Privacy policy | IDParse

1. Who is responsible

IDParse is a product of Wally Gallery OÜ, Selleri tn 10-1, 51007 Tartu, Estonia, registry code 16696073 ("we"). This policy covers the website, the customer account and the API. The contact address for data protection is at the foot of this page.

2. Two roles

We act in two different roles, and this policy keeps them apart:

Account data: for the data of your account, your billing and your use of the service, we are the controller.
Documents sent through the API: we process personal data on the documented instructions of the customer. We act as a processor, or as a sub-processor where the customer processes data for another organisation.

3. Documents sent through the API

We process uploaded documents to produce the requested extraction response. We do not add the documents or extracted fields to our account records or application logs. Processing can create temporary files. These files are intended for the processing request, and the software is designed to remove them during cleanup.

We do not use customer documents to train software. We process documents on a server in Germany hosted by Hetzner. A data processing agreement must be in place before you use IDParse to process personal data on your behalf.

If your document was processed through the service of one of our customers, please contact that customer. The customer, or the organisation it acts for, decides why and how the document is processed.

4. Account data that we process

Account: Your name, email address, language preference and password hash. We also keep account status, trial usage and the time of your first scan.
Billing: payments run through Stripe. We keep customer, subscription, invoice and payment identifiers, the amounts and the money they are in, the dates, payment status and payment failure information. We also keep invoice links, the payment method type and its last four digits. We do not store full card numbers.
API keys: A hash and a short prefix of each key, together with its name, status and usage timestamps. We do not save the full readable key in the account database.
Request metadata: The account and API key identifiers, time, endpoint, request method, response status, outcome code, duration, file size, quota period and whether the request counted towards the allowance. These records do not contain the uploaded document or extracted fields. We also keep monthly usage totals.
Account activity: We record sign-ins, password resets and account changes for security. These records may include your IP address and account details. Account activity records are normally kept for about one year.
Server and security logs: the IP address, the time, the requested address and browser information. No document content.

The information marked as required when you create an account is needed to provide that account. Without it, we cannot create the account. Payment information is needed to provide a paid subscription.

5. Why we process this data

We use account and billing data to provide the service. Where you are personally a party to the contract, the legal basis is performance of that contract under Article 6(1)(b) GDPR. Where you act for a business customer, our legitimate interest is managing that customer relationship under Article 6(1)(f) GDPR.
To keep the service secure, to prevent abuse and to find errors (legitimate interest, Article 6(1)(f) GDPR).
To keep accounting records (legal obligation, Article 6(1)(c) GDPR).

We do not sell personal data.

6. Service providers and other recipients

Hetzner Online GmbH, Germany: hosting of the servers.
Stripe: We use Stripe for payments and subscriptions and receive payment and subscription updates from it. Stripe also processes some information for its own fraud prevention and legal obligations. Stripe may process payment and account information outside the European Economic Area, including in the United States and India. Its Privacy Policy and Data Transfers Addendum explain the relevant entities and transfer safeguards.
Email delivery: Email delivery providers process your email address and the content of account and service messages to deliver those messages.

Documents and the data read from them are not sent to Stripe or to the email delivery provider.

7. Cookies

We use cookies for sign-in and site security. The colour theme is remembered in your browser.

We do not use optional analytics. The pages behind the login load no analytics.

8. How long we keep data

Request metadata: Detailed request records are normally kept for about 30 days, and at least until the end of the calendar month in which the request was made. Monthly usage totals and trial counters are kept while your account remains open.
Account data: When account closure is completed, your active account and its API keys are deleted. We keep a closure record with your name, your email address and the reason you gave, so that we can answer questions about the closure and prevent misuse of the free trial. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. After twelve months a nightly job removes the name, the email address and the payment identifier from that record. What stays is the date, the reason and the plan. Some billing and security records remain for the purposes and periods described here. Earlier account information may also remain in backups until those backups expire.
Billing records: We normally keep accounting records for seven years from the end of the relevant financial year. Some records must be kept longer where accounting or tax law requires it.
Server and security logs: Server access and error logs are normally kept for about 30 days. Relevant entries may be kept longer while a specific security incident or related legal claim is being handled.
Backup copies: Backup copies of account, billing and operational records are normally retained for about 30 days. Deleting data from the active service does not immediately remove it from an existing backup.

9. Your rights

Subject to the conditions in the GDPR, you can request access, correction, deletion, restriction of processing and a portable copy of your personal data. You can object to processing based on legitimate interests. Where processing relies on your consent, you can withdraw it at any time without affecting the lawfulness of earlier processing. Contact us using the email address below to exercise these rights.

You can complain to a data protection authority, including the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). You can also complain to the authority where you normally live or work, or where you believe an infringement occurred.

10. Security

Connections to our public website and API use HTTPS. The API communicates with the document engine locally on the same server.
API keys are stored as SHA-256 hashes. Passwords are stored as hashes.

11. Changes to this policy

The current policy and its update date are shown on this page. Where data protection law requires further information or notice of a change, we provide it.