Privacy and data handling

shipdoc is a student prototype built for the Averis × Monash Hackathon 2026. It is not an Averis product. The authoritative policy is the one inside the app: Privacy Policy, Terms of Use, Cookie Policy and Accessibility statement. This page explains the same facts from a technical point of view.

What is processed

Data	Where it comes from	What happens to it
The hackathon dataset (emails and attachments)	Provided by the organisers. It is synthetic: fictional senders, real-looking company names	Read by the pipeline and served by the API
Results (category, status, evidence lines)	Generated by shipdoc	Stored by the API
A reviewer's name on an override	Typed by the reviewer. It is optional and defaults to "reviewer"	Stored with the result. It is the only personal data collected from real people in the demo
Emails you upload or import from a mailbox	You	Processed by the pipeline; their attachments are cached on the server so they can be read
Mailbox credentials (host, address, App Password)	You, when you connect a mailbox	Used to read the folder (read-only). Not written to disk or logs
Theme, language and filters	Your browser	Stored in your browser's localStorage only

What is not collected

• No analytics, advertising, tracking pixels or third-party scripts.
• No cookies. localStorage holds interface preferences only.
• No third-party fonts or embeds: fonts are self-hosted, so no request goes to a font CDN.

Using real email

The public demo is shared

On the public deployment every visitor sees the same inbox, including anything uploaded or imported, and a connected mailbox stays connected (its credentials held in the server's memory) until someone disconnects it. Use a throwaway mailbox with an App Password, and do not upload real customer emails. Private per-visitor workspaces are on the roadmap. For real mail, run your own copy (locally or on AWS).

Pointing shipdoc at a real inbox means processing names, phone numbers and business addresses of shipping staff and customers. Before doing that for an organisation you would need a processing agreement, a notice to the affected people, and a review of where the data is stored. Malaysia's Personal Data Protection Act 2010 (as amended) applies first, and the GDPR too when counterparties are in the EU. Nobody has reviewed shipdoc as legal advice: have counsel check it for anything beyond the hackathon.

AI processing

With no AI provider configured, nothing leaves the server. With SDOC_LLM_PROVIDER set, the text of documents and emails the rules could not read is sent to that provider: Google (Gemini), Anthropic, or Amazon Bedrock. Bedrock keeps data in the AWS region you choose. The comparison itself never uses AI, and the tool recommends while a person decides.

Access requests

The Privacy Policy in the app lists the contact for questions and data access requests.