Privacy Policy

legal name runs this site and decides what happens to the personal data on it: in the words of the law, we are the controller.

legal name
postal address
country

The way to reach us about any of this is the contact page.

There is a plainer account of what happens to a document you upload at what happens to your document. This page is the formal one.

What we hold, and why we are allowed to

Your email address. An account needs one, and it is the only way we can answer you. We hold it to perform our contract with you.

Your password, as a hash. Not as text: we cannot read it and cannot tell it to you. Held to perform the contract, and to keep your account yours.

The documents you upload, for 30 days, and the rows read out of them, for as long as your account exists. Without the document there are no rows: contract again.

A document you send is not only about you. An invoice names a supplier, a statement names whoever you paid, people as well as companies. We hold those names because they are printed on the page you asked us to read, we use them for nothing else, and we do not build a picture of anybody from them.

Your token balance and the record of what was spent. Contract, and after that our legitimate interest in being able to settle a dispute about a balance, yours as much as ours.

Server logs. Our hosting provider records the address you connect from, in its own logs, as every web server does. We use them only to keep the site working and to see when somebody is attacking it, which is a legitimate interest. We do not run an analytics service, and no third-party script of any kind is loaded on these pages; the typefaces are served from here, not from Google.

Anything you write to us through the contact form: your message, the address you gave so we can answer, and your name if you gave one. Held on our own server so that nothing you tell us is lost, and kept while the matter is open and for a while after, because the same person often writes again about the same thing. Our legitimate interest in answering you, and in remembering that we did.

Ask us to delete a message once it is settled and it goes. We do not add the address to any list. There is no list.

Failed sign-in attempts and repeated form submissions, counted against the network address they came from and forgotten within the quarter of an hour. Without that count a password can be guessed at without limit. Legitimate interest, and a short-lived one.

Who else sees it

No reading service is connected, and no document has been sent anywhere. This is a statement of fact about today, not a promise about tomorrow: turning a page into rows needs a machine that reads it, and that machine will be somebody else's. When one is connected, this page will name the company, name the country it is in, and say what it is allowed to keep, before the first document goes to it, not after.

Our hosting provider holds the server the site runs on, and with it everything stored on it.

Nobody buys this data from us and nobody is given it for advertising. We give it to an authority only where the law requires it, and will tell you if that happens unless we are forbidden to.

Sending a document outside Europe

Nothing leaves the European Economic Area today, because nothing is sent anywhere at all. A reading service, when there is one, may well sit outside it.

Personal data may only be sent outside the Area with a safeguard the law recognises, and a document is squarely personal data: an invoice carries a supplier's name, a statement carries the account it belongs to. Before any document is sent to anybody we will have the written agreement covering the transfer, and the answer to how long the document exists on their side. Until both are in hand, no document goes.

We would rather show you an unfinished page than a finished-looking one that is not true. This paragraph stays here until it can be replaced by a named company, a named country, and the safeguard that covers it.

How long we keep it

Uploaded documents: 30 days, then deleted by a task that runs daily. The rows read out of them stay while the account does: they are the thing you came for.

Account, balance and history: while the account exists. Ask us to close it and it goes, along with the balance.

Messages sent through the contact form: while the matter is open and for a while after. Ask and they go sooner.

Counts of failed sign-ins and repeated submissions: a quarter of an hour.

What you can ask for

If the law where you live gives you these rights, and in the European Economic Area and the United Kingdom it does, you may ask us for:

• A copy of the personal data we hold about you.
• A correction of anything wrong.
• Deletion of it, which for an account means closing it.
• A pause: that we hold it but stop using it while something is disputed.
• A portable copy, in a form another service could read.
• That we stop relying on legitimate interest, if your situation gives you a reason to object. We will stop unless we have grounds that outweigh yours, and we will say which.

Write to us. We answer within a month, free, and we do not ask why. If we need to be sure it is you, we will ask you to write from the address on the account rather than demand a document.

If you think we have handled it badly

Tell us first. It is faster and we would rather know, but you do not have to, and you may complain to a data protection authority instead. In the European Economic Area you may go to the authority in the country where you live, where you work, or where the problem happened, whichever suits you; the list of them is kept by the European Data Protection Board at edpb.europa.eu.

Keeping it safe

The site is served over an encrypted connection. Passwords are stored as hashes. Uploaded documents sit in folders named by a long random string that cannot be guessed or counted up to from somebody else's, and the web is denied the folder itself, so a document cannot be fetched by its address. Guessing at a password is limited. The key that will let us talk to a reading service is kept outside the website's own folders, where the web cannot reach it.

None of that is a guarantee, and anybody who tells you their site cannot be breached is selling something. If a breach happens that puts you at risk, we will tell you and the authority, quickly.

Children

This is a tool for paperwork and is not meant for children. We do not knowingly hold data about anybody under eighteen. If you believe we do, write to us and it will be removed.

Decisions made by machine

A machine decides whether a file is one we can read and refuses it in words if not: a password-protected PDF, a file too large, an image too small. A machine also marks a row whose arithmetic does not add up. Neither decision has a legal effect on anybody: the first is answered by sending a different file, the second by correcting the row yourself, and your correction replaces what the machine read. Nothing on this site profiles you or scores you.

Cookies

Only the ones that keep you signed in. Details on the cookie page.

Changes

When this page changes we date the change at the foot of it. If a change matters to you, such as a new recipient of your data or a new purpose, we will tell account holders by email rather than waiting to be noticed.

An honest note about this page

This was written by the people who built the site and has not been reviewed by a lawyer. It describes what the software actually does, which we checked rather than assumed. It has not been checked against the law of any particular country, and it should be before this site takes money.