DocuMetra (“we,” “us,” or “our”) provides an automated financial document processing service that extracts, verifies, and reconciles bank statement data. This Privacy Policy describes how we collect, use, store, and protect information when you use our platform and services (the “Service”).
By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy.
1. Information We Collect
1.1 Account Information
When you create an account, we collect the information you provide during registration, including your name, email address, and password. Passwords are stored using secure one-way cryptographic hashing and are never stored in plain text.
1.2 Workspace & Organization Information
When you create or join an organization workspace, we collect the organization name and membership information. Organization workspaces are used to scope data access and enforce multi-tenant isolation across the platform.
1.3 Uploaded Financial Documents
When you upload documents (such as bank statements in PDF, PNG, JPG, or WEBP format), we receive and store the original document files. Each uploaded file is cryptographically hashed using SHA-256 for integrity verification and tamper detection.
1.4 Extracted & Processed Financial Data
Through our automated processing pipeline, we extract structured data from your uploaded documents, including transaction dates, descriptions, amounts, counterparty names, running balances, statement periods, and reconciliation results. This extracted data is stored within your organization’s workspace scope.
1.5 Technical & Usage Information
We collect standard technical information necessary to operate and secure the Service, including IP addresses for rate limiting and security purposes, browser type, and general usage patterns such as page views and feature interactions.
2. How We Use Your Information
We use the information we collect to:
- Provide and operate the Service, including document extraction, verification, reconciliation, and financial intelligence features
- Authenticate your identity and manage access to your workspace
- Process your uploaded financial documents and generate structured output
- Maintain audit trails of document reviews, edits, and approval actions within your workspace
- Enforce rate limits and protect against abuse
- Respond to your support and contact inquiries
- Improve and maintain the reliability, performance, and security of the Service
3. Document Processing & Storage
3.1 Processing Pipeline
Uploaded documents are processed by our automated extraction pipeline, which parses document content, extracts tabular financial data, performs mathematical balance verification, and generates reconciliation results. Processing occurs within your organization’s tenant boundary.
3.2 Tenant-Isolated Storage
All uploaded documents and extracted data are stored within strict organization-scoped boundaries. Storage paths are structured by organization identifier, and all database queries enforce organization-level scoping. Documents belonging to one workspace are not accessible to other workspaces.
3.3 Integrity Verification
Each uploaded document is assigned a SHA-256 cryptographic hash at the time of upload. This hash is used for tamper detection and integrity verification purposes.
4. Service Infrastructure
We use industry-standard infrastructure components to deliver the Service, including relational databases for structured data storage, caching services for performance and rate limiting, and object storage services for document file storage. Your data may be processed and stored across the infrastructure regions used by our hosting and storage providers.
5. Security Practices
We implement security measures designed to protect your information, including:
- Multi-tenant data isolation at both the database query level and file storage level
- Cryptographic password hashing using industry-standard algorithms
- JWT-based authentication with time-limited access tokens
- SHA-256 document integrity hashing
- Role-based access control (RBAC) with granular permission enforcement within workspaces
- Rate limiting to protect against abuse and brute-force attacks
- Input validation, filename sanitization, and MIME type verification on all file uploads
While we take reasonable measures to protect your information, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security.
6. Data Retention & Deletion
We retain your account information, uploaded documents, and processed data for as long as your account remains active and as reasonably necessary to provide the Service. You may request deletion of specific documents through the Service interface or by contacting us. Upon account termination, we will delete or anonymize your data within a reasonable period, subject to any legal obligations requiring longer retention.
7. Data Sharing
We do not sell your personal information or uploaded document data. We may share information in the following limited circumstances:
- Infrastructure providers: We use third-party hosting, database, and storage providers to operate the Service. These providers process data on our behalf and are subject to their own security and privacy practices.
- Legal requirements: We may disclose information if required by applicable law, regulation, legal process, or governmental request.
- Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.
Your uploaded financial documents are processed strictly within your tenant boundary and are not used for commercial purposes beyond providing the Service to you.
8. Your Choices & Rights
Depending on your jurisdiction, you may have certain rights regarding your personal information:
- Access: You may access your account information and documents through the Service interface at any time.
- Correction: You may update your account information through your account settings.
- Deletion: You may delete individual documents through the Service interface or request account deletion by contacting us.
- Export: You may export your processed document data in XLSX, CSV, or JSON format through the Service.
To exercise any of these rights, you may use the relevant features in the Service or contact us.
9. International Availability
The Service is available to users internationally. By using the Service, you acknowledge that your information may be processed and stored in the regions where our infrastructure providers operate, which may be outside your country of residence.
10. Cookies & Local Storage
The Service uses browser local storage to persist your display theme preference (light or dark mode). Authentication is handled through JWT Bearer tokens transmitted via HTTP headers, not through cookies. We do not use third-party tracking cookies or advertising cookies.
11. Children’s Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date at the top of this page and may provide additional notice through the Service. Your continued use of the Service after changes become effective constitutes your acceptance of the updated policy.
13. Contact Us
If you have questions about this Privacy Policy or our data practices, please reach out through our Contact Us page.