GDPR

The data controller responsible for personal data collected through the Service is:

We process personal data under one or more of the following legal bases under Article 6 GDPR:

Contract Performance (Article 6(1)(b))

Processing necessary to provide the services you requested, including:

• Document processing and file conversion;
• OCR, translation, and text extraction;
• AI-powered document analysis and summarisation;
• Account and subscription management;
• Payment processing;
• Customer support.

Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate interests, including fraud prevention, security monitoring, abuse detection, service improvement, performance optimisation, internal analytics, and protection of legal rights. We have assessed that these interests do not override your fundamental rights and freedoms.

Legal Obligation (Article 6(1)(c))

Processing necessary to comply with legal obligations, including tax compliance, accounting requirements, regulatory obligations, and responses to lawful requests from public authorities.

Consent (Article 6(1)(a))

Where required by law, we rely on your consent for non-essential cookies, analytics cookies, and marketing communications (if offered in the future). You may withdraw consent at any time.

To exercise any GDPR right, please contact:

• Uploaded files and generated documents: Retained for up to 180 days from the upload date to provide account functionality, document history, customer support, security monitoring, and service improvement. Users may request earlier deletion where available.
• Account data: Retained while your account is active, then deleted or anonymised within 30 days of account deletion unless longer retention is required by law.
• Payment and financial records: Retained for periods required by applicable accounting, tax, and legal obligations.
• Security logs: Retained for a reasonable period to protect the Service and investigate abuse, fraud, or security incidents.

Most personal data is processed within the European Economic Area whenever possible. Our primary infrastructure is hosted by Contabo GmbH in Germany. As a result, the majority of user account data, uploaded files, generated documents, and application data are stored within the European Union.

However, certain service providers may process data outside the EEA, United Kingdom, or Switzerland. Where international transfers occur, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy decisions adopted by competent authorities;
• Additional technical and organisational measures where appropriate;
• Other lawful transfer mechanisms recognised under applicable law.

Further information regarding our service providers is available on our Sub-Processors page.

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with your local supervisory authority. In the EU, you can find your national authority via the European Data Protection Board (EDPB). In the UK, the relevant authority is the Information Commissioner’s Office (ICO).

We encourage you to contact us first so that we may attempt to resolve your concern directly.

For GDPR-related questions, requests, or complaints, please contact: