Privacy Policy

This Privacy Policy explains how DocPilot AI (“we”, “us”) collects, uses, and protects your information when you use our bank-statement conversion service (the “Service”). We designed the Service to handle sensitive financial documents with minimal retention.

• Account information: your name, email, and authentication details when you sign up (including via Google sign-in).
• Uploaded documents: the bank statements and images you submit, and the transaction data extracted from them.
• Payment information: subscription and billing records. Card details are collected and stored by our processor, Razorpay — we never see or store your full card number.
• Usage and device data: analytics events, pages viewed, approximate activity, and a hashed IP address used for abuse prevention.

• To provide the Service — convert your documents and deliver the output files;
• To manage your account, subscription, and page allowance;
• To prevent fraud and abuse of the free-conversion allowance;
• To improve the Service and understand how it is used (aggregate analytics);
• To communicate with you about your account and support requests.

We do not sell your personal information, and we do not use your documents to train AI models.

We minimize how long we keep your files. Uploaded original documents are deleted shortly after processing. Guest (no-account) conversions and their data are removed within about 24 hours, and guest sessions expire after 30 days. For registered users, extracted transaction data is retained in your account history until you delete it or close your account. Deleting your account removes your associated data.

We use trusted third parties to operate the Service, each processing data only as needed:

• Supabase — authentication, database, and file storage.
• Vercel — application hosting.
• OpenAI and Mistral — AI-assisted extraction and OCR. Data is processed to return results and is not used to train their models.
• Razorpay — payment processing.
• PostHog — product and usage analytics.
• Trigger.dev — background processing of conversion jobs.

We use encryption in transit, private storage buckets, access controls, and row-level security to protect your data. No method of transmission or storage is 100% secure, but we take reasonable measures to safeguard your information and limit how long sensitive files are kept.

Depending on your location, you may have rights to access, correct, export, or delete your personal data. You can download your data and delete your account at any time from your account settings, or contact us to exercise these rights.

We use essential cookies to keep you signed in and to track the free-conversion allowance for guest users, and analytics cookies to understand usage. You can control cookies through your browser settings, though disabling essential cookies may affect functionality.

The Service is not directed to individuals under 18, and we do not knowingly collect their personal information.

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated effective date.

For privacy questions or requests, contact us at support@docpilot.ai.