Basis (GDPR) |
|---|---|---|---|
| Email address | Supabase (encrypted) | Account activation, usage tracking | Contractual necessity (Art. 6(1)(b)) |
| Import count | Supabase | Enforce free tier limits | Contractual necessity |
| Platform type | Supabase | Analytics (Figma vs InDesign) | Legitimate interest (Art. 6(1)(f)) |
| Figma user ID | Local (clientStorage) | Link session to account | Contractual necessity |
| Auth tokens | Local (clientStorage) | Maintain login session | Contractual necessity |
| Logo image | Local (localStorage) | Persist uploaded logo | Contractual necessity |
| Marketing consent | Supabase | Product updates (opt-in) | Explicit consent (Art. 6(1)(a)) |
| Email address (waitlist) | Resend Audience | Notify you when Pro tier launches; deliver waitlist-member 50% off year-one discount | Explicit consent (Art. 6(1)(a)) |
We do not use any AI or LLM providers to process your documents. All document processing — layout analysis, typography extraction, table formatting — happens locally on your device. Your documents are never sent to Anthropic, OpenAI, Google, Xai, or any other AI provider. We do not use your documents to train any AI models or machine learning systems.
Your uploaded documents are not used to train AI models. We do not share your documents with any AI provider under terms that permit training or fine-tuning. The LLM providers we may use for other parts of our service (if any) never see your document contents.
The docstodesign.com website uses Google Analytics (GA4) to understand how visitors find and use the site. This tracking only activates after you consent via the cookie banner. GA4 collects anonymized usage data (pages viewed, referral source, device type). It does not collect personal information. You can opt out at any time by declining cookies or using a browser ad blocker.
Your account data is stored on Supabase (supabase.com), which provides:
Payment Processing: LemonSqueezy (Lemon Squeezy LLC) processes all Pro tier payments on our behalf. LemonSqueezy receives your billing email, payment method, and purchase history. LemonSqueezy's Privacy Policy (linked above) applies to all payment data.
Email List Management: Resend Inc. manages our Pro-launch notification email list. When you join our waitlist, your email address is stored in a Resend Audience. Resend handles email delivery only and does not use your email for marketing or any other purpose. Resend's Privacy Policy (linked above) applies to your data.
Font Delivery: Google Fonts (Google LLC) serves the Space Grotesk typeface used across the docstodesign.com website. When fonts load, your IP address is briefly transmitted to Google's CDN (fonts.googleapis.com and fonts.gstatic.com). No cookies are set and Google's stated policy is to not use Fonts API data for advertising. Google's Privacy Policy (linked above) applies to font fetch logs.
Site Analytics Beacon: Cloudflare Insights records anonymous page-load performance metrics for the docstodesign.com website. The beacon receives request metadata only (URL, timing, country-level location) and does not set tracking cookies or identify individual users. Cloudflare's Privacy Policy (linked above) applies.
Docs to Design runs as a plugin on Figma and Canva. Each platform provides user identity and session management via their SDK.
When you use the Figma plugin, Figma provides your user ID via the Figma Apps SDK. This ID is stored locally in your browser for the duration of your session and is used only to link the generated design output back to your Figma account. It is not transmitted to our servers and is automatically cleared when you close the plugin or log out.
When you use the Canva plugin, Canva provides your user ID via the Canva Apps SDK. This ID is stored locally in your browser for the duration of your session and is used only to link the generated design output back to your Canva account. It is not transmitted to our servers and is automatically cleared when you close the plugin or log out.
We do not store Canva OAuth tokens or session credentials on your device. All authentication is handled entirely by the Canva Apps SDK. The plugin reads design instructions and writes the completed design exclusively through the SDK's secure interface.
When the Canva plugin completes a design, it writes the result directly to your Canva workspace as a new file. This design exists in your Canva account only. Docs to Design does not retain, store, or access the design after it is delivered to your workspace.
You can view your account data in the plugin's Settings panel. For a full data export, contact us.
You can delete your account from the plugin's Settings panel. This permanently removes your email, usage history, and authentication tokens. Deletion is immediate and irreversible.
Contact us to correct any inaccurate data.
Request a machine-readable export of your data by emailing us.
We do not sell your personal information. We have no advertising partners and do not share data for commercial purposes.
| Data | Retention |
|---|---|
| Account record | Until you delete your account |
| Usage logs | 12 months, then automatically purged |
| Auth tokens (local) | Until you sign out or uninstall |
| Logo data (local) | Until you clear browser data or uninstall |
Docs to Design is not directed at children under 13. We do not knowingly collect data from children under 13. Users aged 13+ may use the Plugin; users under the age of majority in their jurisdiction may require parental consent.
Data Controller: MZM Labs Inc. (Alberta, Canada) is the data controller for your account information (email, usage history, authentication).
Legal Basis: We process your data under:
Your Rights: You have the right to access, correct, delete, and export your data. See the "Your Rights" section below. You also have the right to lodge a complaint with a supervisory authority (e.g., UK ICO, EU EDPB).
Data Transfer: Your data is stored in North America (Supabase default region). We rely on Standard Contractual Clauses for international transfers.
Jurisdiction: MZM Labs Inc. is incorporated in Alberta, Canada, and is subject to:
Your Rights: Under PIPEDA and PIPA, you have the right to:
Regulators:
We may update this policy as features evolve. Updates will be noted with a revised "Last updated" date. Material changes will be communicated through the plugin's update notes.
For privacy questions or data requests:
MZM Labs Inc.