Privacy Policy

We collect only what is necessary to provide the Service:

• Account information: Name, email address, and hashed password. If you sign in with Google, we receive your name and email only - we do not store Google access tokens.
• Uploaded documents: Files you upload (PDF, JPG, PNG) for OCR processing. These are stored in your account until you delete them.
• Extracted data: Structured text, key-value pairs, and tables produced by our OCR pipeline. Stored alongside your uploaded documents.
• Payment information: Processed entirely by Stripe. We never see or store your credit card number.
• Usage data: Page counts, processing times, and credit usage for billing and service operation.
• Session data: IP address, user agent, and timestamps for authentication and security logging.

• We do not track you across other websites.
• We do not use marketing cookies or advertising trackers.
• We do not sell, rent, or share your personal information with third parties for their marketing purposes.
• We do not use your uploaded documents or extracted data to train AI models.

• To provide the Service: Processing your documents, storing results, managing your account and credits.
• To communicate with you: Account verification emails, password resets, and service-related notices.
• To maintain security: Audit logging, session management, and abuse prevention via rate limiting.
• To process payments: Sending billing information to Stripe for subscription and credit purchases.

We share data with the following third parties, solely to operate the Service:

• Amazon Web Services (AWS): File storage (S3) and database hosting (RDS). All data encrypted at rest and in transit. Region: US East (Virginia).
• Fireworks AI: OCR and document extraction. Receives a temporary presigned URL to your document image - never the original file. URLs expire within 1 hour.
• Anthropic: Used for automated data quality checks (curation). Receives extracted text data only, not original documents.
• Stripe: Payment processing. Receives your email and payment details. See Stripe's Privacy Policy.
• Google: OAuth sign-in only. Receives and returns your name and email. See Google's Privacy Policy.
• Sentry: Error monitoring. Receives error logs with sensitive headers (cookies, tokens, API keys) scrubbed before capture.

We do not share your data with any other third parties.

We use two types of cookies:

• Essential cookies: Session authentication and CSRF protection. Required for the Service to function. Cannot be disabled.
• Analytics cookies: Help us understand how visitors use our website. Optional - you can disable these in Cookie Settings.

We do not use marketing or advertising cookies.

All data is encrypted at rest and in transit. For full technical details - encryption standards, authentication, access controls, rate limiting, and audit logging - see our Security page.

• Your data is stored until you delete it. Deleting a file removes all associated data (original, page images, extraction results, and database records).
• Audit logs are retained for compliance purposes.
• Upon account termination, contact support@untxt.ai to request full deletion.

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Delete: Request deletion of your personal data.
• Correct: Request correction of inaccurate data.
• Opt-out: We do not sell personal information. There is nothing to opt out of.

To exercise any of these rights, email support@untxt.ai. We will respond within 45 days.

The Service is not directed to anyone under 18. We do not knowingly collect data from minors. If we learn we have, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-Service notice. Continued use after changes constitutes acceptance.