Privacy

The short version: your documents are not stored. What we keep is the minimum needed to run an account and a credit balance.

This document is not yet finalised. The controlling legal entity, the governing jurisdiction and the contact address are marked below and must be completed, and the whole document reviewed by a qualified adviser, before this product takes money from the public.

Your documents

Files you send are held in memory for the length of the request, never written to persistent disk, never used to train anything, and gone when the response ends. The mechanisms behind that claim, and the three places it does not apply, are set out in what happens to your files.

What we store

Data	Why
Email address	Identifies the account and receives sign-in codes and results.
Google subject ID	If you sign in with Google. Never the password, which we never see.
API key hashes	SHA-256 of the key. The key itself is never stored, so a database leak yields no working keys.
Job records	Operation name, status, credits, timestamps and an error code. Never the document.
Credit ledger	Append-only rows for purchases, holds, settlements and refunds.

There is no password, on either sign-in method, so there is nothing to leak and no reset flow to attack.

Sub-processors

These are the services that can see something. There are no others.

Service	Role	What it can see
Fly.io	Runs the API and the document runner	Requests in transit and in memory
Neon	Postgres database	Account email, key hashes, job records, credit ledger
Stripe	Payments	Billing name, email and card data — we never see the card
Resend	Sending the sign-in code and results	Email address, message contents
Sentry	Error reporting	Stack traces and request metadata, never file contents
Cloudflare R2	Evidence vault, opt-in only	Captures you explicitly chose to retain

Your rights

You can ask for a copy of what is stored against your account, ask for it to be corrected, or ask for the account to be deleted. Deleting an account removes the email, the keys and the job records; the credit ledger rows are retained where we are required to keep records of payments.

Requests go to [CONTACT ADDRESS — to be set].

Controller and jurisdiction

The data controller is [LEGAL ENTITY — to be set], and this policy is governed by the laws of [JURISDICTION — to be set].

Changes

Material changes will be published here with a new date. Continuing to use the service after a change means accepting it.