Privacy Policy

Last updated: April 12, 2026

DocuExtract is a document extraction API operated by DocuExtract (“we,” “us,” “our”). This policy explains what data we collect, what we explicitly do not collect, and how we handle everything in between. We believe privacy policies should be readable by humans, not just lawyers.

1. What We Collect

When you create an account or use the API, we collect:

• Account information: your email address and authentication provider (GitHub, Google, or magic link). We do not collect passwords — authentication is handled via OAuth or one-time magic links.
• API usage logs: timestamps, document types processed, AI model used, processing time, token counts, and confidence scores. We use this data to enforce rate limits, generate your usage reports, and improve extraction accuracy.
• Payment information: managed entirely by Stripe. We store your Stripe customer ID and subscription status in our database, but we never see, transmit, or store your card number, CVC, or billing address.

2. What We Do NOT Collect

We do not store your documents. Ever.

Documents sent to the /v1/extract endpoint are processed entirely in memory by the Claude AI model and immediately discarded once the structured JSON response is returned. We never retain, cache, log, or write document content to disk. Your invoices, receipts, contracts, and forms pass through our system — they do not stay.

This is a deliberate architectural decision, not an afterthought. We designed DocuExtract so that document non-storage is enforced at the infrastructure level, not by policy alone. There is no “document storage” table in our database. There is no file bucket for uploaded content. The data literally has nowhere to persist.

Anthropic (the Claude API provider) also does not train on or retain API inputs. See their privacy policy for details.

3. How We Use Your Data

We use the data we collect for the following purposes:

• Authentication: verify your identity and authorize API requests.
• Rate limiting: enforce per-minute and per-month request limits based on your plan.
• Billing: track usage for metered billing, process payments, and manage subscriptions through Stripe.
• Transactional emails: send usage alerts, weekly reports, payment confirmations, and account notifications. You can unsubscribe from non-essential emails at any time.
• Service improvement: analyze aggregated, anonymized usage patterns (e.g., average processing times, popular document types) to improve extraction accuracy and API performance. We never use individual document content for this purpose because we do not have it.

4. Third-Party Processors

We rely on a small number of trusted infrastructure providers to operate DocuExtract:

• Supabase (US) — PostgreSQL database, authentication, and session management.
• Anthropic (US) — Claude AI models for document extraction. Documents are sent to the Claude API for processing and are not retained by Anthropic.
• Stripe (US) — Payment processing, subscription management, and invoicing. Stripe is PCI DSS Level 1 certified.
• Vercel (US) — Application hosting, serverless function execution, and edge network delivery.
• Resend (US) — Transactional email delivery (usage alerts, welcome emails, receipts).

We do not sell, rent, or share your data with any third party for advertising or marketing purposes.

5. Cookies

We use essential cookies only — specifically, authentication session tokens managed by Supabase. These cookies are required for the dashboard and API key management to function.

We do not use tracking cookies, analytics cookies, or third-party advertising cookies. There are no cookie banners because there is nothing optional to consent to.

6. Data Retention

• Account data (email, API keys, plan info): retained for the lifetime of your account. Deleted permanently when you delete your account.
• API usage logs (timestamps, document types, processing metrics): retained for 90 days, then automatically purged. Aggregated statistics may be retained longer in anonymized form.
• Payment records: retained by Stripe according to their data retention policy and applicable financial regulations.
• Document content: not applicable — never stored in the first place.

7. Your Rights

You have the right to:

• Access your personal data — view your account info, usage history, and billing details from the dashboard.
• Correct inaccurate data — update your email or account details in Settings.
• Delete your account — permanently remove your account, API keys, and usage history from Settings. Document content is never stored, so there is nothing additional to delete.
• Export your data — request a machine-readable export of your account and usage data by emailing privacy@docuextract.dev.

We respond to all data requests within 30 days.

8. Children’s Privacy

DocuExtract is a developer tool designed for professional and business use. We do not knowingly collect personal information from anyone under the age of 13. If you believe a child under 13 has created an account, please contact us at privacy@docuextract.dev and we will promptly delete the account.

9. International Data Transfers

DocuExtract and all of our third-party processors are based in the United States. If you access the service from outside the US, your data (account information and usage logs — never document content) will be transferred to and processed in the United States.

By using DocuExtract, you consent to this transfer. We apply the same security and privacy protections regardless of where you are located.

10. Changes to This Policy

We may update this privacy policy as the service evolves. If we make material changes — especially anything affecting how we handle your data — we will notify registered users by email before the changes take effect.

Minor clarifications or formatting updates will be reflected in the “Last updated” date at the top of this page without separate notification.

11. Contact

Questions about this policy or your data? Reach us at privacy@docuextract.dev. We aim to respond within 2 business days.