Privacy policy
This privacy policy explains how we process personal data when you use the PDF Parse API service (the “Service”), including the website, dashboard, and HTTP API. It is provided in English for users of this product.
1. Data controller
The controller of personal data is:
FRACTAL SOFT sp. z o.o.
ul. Józefa Poniatowskiego 29/4
44-100 Gliwice
Poland
- KRS: 0000696422
- NIP: 5482686629
- REGON: 368341368
Privacy contact: contact@fractalsoft.com.
2. Scope
This policy covers the PDF Parse API product operated by Fractal Soft (for example marketing pages, account dashboard, and /v1 API endpoints). It does not replace the privacy policy of fractalsoft.org, which applies to that separate website.
3. What data we process
Depending on how you use the Service, we may process:
- Account data — email address, password (stored as a secure hash), account/organisation name, and membership role.
- Session and security data — signed session cookie, IP address, and user agent associated with dashboard sign-in sessions.
- API credentials — API token names, token prefixes, and cryptographic digests of tokens (we store hashes, not raw secrets after issuance).
- Billing data — customer and payment records processed by Stripe (for example email, payment method metadata, invoices). Card numbers are handled by Stripe; we do not store full card PAN on our servers.
- Usage and job data — job identifiers, status, page counts, credit ledger entries, timestamps, filenames, and parse options you submit.
- Document content — PDF files you upload and derived outputs (for example JSON extraction results and related artefacts). These may contain personal data if present in the files you send.
- Technical logs — standard application and infrastructure logs needed to operate and secure the Service.
We do not intentionally collect special categories of personal data. If you upload documents that contain such data, you do so under your own responsibility as described in section 10.
4. Purposes and legal bases (GDPR)
- Providing the Service (accounts, API, parsing jobs, credit balance) — Art. 6(1)(b) GDPR (performance of a contract).
- Payments and invoicing — Art. 6(1)(b) and, where required, Art. 6(1)(c) (legal obligations related to accounting/tax).
- Operating, securing, and troubleshooting the Service (including abuse prevention and logs) — Art. 6(1)(f) GDPR (legitimate interest in a secure, reliable service).
- Responding to support or privacy requests — Art. 6(1)(b), (c), and/or (f), as applicable.
5. Document processing, location, and AI
- Uploaded PDFs are processed to fulfil your parse requests on infrastructure we operate in the European Union (EU-region compute and, when configured, EU-region object storage).
- We do not send your uploaded files to third-party generative AI APIs as part of this product.
- Extracted text is returned as structured data; we do not deliberately rewrite or “correct” document wording for model training.
- We do not use your uploaded documents to train machine-learning models for third parties.
6. Retention
- Source PDFs are retained to complete jobs and for short operational follow-up, then purged by automated retention jobs after 7 days by default (configurable for the deployment).
- Parse results and job metadata may be retained longer so you can retrieve outputs and audit usage; you may request deletion subject to GDPR conditions and technical limits.
- Account and billing records are kept for the life of the account and for periods required by law (for example accounting).
- Credit ledger entries are kept to show balance history and resolve billing disputes.
- Session cookies last according to browser/session settings (signed permanent cookie for dashboard login, httpOnly).
7. Recipients and subprocessors
We may share data with processors who support the Service, under appropriate agreements:
- Stripe — payment processing and customer billing portal (Stripe Privacy Policy).
- Hosting / infrastructure providers — EU-based providers for application, database, and worker compute.
- Object storage — S3-compatible storage located in the EU when enabled for file blobs.
- Email delivery — if transactional email (for example password reset) is configured for the deployment.
We do not sell personal data. Where a processor processes data outside the EEA, we rely on appropriate safeguards (for example Standard Contractual Clauses) as required by GDPR. Stripe’s transfers are described in Stripe’s documentation.
8. Cookies
The Service uses essential cookies required for security and sign-in (for example CSRF protection and the signed dashboard session cookie saas_kit_session_id). We do not use third-party advertising cookies on this product site. If we add optional analytics later, we will update this policy and request consent where required.
9. Your rights
Subject to GDPR conditions, you may request:
- access to your data;
- rectification;
- erasure;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interests.
To exercise these rights, email contact@fractalsoft.com. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland: uodo.gov.pl.
10. Your responsibilities for uploaded content
You must have a lawful basis to upload files to the Service. If documents contain personal data of third parties, you act as an independent controller (or processor for your own customer) for that content, and you instruct us to process it only to provide the parse Service. Do not upload unlawful content or data you are not allowed to process.
11. Children
The Service is directed to businesses and developers. It is not directed to children under 16. We do not knowingly create accounts for children.
12. Changes
We may update this policy when our processing practices or legal requirements change. The “Last updated” date at the top will be revised accordingly. Material changes affecting registered users may also be communicated via the Service or email where appropriate.