Privacy notice
This is the notice in force for this website and this service, not legal advice. It says what we hold, why we are allowed to hold it, how long it stays, and what you can make us do about it.
In force from 2026-08-29 · reviewed with the security page · plain-language draft
1. Who is responsible
The controller for the personal data described in this notice is [registered legal entity name], registered in [country of incorporation] under company number [company registration number], at [registered postal address]. For anything in this notice, write to [privacy contact email address] or use the contact form.
We have not appointed a data protection officer. We are not required to, and saying we had one when the same person answers every email would be a decoration rather than a safeguard.
2. Two roles, and the difference matters
For the documents you send us, you are the controller and we are the processor. Your invoices and contracts contain other people's personal data — suppliers, signatories, customers — and we process it on your instructions, which are the API calls you make. We do not decide what is in those documents, we do not use them for our own purposes, and we do not keep them.
For your account, we are the controller. Your email address, your API keys, your sign-in activity and your billing details are ours to justify, and the table below does that.
3. What we hold, and why
Every row is a category that exists in the database or the logs today. Article references are to the GDPR.
| Category | What is in it | Lawful basis | Kept for |
|---|---|---|---|
| Account | Email address, a hash of your password, plan, page allowance, your retention setting, when the account was created and last signed in. | Art. 6(1)(b) — performing the contract | Until you close the account, which erases it. |
| Sessions | A hash of the session token, a salted hash of the IP address it was created from, the browser's user-agent string, and an expiry. | Art. 6(1)(b) and 6(1)(f) — keeping the signed-in surface secure | Expires 14 days after sign-in; revoked immediately when you sign out or change your password. See the housekeeping note below. |
| API keys | The name you gave the key, its first twelve characters, a SHA-256 hash of the whole key, and the created, last-used and revoked timestamps. Never the key itself. | Art. 6(1)(b) | Until you revoke it; revoked keys stay listed so you can see what was withdrawn, and go with the account. |
| Sign-in attempts | A hash of the address that was tried, a salted hash of the IP, whether it succeeded, and when. No address and no IP in the clear. | Art. 6(1)(f) — stopping password guessing | Used for a 15-minute lockout window. See the housekeeping note below. |
| Documents you send | The PDF itself, while it is being parsed. | Processed for you, on your instructions (Art. 28) | Deleted from our disk when the job ends — success or failure, in the same code path, so a failed parse cannot leave one behind. |
| Extracted text | The text read out of your pages. | Processed for you, on your instructions | Not stored at all unless storage is switched on for the deployment. Off by default. |
| Job records | Filename, page count, which tier read each page, confidence, duration, cost, and the validation verdict. Not the document. | Art. 6(1)(b) | Until you delete the document from your dashboard, or close the account. |
| Contact form | The email address, company, role and notes you type, plus a hash of your IP and your user-agent string. | Art. 6(1)(b) — steps taken at your request before a contract — and 6(1)(f) | Until you ask us to delete it, which we do on request. |
| Web server log | Timestamp, IP address, request path, status code, user-agent. Written by the web server in front of the application. | Art. 6(1)(f) — running and defending the service | Rotated by size: five files of 10 MB. How many days that is depends on traffic, so we will not quote you a number we do not control. |
| Database backups | A nightly encrypted dump, which contains whatever the database contained that night. | Art. 6(1)(f) — not losing your data | 14 days, then the backup is destroyed. |
Housekeeping we have not automated yet. Two of the rows above have no scheduled purge running: expired session rows and sign-in-attempt rows accumulate rather than being cleared on a timer. Both hold hashes rather than addresses, and neither is used for anything once its window has passed — but "kept until we get to it" is the honest description, and it is what this notice will say until the job is scheduled.
4. What we do not do
- We do not train models on your documents. We do not train models at all — the pipeline is a PDF text layer, local OCR, and a hosted model for the pages neither can read.
- We do not sell, rent or share personal data for anyone else's marketing.
- We do not profile you and we take no decision about you by automated means within the meaning of Article 22.
- We run no analytics, no tracking pixels and no advertising tags. The public pages of this site make no third-party network requests at all, which you are welcome to verify from your browser's network tab.
5. Cookies
The public pages — this one, the landing page, pricing, docs and security — set no cookies. There is no consent banner because there is nothing to consent to.
The signed-in area sets two, both strictly necessary and both scoped so they cannot follow you back out here: a session cookie that keeps you signed in, and a short-lived cookie that carries a flash message from one page to the next. Neither is used to measure anything.
6. Who else processes it
Two providers touch documents: the company that hosts our server, and the model provider that reads the pages our own OCR cannot. Both are named on the security page, along with who owns them, and along with their own sub-processors — eight more companies in the path our documents take. We publish that second layer because a chain is only as short as its longest link.
Both operate under an Article 28 data processing agreement. We will tell you before the list changes, so you have the chance to object.
One further processor sits outside the document path entirely. Polar Software Inc., a US company, is our merchant of record: it takes payment, calculates and remits sales tax, and issues your invoice. It receives your email address, your name, your billing country and which plan you bought. It never receives a document, and it is never contacted by your browser while you use this site — checkout is a redirect to Polar's own domain, not a script running on ours. We list it because it processes your personal data on our behalf, and a disclosure that quietly omitted the payment processor would be the kind of gap this notice exists to close.
7. Transfers outside the EU
Documents are processed in the EU, by EU-incorporated contracting entities. That is the accurate claim and it is narrower than the one this category usually makes, so read the qualification with it.
Our hosting provider is a German company with a US majority owner. Our model provider is French, and we call its EU endpoint — but its own published sub-processor list includes US-incorporated companies, one of them in the traffic path, and it describes limited safeguarded transfers outside the selected region. We therefore do not tell you that your documents never leave EU jurisdiction, because it is not something we can promise. The security page sets out exactly which four sentences we will not print and why.
8. Your rights, and how to use them
Under the GDPR you may ask us for a copy of your personal data, ask us to correct it, ask us to erase it, ask us to restrict or stop a particular use, object to processing we base on legitimate interests, and ask for your data in a portable form. You may also withdraw consent where consent was the basis — though as the table shows, it rarely is here.
Three of these you can exercise without asking anyone:
- Erase a document's record — delete it from your dashboard. The document itself was already gone when the parse finished.
- Erase everything — close your account. Jobs and sessions are erased with it, and it is not reversible.
- Revoke access — revoke an API key, which takes effect on the next request.
For anything else, write to [privacy contact email address]. We answer within 30 days, and usually within a few. We may ask you to confirm you control the account's email address — not to obstruct you, but because handing an account's data to whoever asked for it would be the worse failure.
A deletion takes effect in the live database immediately. Backups are a separate copy and are not edited: a deleted record can persist in a backup for up to 14 days, after which that backup is destroyed. If a backup were ever restored, we re-apply outstanding deletions.
If the documents you sent contain someone else's personal data and that person comes to us directly, we will point them to you, because you are the controller for that data — and we will tell you that we did.
9. Security
Passwords are stored hashed, never recoverable. API keys are stored as a SHA-256 hash and a display prefix. Session tokens are stored hashed. IP addresses in the account tables are stored as salted hashes rather than addresses. Traffic is TLS, terminated on our own server with no CDN in front of it. Sign-ins are rate-limited, and the limit drains rather than extending itself, so a person who mistypes a password is not locked out permanently.
We hold no security certifications. There is no ISO 27001, SOC 2 or C5 report to send you, and a page that implied otherwise would fail at the first question of your questionnaire rather than the last.
10. Breaches
If a personal data breach happens and it is likely to be a risk to people, we notify the supervisory authority within 72 hours of becoming aware of it, as Article 33 requires, and we tell the affected customers. Where we are the processor — that is, where it involves documents you sent — we tell you without undue delay so that you can meet your own obligation.
11. Complaints
Tell us first if you can: [privacy contact email address]. You also have the right to complain to a supervisory authority, which for us is [lead supervisory authority], or to the authority in the EU country where you live or work.
12. Changes to this notice
When this notice changes materially — a new category of data, a new purpose, a new sub-processor in the document path — we tell account holders by email before it takes effect. Smaller corrections take effect when published, and the date at the top changes with them.
The bracketed fields above are unfilled. They are the controller's legal name, registration number, postal address, privacy contact address and lead supervisory authority. A GDPR notice that names no controller is incomplete; one that names an invented controller is worse. Fill them from the incorporation documents before relying on this page.
Need this in a questionnaire?
Send us the questionnaire. We answer it with this page, both providers' DPAs, and a straight answer where the honest answer is no.