Privacy Policy
DRAFT — needs legal review before launch. Replace every
[bracketed]placeholder.
Last updated: [date]
AlFasil ("we") turns invoices and receipts into structured data. This policy explains, in plain language, what we store, what we never store, and who helps us run the service.
Operator: [Your full legal name or business name], [city, country]. Contact: [privacy@your-domain].
What we store
| What | Why | How long |
|---|---|---|
| Your account: email address, name, Google account ID, language | To sign you in and run your workspace | Until you delete your account |
| Workspace settings, team members, clients | To run the service | Until you delete them or your account |
| Original files you upload or forward | So you can review them next to the extracted data | Deleted automatically 24 hours after processing by default (you can choose 1 hour to 7 days) |
| Extracted data (supplier, numbers, dates, line items, totals) | It's the product you asked for | Until you delete it or your account |
| Usage counts (pages processed, AI tokens, estimated cost) | Plan limits and billing | While your account exists |
| Billing status and the payment provider's customer ID | To apply your plan | While your account exists (Paddle keeps its own records) |
Free tool (no account): the original is deleted as soon as it has been processed, and the extracted data is deleted within two hours. We store a daily-rotating, one-way hash of your IP address to enforce the free limit; it cannot be turned back into your IP address and is deleted after two days.
What we never do
- We never use your documents or extracted data to train AI models, and our AI provider does not train on API data.
- We never sell or share your data with advertisers. There are no ads and no tracking scripts on the site.
- We never write the content of your documents (or file names) into our logs.
Who processes data for us (sub-processors)
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, temporary file storage, inbound email | Global network |
| Anthropic, PBC | Reading documents with AI (Claude API) | United States |
| Paddle.com Market Ltd | Checkout, payments, invoices and sales tax (merchant of record) | United Kingdom |
| Google LLC | "Sign in with Google" | Global |
Files are sent to Anthropic only to process the document you uploaded, using a short-lived private link.
Your rights
You can, at any time and without asking us:
- download all your data (Settings → Your data → Download all my data), and
- delete your account and all of its data (Settings → Your data → Delete my account).
You can also write to [privacy@your-domain] to access, correct or delete your data, or to object to processing. If you are in the EU/UK you may complain to your data protection authority.
Cookies
We use one cookie, qayd_session, to keep you signed in. It is strictly necessary and is not used for tracking. The free tool's bot check (Cloudflare Turnstile) and the checkout (Paddle) may set their own strictly necessary cookies.
Changes
We'll update the date above and tell signed-in users about material changes.