[{"data":1,"prerenderedAt":509},["ShallowReactive",2],{"legal-\u002Flegal\u002Fprivacy":3},{"id":4,"title":5,"body":6,"description":500,"extension":501,"meta":502,"navigation":503,"order":486,"path":504,"seo":505,"stem":506,"updated":507,"__hash__":508},"legal\u002Flegal\u002Fprivacy.md","Privacy Policy",{"type":7,"value":8,"toc":484},"minimark",[9,17,22,25,60,63,67,109,113,116,134,137,141,153,156,160,167,241,244,258,263,266,270,322,325,329,361,364,368,371,375,381,385,388,432,440,448,454,460,464,469,473,476],[10,11,12,16],"p",{},[13,14,15],"strong",{},"We never sell your personal data — we never have and never will."," This policy explains what Docabra collects, why, who it is shared with, how long it is kept, and the rights you have over it. It applies to the Docabra website and application (the \"Service\"), operated by VectorForge LLC (\"Docabra\", \"we\", \"us\").",[18,19,21],"h2",{"id":20},"_1-two-roles-two-kinds-of-data","1. Two roles, two kinds of data",[10,23,24],{},"Privacy law assigns roles, and which role we are in depends on the data:",[26,27,28,39],"ul",{},[29,30,31,34,35,38],"li",{},[13,32,33],{},"Your account data"," — your email, name, password hash, plan, and billing records. Here Docabra is the ",[13,36,37],{},"controller",": we decide why and how it is processed, and this policy governs it directly.",[29,40,41,44,45,48,49,54,55,59],{},[13,42,43],{},"The documents you upload and the tables extracted from them"," (\"Customer Content\"). Here ",[13,46,47],{},"you are the controller and Docabra is the processor",": we process this data only on your instructions, to provide the Service. Our ",[50,51,53],"a",{"href":52},"\u002Flegal\u002Fdpa","Data Processing Agreement"," governs that processing, and it is part of our ",[50,56,58],{"href":57},"\u002Flegal\u002Fterms","Terms of Service",".",[10,61,62],{},"If you upload documents that contain other people's personal data — invoices, résumés, bank statements — you are responsible for having the right to process and share that data with us.",[18,64,66],{"id":65},"_2-what-we-collect","2. What we collect",[26,68,69,75,85,91,97,103],{},[29,70,71,74],{},[13,72,73],{},"Account information."," Email address, display name, and avatar (from Google if you sign in with Google), and a cryptographic hash of your password if you set one. We never store your password in readable form.",[29,76,77,80,81,84],{},[13,78,79],{},"Billing information."," Your plan, page usage, balance ledger, and transaction history. We send Stripe and its Managed Payments affiliate, Sold through Link, LLC, your name, email address, Docabra account identifier, product, price, and transaction metadata. Stripe may also collect billing and tax details, IP address, device information, and payment method information on its hosted pages. ",[13,82,83],{},"Payment card details go directly to Stripe and never pass through or touch our servers."," We receive from Stripe only identifiers and transaction metadata, such as amounts, dates, card brand, and the last four digits shown on receipts.",[29,86,87,90],{},[13,88,89],{},"Customer Content."," The documents you upload and the tables, values, citations, and edits the Service produces from them.",[29,92,93,96],{},[13,94,95],{},"Usage and technical data."," Server logs (IP address, timestamps, pages requested), browser and device type, and product events needed to operate the Service — uploads, processing runs, sign-ins. Sign-in sessions record a browser user-agent string so you can recognize your own sessions.",[29,98,99,102],{},[13,100,101],{},"Product analytics."," Page views and feature-usage events (for example, which export format was used), collected by our own first-party system and stored in our own database — not by any third-party analytics provider. This collection uses no analytics cookies and stores no IP address: your IP is used only in memory, at the moment of the request, to derive an anonymous key that rotates daily and cannot be traced back to you.",[29,104,105,108],{},[13,106,107],{},"Support communications."," If you email us, we keep the correspondence.",[18,110,112],{"id":111},"_3-how-we-use-it","3. How we use it",[10,114,115],{},"We use the data above to:",[117,118,119,122,125,128,131],"ol",{},[29,120,121],{},"Provide the Service — authenticate you, store your projects, process your documents, render your tables, produce your exports.",[29,123,124],{},"Bill you — track page usage, apply quotas, charge overage from your balance, keep the ledger you can inspect on the billing page.",[29,126,127],{},"Send transactional email — sign-in codes, password reset links, and important notices about your account or these policies. We do not send marketing email, and we do not run advertising.",[29,129,130],{},"Keep the Service secure and improve it — detect abuse, prevent fraud, debug failures, and understand in aggregate how the Service is used (the first-party product analytics described in Section 2, including A\u002FB tests of product changes).",[29,132,133],{},"Meet legal obligations — tax, accounting, and lawful requests from authorities.",[10,135,136],{},"We also use anonymized, aggregated usage data (for example, which column types are most common across all users) to improve the Service. This data cannot reasonably be used to identify you or your documents.",[18,138,140],{"id":139},"_4-ai-processing","4. AI processing",[10,142,143,144,147,148,152],{},"Document extraction is performed by AI models. When you run an analysis, page images and text from your documents are sent to one or more of our AI providers — ",[13,145,146],{},"OpenAI, Anthropic, or Google"," — over an encrypted API connection. They are listed on our ",[50,149,151],{"href":150},"\u002Flegal\u002Fsubprocessors","subprocessors page",", and their own terms govern what they do with the data they receive.",[10,154,155],{},"Extraction results are cached so that re-processing the same document does not cost you pages twice; cached results are deleted on the schedule in Section 7.",[18,157,159],{"id":158},"_5-cookies","5. Cookies",[10,161,162,163,166],{},"The Service uses only ",[13,164,165],{},"strictly necessary cookies"," — the ones required to sign you in and remember your preferences. We do not use analytics, advertising, or tracking cookies, so no cookie consent banner is required.",[168,169,170,186],"table",{},[171,172,173],"thead",{},[174,175,176,180,183],"tr",{},[177,178,179],"th",{},"Name",[177,181,182],{},"Purpose",[177,184,185],{},"Duration",[187,188,189,204,217,229],"tbody",{},[174,190,191,198,201],{},[192,193,194],"td",{},[195,196,197],"code",{},"docabra_session",[192,199,200],{},"Keeps you signed in",[192,202,203],{},"30 days",[174,205,206,211,214],{},[192,207,208],{},[195,209,210],{},"docabra-locale",[192,212,213],{},"Remembers your interface language",[192,215,216],{},"1 year",[174,218,219,224,227],{},[192,220,221],{},[195,222,223],{},"docabra-locale-mode",[192,225,226],{},"Remembers how your language was chosen",[192,228,216],{},[174,230,231,236,239],{},[192,232,233],{},[195,234,235],{},"docabra_device",[192,237,238],{},"Security: recognizes this device to prevent abuse of the Service, such as free-quota evasion through multiple accounts",[192,240,216],{},[10,242,243],{},"The device cookie is used only for security and abuse prevention — never for analytics, advertising, or tracking you across the web. Our product analytics runs on the anonymous, daily-rotating key described in Section 2 and does not read the device cookie.",[10,245,246,247,252,253,59],{},"This section describes cookies set on Docabra. When you leave Docabra for a Stripe-hosted Checkout, payment-update page, or Customer Portal, Stripe may use cookies and similar technologies for payment processing, authentication, fraud prevention, security, and its own service analytics. Stripe governs those technologies under its ",[50,248,5],{"href":249,"rel":250},"https:\u002F\u002Fstripe.com\u002Fprivacy",[251],"nofollow"," and ",[50,254,257],{"href":255,"rel":256},"https:\u002F\u002Fstripe.com\u002Flegal\u002Fprivacy-center",[251],"Privacy Center",[10,259,260,261,59],{},"You can block or delete cookies in your browser settings, but the Service will not be able to sign you in without ",[195,262,197],{},[10,264,265],{},"Our product analytics and A\u002FB testing run without cookies: usage events are tied to the anonymous, daily-rotating key described in Section 2 — or to your account when you are signed in — never to an analytics cookie. If we ever adopt a tool that requires cookies or similar storage that is not strictly necessary, those will be listed here and — where the law requires — enabled only after you give consent through a consent control. We will update this policy before that happens.",[18,267,269],{"id":268},"_6-who-we-share-it-with","6. Who we share it with",[26,271,272,285,291,310,316],{},[29,273,274,277,278,281,282,59],{},[13,275,276],{},"Customer Content subprocessors"," — AI and infrastructure providers process Customer Content on our behalf and only to provide the Service. They are listed on the ",[50,279,280],{"href":150},"subprocessors and providers page"," and in our ",[50,283,284],{"href":52},"DPA",[29,286,287,290],{},[13,288,289],{},"Account-data service providers"," — Resend processes account email addresses and transactional email on our behalf. Our hosting provider processes the account, usage, and application data needed to run the Service. These providers are contractually required to protect that data and process it for the contracted services.",[29,292,293,296,297,300,301,304,305,309],{},[13,294,295],{},"Stripe and Sold through Link, LLC"," — they process payment and transaction data on our instructions for some operations. They act as independent controllers when they determine how to process data for financial partners, fraud and loss prevention, legal and financial compliance, supported indirect tax administration, disputes, customer support, and improvement of their services. They may handle requests to exercise privacy rights for the data they control in their systems. Their ",[50,298,5],{"href":249,"rel":299},[251],", ",[50,302,257],{"href":255,"rel":303},[251],", and ",[50,306,284],{"href":307,"rel":308},"https:\u002F\u002Fstripe.com\u002Flegal\u002Fdpa",[251]," explain these roles.",[29,311,312,315],{},[13,313,314],{},"Legal requirements"," — if the law, a court, or a regulator compels disclosure, or to protect the rights, property, or safety of Docabra, our users, or the public. Where the law allows, we will tell you before disclosing.",[29,317,318,321],{},[13,319,320],{},"Business transfers"," — if Docabra is acquired or merged, your data may transfer to the successor, who remains bound by this policy.",[10,323,324],{},"That is the whole list. We do not sell personal data, and we do not share it for cross-context behavioral advertising.",[18,326,328],{"id":327},"_7-retention-and-deletion","7. Retention and deletion",[26,330,331,337,343,349,355],{},[29,332,333,336],{},[13,334,335],{},"Account data"," is kept while your account is active. If you close your account, it is deleted from active systems within 30 days, except records the law requires us to keep (for example, tax and accounting records of payments, typically kept for the statutory period).",[29,338,339,342],{},[13,340,341],{},"Customer Content"," is kept until you delete it. When you delete a document, a project, or your account, the associated content is removed from active systems within 30 days. Two honest qualifications: identical files are stored once and shared across accounts by content hash, so a file you delete is destroyed only when no other account holds the identical file; and extraction caches derived from such a shared file persist while the file does.",[29,344,345,348],{},[13,346,347],{},"Server logs"," are kept for up to 90 days.",[29,350,351,354],{},[13,352,353],{},"Product analytics events"," are kept for up to 12 months, then deleted or reduced to anonymous aggregates.",[29,356,357,360],{},[13,358,359],{},"Transactional email"," is retained per the records of our email provider, Resend.",[10,362,363],{},"Deleted means deleted: after these windows, the data cannot be recovered from active systems. Copies inside our hosting provider's infrastructure snapshots rotate out on the provider's own schedule.",[18,365,367],{"id":366},"_8-security","8. Security",[10,369,370],{},"We protect your data with encryption in transit (TLS) and at rest, hashed credentials (we store only scrypt password hashes and hashed session tokens), least-privilege access to production systems, and contractual safeguards with the providers described above. No method of transmission or storage is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.",[18,372,374],{"id":373},"_9-international-transfers","9. International transfers",[10,376,377,378,380],{},"Docabra is based in the United States, and our providers process data in the United States and other countries where they operate. If you use the Service from the EEA, the UK, or Switzerland, your data will cross borders. For Customer Content protected by European law, we rely on the European Commission's Standard Contractual Clauses and the UK addendum with our subprocessors, as described in our ",[50,379,284],{"href":52},". Other providers, including Stripe, govern their international transfers under their own privacy notices and contractual safeguards. We have not self-certified to the EU–US Data Privacy Framework.",[18,382,384],{"id":383},"_10-your-rights","10. Your rights",[10,386,387],{},"We extend the same core rights to every user, wherever you live:",[26,389,390,396,402,408,414,420,426],{},[29,391,392,395],{},[13,393,394],{},"Access"," — ask what personal data we hold about you.",[29,397,398,401],{},[13,399,400],{},"Correction"," — fix inaccurate data (your name and email are editable in the product).",[29,403,404,407],{},[13,405,406],{},"Deletion"," — delete documents and projects in the product, or ask us to close your account and delete your data.",[29,409,410,413],{},[13,411,412],{},"Export"," — your tables export to Excel and CSV from the product at any time; you may also ask us for a copy of your account data.",[29,415,416,419],{},[13,417,418],{},"Objection and restriction"," — object to or restrict certain processing.",[29,421,422,425],{},[13,423,424],{},"Withdrawal of consent"," — where processing is based on consent, withdraw it at any time.",[29,427,428,431],{},[13,429,430],{},"Complaint"," — you may complain to your local data protection authority. We would appreciate the chance to fix the problem first.",[10,433,434,435,439],{},"To exercise any of these, email ",[50,436,438],{"href":437},"mailto:legal@docabra.com","legal@docabra.com",". We will respond within 30 days. We will not discriminate against you for exercising your rights.",[10,441,442,443,447],{},"For payment data that Stripe or Sold through Link, LLC controls independently, you may also submit a request through the rights mechanism described in the ",[50,444,446],{"href":255,"rel":445},[251],"Stripe Privacy Center",". We remain responsible for responding to requests about the account, billing ledger, usage data, and Customer Content held by Docabra.",[10,449,450,453],{},[13,451,452],{},"For EEA\u002FUK users",", our legal bases are: performance of our contract with you (providing and billing for the Service), our legitimate interests (security, improvement, aggregated statistics), your consent (where we ask for it), and legal obligation (tax and accounting).",[10,455,456,459],{},[13,457,458],{},"For US state privacy laws (California and others)",": you have the rights listed above, including the right to know, access, correct, delete, and to non-discrimination. Because we do not sell personal data and do not share it for targeted advertising, there is no sale or sharing to opt out of. You may use an authorized agent to make a request, subject to verification.",[18,461,463],{"id":462},"_11-children","11. Children",[10,465,466,467,59],{},"The Service is not directed at anyone under 16, and we do not knowingly collect personal data from children under 16. If we learn that we have, we will delete it. If you believe a child has given us personal data, contact ",[50,468,438],{"href":437},[18,470,472],{"id":471},"_12-changes-and-contact","12. Changes and contact",[10,474,475],{},"If this policy changes, the date at the top changes with it. For material changes we will additionally notify you by email or by a notice in the Service at least 30 days before the change takes effect.",[10,477,478,479,483],{},"Questions, requests, and complaints: ",[13,480,481],{},[50,482,438],{"href":437},", or VectorForge LLC, Wyoming, United States.",{"title":485,"searchDepth":486,"depth":486,"links":487},"",2,[488,489,490,491,492,493,494,495,496,497,498,499],{"id":20,"depth":486,"text":21},{"id":65,"depth":486,"text":66},{"id":111,"depth":486,"text":112},{"id":139,"depth":486,"text":140},{"id":158,"depth":486,"text":159},{"id":268,"depth":486,"text":269},{"id":327,"depth":486,"text":328},{"id":366,"depth":486,"text":367},{"id":373,"depth":486,"text":374},{"id":383,"depth":486,"text":384},{"id":462,"depth":486,"text":463},{"id":471,"depth":486,"text":472},"What Docabra collects, why, who it is shared with, how long it is kept, and the rights you have over it.","md",{},true,"\u002Flegal\u002Fprivacy",{"title":5,"description":500},"legal\u002Fprivacy","2026-08-10","orUbpgfEdKECOt27DA-ClbMAwdgmUrEKhfRN2P_Z2NA",1786352158293]