Privacy Policy

Updated October 17, 2026 · Vision OCR disclosure v1

This policy explains how DocuExtracts handles information when you visit, create an account, or process documents. The service uses OpenAI Sites hosting infrastructure and Cloudflare. This policy covers DocuExtracts; external providers also have their own privacy policies.

Information we collect

• Account information: email, account identifier, password hash and salt, session records, recovery-code hash, and creation date. Passwords are hashed rather than stored as plain text.
• Agreement records: account identifier, accepted agreement version, and acceptance time. The signup agreement is separate from any marketing permission.
• Processing metadata: filename, file type, page count, processing status, timestamps, and free or purchased credit usage. Filenames can themselves contain personal information.
• Saved content: extracted text and fields when you choose Save. You can review, edit, and delete saved results.
• Technical logs: requests, IP addresses, browser details, approximate country, timestamps, and response status may be recorded by the hosting infrastructure for operation, security, and troubleshooting.
• Communications and purchases: your name, email address, and details submitted through the contact form or messages you email us and, if purchases are enabled, payment references and credit-grant records.

What happens to uploaded files

Local extraction reads original documents and images in your browser without uploading their contents. The optional Vision OCR agent is different: after you select it and allow vision processing, rendered page images are sent through our server to OpenAI to extract text, tables, and fields. DocuExtracts does not save these images in its database or file storage. Provider retention policies still apply. Vision OCR requires sign-in and records account-linked AI usage. For signed-in local processing, filenames and page counts are recorded on the server. Guest local extraction does not create account history. Results stay in the open page until you choose Save or another AI feature. Saved results include the selected outputs and any extraction warnings. This distinction does not make sensitive filenames or saved content anonymous.

How we use information

We use information to authenticate accounts, show processing history, save results, administer credits and payments, record agreements, prevent abuse, troubleshoot problems, and answer requests. The operator receives activity summaries by email through Gmail. These summaries contain counts, times, and HTTP outcomes, rather than original documents, extracted text, visitor email addresses, or IP addresses.

Providers and disclosure

OpenAI Sites and Cloudflare provide hosting and related infrastructure. When enabled and selected, AI field extraction sends extracted text to OpenAI, and Vision OCR sends rendered document images. The application requests store: false; this is not a promise of zero provider retention. Stripe processes payments when checkout is enabled; DocuExtracts does not receive full card details. Contact-form submissions, including name, email address, and message, are stored in our Cloudflare database and read by an owner-authorized ChatGPT automation to send support email through Gmail. These submissions are retained in the support inbox and site database until deletion is requested. A hashed network identifier is used to limit contact-form abuse. Gmail handles support email and operator activity alerts. Information may also be disclosed when required by law or reasonably necessary to protect rights, security, or safety.

The current application has no advertising or data-sale feature and does not sell personal information or share it for cross-context behavioral advertising.

Cookies and tracking preferences

Account sign-in uses a session cookie. We do not add advertising trackers or cross-site profiling tools. The application does not change essential account, processing, or security functions in response to Do Not Track signals. Because it has no sale or advertising-sharing feature, a Global Privacy Control signal does not trigger such a transfer. Infrastructure providers may process technical data under their own policies.

Retention, access, and deletion

Account and saved-result data remains stored until removed or a verified deletion request is processed. Deleting a saved result removes that record from the active application; it does not necessarily immediately remove provider backups or independent processing metadata. Usage, payment, security, and agreement records may be retained when needed for service operation, disputes, or legal obligations. Provider log and backup retention varies. We do not promise a fixed deletion period or immediate removal from every backup.

Use My account to review processing history and edit or delete saved results. Email gayasi007@gmail.com to request account deletion, access, or correction, or exercise rights that apply to you. We may verify identity before providing or deleting information. Do not email passwords or original sensitive documents.

Security and international processing

We use HTTPS, password hashing, and account access controls. No service can guarantee absolute security. Providers may process information outside your home country. Evaluate your organization’s privacy and confidentiality requirements before using the service.

Adults only and policy changes

The service is intended for people aged 18 or older. If you believe a child provided information, contact us. We will update the effective date and version when this policy changes; material changes will be identified in the service. Review the policy before using new features.

Questions? Contact the DocuExtracts site operator at gayasi007@gmail.com.