Privacy Policy

This Privacy Policy explains how Extract API OÜ ("we", "us", "our") processes personal data when you use Extract API (the "Service") — including our website, REST API, documentation, and billing integration.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national laws. For a technical summary of data flows, caching, and sub-processors, see our Data processing documentation.

1. Who we are (data controller)

For personal data relating to API account holders, billing contacts, and website visitors, we act as the data controller.

Data Protection Officer (DPO): Not appointed — contact privacy@extract.example.com

2. Our role when you send documents

Extract API is a business-to-business document extraction service. When you upload PDFs containing third-party personal data (names, addresses, payment details in invoices or CMRs), you are the data controller for that information.

For document processing, we act as a data processor on your instructions. You must have a lawful basis to upload such data. Our Data Processing Agreement (DPA) applies when you register for the Service.

3. Personal data we collect

3.1 Account data

• Email address, company name
• API key hash (never plaintext), webhook secret
• Stripe customer ID for billing
• Credit balance and purchase history

3.2 Document data (processor capacity)

• Uploaded PDF file contents — stored temporarily only for the duration of extraction (deleted after processing)
• Extracted field values and confidence scores returned to you via API or webhook
• Extraction request records in our database (metadata, result JSON, timestamps)
• File hash (SHA-256) — used for deduplication; the PDF itself is not stored in the result cache

3.3 Third-party AI processing

Depending on document type and deployment settings, document content may be sent to sub-processors for OCR or structured extraction:

• Mistral AI — OCR for scanned PDFs; structured JSON extraction when enabled
• OpenAI — structured extraction or vision follow-up when enabled by the operator

Digital PDFs with an embedded text layer are first processed locally on our servers (Poppler). Cloud AI is used when local text is insufficient or for configured structured/vision stages. See Sub-processors and Data processing docs.

3.4 Result cache

To improve performance and reduce cost, we cache extraction results in Redis for up to 30 days. The cache stores:

• Extracted field values (which may include personal data from the document)
• Confidence scores and detected document type
• Internal pipeline metadata — not the original PDF file

Cache entries are scoped to your API account (account ID + file hash + document type). Results are never served from one customer's cache to another customer.

3.5 Technical logs

• IP address, user agent, request path (API access logs)
• Error traces (without document body content in logs)

3.6 Website

• Essential cookies for session and security (see Cookie Policy)
• Analytics only with consent where required

4. Purposes and legal bases

5. Sub-processors

We use third-party providers for hosting, OCR, structured extraction, and payments. A complete list, purposes, and locations is at /subprocessors (DPA Annex III).

We notify API account holders by email at least 30 days before adding or replacing a sub-processor. You may object on reasonable data-protection grounds within 14 days as set out in the DPA.

6. Retention

• Account data: duration of account + statutory retention for billing records
• Uploaded PDFs: deleted after extraction completes (async: after the queued job finishes)
• Extraction results in Redis cache: up to 30 days, then automatic expiry
• Extraction request records (database): duration of account; removed when you delete your account unless a legal hold applies
• Closed support tickets: 365 days after closure
• Cookie consent journal: 5 years
• Anonymized billing records after account deletion: 7 years, then deleted
• API logs: 90 days (when API request logging is enabled)

7. Your rights

As an account holder (controller for your own registration data), you may request access, rectification, erasure, restriction, portability, or object to processing — including objecting to result caching on legitimate-interest grounds.

For personal data inside documents you uploaded (where you are controller and we are processor), coordinate erasure requests through your DPA contact or ours at dpa@extract.example.com .

You may delete your account at any time from the Dashboard (delete account section). We remove your profile, API credentials, extraction history, and support tickets. Anonymized billing records are kept for the statutory period in §6.

You may download a machine-readable copy of your account data from the Dashboard (Privacy & data section). The export includes account profile, billing, extraction metadata and results returned to you, support messages, and cookie consent records. API secrets are excluded.

Contact: privacy@extract.example.com . You may lodge a complaint with your supervisory authority.

8. International transfers

Primary hosting is in the EEA. When sub-processors (e.g. Mistral AI, OpenAI, Stripe) process data outside the EEA, we rely on Standard Contractual Clauses, adequacy decisions, or equivalent safeguards as described in the DPA.

9. Contact

privacy@extract.example.com