Privacy policy

For account, billing and website data we are the controller. For the documents you upload and the results extracted from them (“customer content”) we act as a processor on behalf of your organization, which decides what is uploaded and why. A data processing agreement is available on request.

• Account data: name, email address, company name, password hash, workspace roles and settings.
• Billing data: plan, usage (pages processed) and billing contact; card details are handled by our payment provider and never stored by us.
• Customer content: documents you upload by browser, API or integration, rendered page images, extracted values, review corrections and audit records.
• Technical data: IP address, browser type, request logs and security events, used to operate and protect the service.
• Messages you send us through the contact form or by email.
• Analytics data from optional cookies, only if you accept them (see Cookies).

• To provide the service: classify and extract your documents, show results, deliver them to your systems and support human review.
• To secure the service: authentication, malware scanning of uploads, rate limiting, abuse prevention and audit logging.
• To bill usage and to communicate about your account, including service and security notices.
• To answer your questions and requests.

We do not use customer content to train AI models, and we do not sell personal data or customer content. Using your reviewed corrections to improve our shared, ready-made document types is opt-in per workspace and off by default.

To extract data we send document pages and text to the AI provider configured for your workspace (currently OpenAI or Anthropic). We use their business APIs with settings that exclude your data from model training, and zero-retention options where offered. Workspaces can restrict which providers may process their documents.

We share data only with providers that help us run the service:

• Vercel — web application and API hosting.
• Prisma Postgres — database.
• Our S3-compatible object storage provider — storage of uploaded files.
• OpenAI and Anthropic — AI processing, when configured for your workspace.
• Our email delivery and payment providers — account emails and billing.

The current list is on our security page.

• Source documents are deleted 30 days after upload by default.
• Extraction results are deleted one year after processing by default.
• Workspace administrators can change these periods and delete documents at any time.
• Account data is kept while your account is active and deleted or anonymized after closure, except where the law requires us to keep records (for example invoices).
• Security logs are kept for a limited period to investigate incidents.

Data is encrypted in transit and at rest; credentials are hashed or encrypted; access is role-based and audited. Details are on our security page.

We use strictly necessary storage to keep you signed in (an HttpOnly session cookie) and to remember your cookie choice. These are always on.

With your consent we also load Google Analytics, the Meta pixel and the LinkedIn Insight tag to understand visits to our website. They are not loaded until you click “Accept”, and you can change your choice at any time with “Cookie settings” in the footer.

Depending on where you live you may have the right to access, correct, export or delete your personal data, and to object to or restrict processing. For customer content, please contact your organization first; we will help them respond. Use our contact form to make a request. You may also complain to your data protection authority.

Our providers may process data outside your country, including in the United States. Where required we rely on appropriate safeguards such as standard contractual clauses.

We will post changes here and update the date above; material changes will be announced in advance. Questions? Use our contact form.