Privacy Policy

Last updated: 2026-07-06

What we collect

Account data: your email address and a password hash, managed by our authentication provider (Supabase). We do not see or store your password.

Transaction data you submit: invoice metadata and confidence scores you enter or extract, review decisions, and reviewer names you register. This data belongs to your workspace and is isolated from other users by database row-level security.

Usage records: for rate limiting and billing we log which metered endpoints your account calls and when. We do not log the content of your documents in usage records.

How the consortium sharing works

Identifying fields in a shared transaction (names, addresses, references) leave your workspace only as SHA-256 hashes — one-way fingerprints that allow matching without revealing the underlying value. Amount, currency, and date are shared in clear for risk scoring. Nothing is shared until a transaction passes the confidence gate or is approved by a registered reviewer.

AI processing

If you use AI document extraction (a Pro feature you invoke explicitly), the document text you paste is sent to a third-party model provider (Google or Groq, depending on configuration) to be structured. The text is treated strictly as data, capped in length, and the result is re-validated before anything is stored. We do not use your documents to train models.

Service providers

We rely on Vercel (hosting), Supabase (authentication and database), Stripe (payments, when billing is enabled — card details go to Stripe directly and never touch our servers), and the AI providers named above. Each processes data only to provide its service.

Retention and deletion

Your workspace data is retained while your account exists. The audit trail is append-only by design — it records that decisions happened and who made them. To delete your account and its data, email us at the address below; we will confirm completion.

Contact

Privacy questions or requests: abuahmad105116@gmail.com.