Privacy Policy

1.1 Information you provide

• Account information: email address, name, and password when you sign up.
• Payment information: billing details collected and stored by Paddle (our payment processor). We never store full card numbers.
• Documents: PDF files, images, and other documents you upload for processing.
• Communications: messages you send to our support team.

1.2 Information collected automatically

• Usage data: pages visited, features used, processing history, and export counts.
• Device fingerprint: a hashed identifier derived from browser properties (user agent, language, screen resolution, timezone) used to manage anonymous usage quotas. This is stored in your browser's localStorage and never linked to your identity without your consent.
• Log data: IP address, browser type, referring URL, and timestamps, retained for up to 30 days for security and debugging purposes.
• Cookies: session cookies required for authentication. We do not use third-party advertising cookies.
• Product analytics: which pages and features are used, and recordings of sessions in the web app, collected through PostHog to find where the product is confusing or broken. Screens that show data from your accounting software are excluded from recordings.

1.3 If you connect QuickBooks Online

Connecting QuickBooks Online is optional. If you do, Intuit gives us an authorization for the QuickBooks company you choose, and:

• What we read: only what is needed to send a document: the company's name, edition, country, currency and tax settings; its expense, bank and credit card accounts; its purchase tax rates; and vendor names, to match the vendor on your document.
• What we write: only what you choose to send: a bill or expense for an invoice or receipt, with the document attached, and a vendor when none with that name exists yet.
• How it is stored: the authorization is encrypted (AES) on our servers, with the encryption key kept separately from the database. We keep a record of what was sent, so the same document is not sent twice.
• What we never do: sell QuickBooks data, share it with third parties, use it for advertising, or use it to train AI models.
• Disconnecting: you can disconnect at any time from Account → Integrations or from the Apps tab in QuickBooks. We then revoke the authorization with Intuit and delete it from our servers. Transactions already sent stay in your QuickBooks company.

• To provide, maintain, and improve the Service.
• To process your uploaded documents and return extracted data.
• To manage your account, billing, and subscription via Paddle.
• To send transactional emails (receipts, usage alerts, plan changes). We do not send marketing emails without your explicit consent.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

We keep the documents you upload, and the data extracted from them, until you delete them. Nothing is removed on a timer:

You can delete a statement, and the transactions extracted from it, at any time from your dashboard. Account information is retained while your account is active and for up to 90 days after deletion to handle disputes. You may request earlier deletion (see Section 7).

We do not sell your personal data. We share information only with the following sub-processors, each of whom is contractually obligated to protect it:

If you connect QuickBooks Online, the documents you choose to send go to Intuit, at your instruction, into your own QuickBooks company. Intuit is not our sub-processor; its handling of your data is governed by Intuit's privacy statement.

We may also disclose information if required by law, court order, or to protect the rights, property, or safety of Documentric, our users, or the public.

We apply industry-standard security measures including:

• TLS 1.2+ encryption in transit for all data.
• AES-256 encryption at rest in Amazon S3.
• Every request is checked against your account, so users can only access their own data.
• Signed, time-limited URLs (1-hour expiry) for document previews.
• Service-role API keys stored server-side only, never exposed to the browser.
• Authorizations for connected accounting software encrypted with AES, the key held separately from the database.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at hello@documentric.com.

We use only the following types of cookies:

• Authentication cookies (Auth.js): required for you to stay signed in. These are first-party, session-scoped cookies.
• localStorage: we store a device fingerprint locally to manage anonymous quotas and user preferences. This data never leaves your browser unless you are making an API request.

• Product analytics (PostHog): a first-party cookie and localStorage entry that let us count usage and record sessions in the web app, as described in Section 1.2.

We do not use Google Analytics, Facebook Pixel, or any third-party advertising trackers.

Depending on your location you may have the following rights under GDPR, CCPA, or similar laws:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate data.
• Deletion: request deletion of your account and associated data.
• Portability: receive your data in a machine-readable format.
• Objection / restriction: object to or restrict certain processing.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at hello@documentric.com. We will respond within 30 days. We may need to verify your identity before fulfilling the request.

Our sub-processors may transfer and process your data in countries outside your own, including the United States. Where required, such transfers rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards approved by the relevant data protection authority.

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy here and, for significant changes, via email. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

For privacy-related inquiries: