Privacy Policy

1. Introduction

FactExtract ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect information when you use our document processing service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Name (optional)
• Password (stored securely hashed)

2.2 Payment Information

When you make a purchase, payment information is processed by Stripe, our payment processor. We do not store credit card numbers. We receive from Stripe:

• Transaction amounts and dates
• Last four digits of payment card (for reference)
• Billing address (if provided)

2.3 Documents You Upload

We process the documents you upload to provide our service. These documents are:

• Encrypted during transmission and at rest
• Deleted automatically after processing completes
• Never used to train AI models
• Never shared with third parties except as needed to process them

2.4 Usage Data

We automatically collect:

• IP address
• Browser type and version
• Pages visited and features used
• Date and time of access
• Processing statistics (page counts, processing times)

3. How We Use Your Information

We use collected information to:

• Provide and maintain the Service
• Process your documents and generate outputs
• Process payments and manage your account
• Send service-related communications
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Document Processing

AI Processing: Your document text is processed by a Large Language Model accessed via our AI service provider. We utilize a provider who has a zero data retention policy. Your data is not stored by the AI provider, and it is not used to train any AI model or other computer systems. Your data is processed immediately without storage and is not retained for any purpose by the provider.

Data Retention by FactExtract.net:

• Source documents: Deleted immediately after processing. No human being at FactExtract ever sees your documents.
• Output files: Your spreadsheet and database are automatically deleted after 14 days. You can delete sooner on demand from your user portal. Downloads are not available after deletion or expiration. Your "Jobs" page will reflect the file names of the files you uploaded for the 14 day period we keep your spreadsheet and database available for download, or until you delete on demand if sooner.
• Processing logs: Our processing logs do not retain any of your data. They reflect activity metrics like the amount of data and number of files processed, but not the content. Your "Jobs" data will reflect the file names of the files you uploaded for the 14 day period we keep your spreadsheet and database available for download or until you delete them earlier. Thereafter, your file name data is scrubbed to generic names like "Document 01.pdf" for privacy. We do not retain deleted data in any form. Note, however, that your job name and billing references persist for accurate record keeping. If you wish to preserve maximum privacy, do not use private information in job names or billing codes.
• Billing data: Transaction records are retained indefinitely for tax and accounting purposes. You may request deletion of billing data after the applicable statutory retention period (typically 5 years) or as otherwise provided by applicable law.

5. Data Sharing

We share your information only in these circumstances:

• AI Providers: Document content is sent to our AI provider for processing by an LLM.
• Payment Processor: Payment data is shared with our payment provider, Stripe.
• Cloud Infrastructure: Data is stored on secure cloud services and promptly deleted per our privacy practices.
• Legal Requirements: When required by law or legal process. We do not voluntarily cooperate with any request for information, but must honor any legally compelled process. We retain very little information per our privacy practices. Absent an enforceable court order or other legally compulsory process properly served, we do not alter our data retention policies for litigation holds or otherwise. It is the duty of any party seeking data retention to comply with legal process. Our data scrubbing practices are automatic in order to best support privacy obligations our customers may have to their customers. As a result, any compulsory requests for data preservation must be provided with early and actual notice.

We do not sell your personal information to third parties.

6. Data Security

We implement appropriate security measures including:

• All data is transmitted over encrypted connections
• Data is stored in encrypted cloud infrastructure
• Passwords are securely hashed and never stored in plain text
• Access to production systems is restricted to authorized personnel

7. Your Rights

7.1 All Users

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and associated data
• Export your data
• Opt out of marketing communications

7.2 California Residents (CCPA)

California residents have additional rights under the CCPA, including:

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt out of the sale of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights

7.3 European Residents (GDPR)

If you are in the European Economic Area, you have rights under GDPR including:

• Right of access to your data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing

8. Cookies

We use essential cookies for:

• Session management (keeping you logged in)
• Security (CSRF protection)

We do not use tracking cookies or third-party analytics that track you across websites.

9. Children's Privacy

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Service. Your continued use after changes become effective constitutes acceptance.