Privacy Policy

1. Information We Collect

Some uploads/data may include highly sensitive personal or financial information (invoices, bank statements, medical info, etc.), and we treat them with extra security.

Account Information

• Email address (required for registration and verification).
• Password credentials, stored as password hashes and never stored in plain text.
• Name or full name, when you provide it or when it is returned by a supported sign-in provider.

Google Sign-In Information

If you choose to register or sign in with Google, we receive and verify a Google ID token. We use that token only to authenticate you, create or sign in to your PDFData account, and link your Google identity to an existing verified PDFData account when eligible.

• Google account unique identifier, also called the Google sub claim.
• Email address and email verification status.
• Name or full name when Google provides it.
• Hosted domain when Google provides it for a Google Workspace account.

We do not request access to Google Drive, Gmail, Google Calendar, contacts, or other Google API content for Google sign-in. We do not store your Google password.

Payment Information

• We use Stripe to handle all payments and payment methods.
• We do not store your full credit card details on our servers.
• Stripe may collect billing information such as your name, card type, and billing address.

Uploaded Files

• When you upload PDF files for data extraction, we temporarily store them for processing.
• Uploaded files are retained according to the retention schedule below.
• We do not share, analyze, or use your uploaded files for any purpose other than processing them for your request.

Usage Data

• IP address.
• Browser type.
• Operating system.
• Date and time of access.
• Actions performed in your account (e.g., file uploads, subscription changes, and usage events).

We use this data to improve our service, secure our platform, and analyze usage trends.

Data Security and Encryption

We take the protection of your sensitive information, including uploaded files (PDFs), extracted data (bank/financial data, medical information, invoices/receipts, resumes, insurance claims, etc.), and stored account data, very seriously. To safeguard this data, we implement a comprehensive set of security measures, as described below:

• Encryption in transit and at rest:
  • All data exchanged between your browser (or client) and our servers is transmitted over secure TLS/HTTPS connections.
  • Data stored on our infrastructure, including uploaded files and database records, is encrypted at rest.
• Strict key management and access control:
  • Secrets, provider credentials, and infrastructure keys are stored in secured configuration and are not committed to public or shared repositories.
  • Access to production systems and secrets is limited to authorized backend processes and authorized personnel.
• Security review, maintenance, and best-practice configuration:
  • We perform regular security reviews and updates to dependencies, encryption libraries, and server configurations.
  • We enforce principles of "privacy by design": data minimization, least privilege, retention limits, and secure defaults.

Transparency and User Rights

• We provide you with the ability to request deletion of your stored data (both original files and extracted data).
• We handle all data in compliance with applicable data-protection laws/regulations, and are committed to maintaining high standards of data confidentiality, integrity, and availability.

Limitation of Guarantees

• While we use state-of-the-art encryption and access controls, no system is 100% immune to risks. We cannot guarantee absolute security, but we continuously monitor, audit, and improve our security posture to minimize any potential risks.

2. How We Use Your Data

We use the collected information to:

• Provide and maintain our Services.
• Process payments, subscriptions, and account usage.
• Authenticate users, including through email/password login and optional Google sign-in.
• Create or link accounts when Google verifies an eligible email address.
• Protect the confidentiality, integrity, and availability of your data through encryption, controlled access, and secure handling.
• Communicate with you (e.g., email confirmations, service updates).
• Improve and secure our Services.
• Comply with legal obligations.

3. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We may share data with:

• Stripe for payment processing.
• Google for optional Google sign-in and, where applicable, OCR processing.
• Mailgun or similar email providers for account and service emails.
• AI, OCR, storage, hosting, and infrastructure providers that help process documents and operate the platform.
• Legal authorities if required by law or subpoena.

We do not sell Google user data. We do not use Google user data for advertising, retargeting, determining creditworthiness, lending, or training generalized AI or machine-learning models. Service providers may process data only as needed to provide, secure, maintain, or support the Services, or as required by law.

4. Cookies and Tracking

We may use cookies and similar technologies to:

• Authenticate users.
• Track session activity.
• Analyze platform performance.

You can control cookies through your browser settings. See our Cookies Policy for more detail.

5. Data Retention

• Account data: Retained as long as your account is active or as required by law.
• Google identity link data: Retained while your account remains active or as needed to provide authentication, security, support, legal compliance, and account recovery.
• Uploaded PDF files: Automatically deleted in 7 days after processing.
• Extracted document data and usage records: Retained while your account remains active or as needed to provide the Services, support exports, comply with legal obligations, resolve disputes, and enforce our agreements.
• Payment logs: Retained for financial and legal compliance.

6. Your Rights

Depending on your location, you may have the right to:

• Access your data.
• Correct or delete your data.
• Object to certain processing.
• Request data portability.

7. Data Security

We implement industry-standard measures to protect your data, including:

• Encryption (in transit and at rest).
• Access controls and audit logs.
• Regular security reviews.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the Service after changes constitutes acceptance.