1. Our role
For account, billing, and website information, we decide how and why that information is processed and act as its controller. For the documents, media, prompts, and other Customer Content (as defined in the Terms) that you submit, we act on your behalf as a service provider or processor, and your organization controls that content. If you are an end user of an organization's DocSlurp workspace, direct privacy requests about that content to the organization.
2. Information we collect
- Account information. Name, email address, password hash, organization and workspace membership, and, if you sign in with GitHub, Google, or company SSO, the profile details that provider shares with us.
- Customer Content. Files and media you upload, and what the Service derives from them: extracted text, page images, chunks, embeddings, structured fields, search queries, chat messages, and answers.
- Billing information. Plan, credit, and invoice records. Payments are handled by Stripe; we do not receive or store full payment card numbers.
- Usage and technical data. API requests, API key identifiers, IP address, browser and device details, logs, timing, token usage, cost, and error reports.
- Communications. Messages you send us, such as support requests and legal notices.
3. How we use information
- Provide, operate, and maintain the Service, including ingestion, search, and chat over your content.
- Authenticate users, secure accounts, and detect, prevent, and investigate abuse, fraud, and security incidents.
- Meter usage, enforce plan limits and budgets, bill, and collect payment.
- Send service messages, such as verification codes, security notices, billing notices, and changes to our terms.
- Monitor performance and reliability, and improve the Service using aggregated or de-identified Service Data as described in the Terms.
- Comply with law, respond to lawful requests, and enforce our agreements.
Where the law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in running and securing a business service, compliance with legal obligations, and, where required, your consent.
4. AI processing
Some features send portions of Customer Content to third-party AI model providers to extract, embed, summarize, or answer questions about it. Which providers and models are used depends on your workspace settings and the features you enable. We send only what a request needs, and those providers process it under their own API terms to return results to us.
We do not use Customer Content to train general-purpose AI models. AI outputs can be inaccurate; review them before relying on them, as the Terms describe.
7. Retention
We keep Customer Content until you or your organization delete it, or until the account is closed, after which we delete it from active systems within a reasonable period. Residual copies in backups and logs expire on their normal cycles. We keep account, billing, and transaction records as long as needed to provide the Service and to meet legal, tax, accounting, and dispute-resolution obligations. Operational logs and usage telemetry are kept for limited periods.
8. Security
We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit, hashed passwords, scoped API keys, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials, as the Terms describe.
9. International transfers
We are based in the United States, and we and our subprocessors may process information in the United States and other countries whose data protection laws may differ from yours. Where required, we use appropriate safeguards for these transfers.
10. Your choices and rights
You can view and update account information in the dashboard, and delete workspaces, documents, and your account. Depending on where you live, you may also have the right to request access to, correction of, deletion of, or a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To make a request, email [email protected]. We may need to verify your identity, and we will not discriminate against you for exercising these rights. You may also complain to your local data protection authority.
11. Children
The Service is for business use by people 18 and older. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.
12. Changes to this Policy
We may update this Policy from time to time. We will post the updated Policy here with a new effective date and, for material changes, give additional notice such as an email or in-product message.
13. Contact
Questions or requests about this Policy: [email protected].