Privacy Policy
What we collect, where it is processed, how long we keep it, and what we never do with it.
Who we are
VisionParse is operated by Senithu Software Solutions ("we", "us"), No: 295/A/1, Nedagamuwa, Kotugoda, Sri Lanka, which is the data controller for this service. You can reach us at VisionParse@senithu.lk.
VisionParse converts documents into text and structured data. This policy covers the website, the free tools, the web application and the API.
Documents you upload
Documents are processed on our own servers in Frankfurt, Germany. They are not sent to a third-party OCR service.
When you use an AI extraction feature, the page image and its extracted text are sent to Google’s Gemini API on the paid tier, under which Google does not use the content to train its models.
- Original files — free tools and accounts alike — are deleted within one hour of processing. The system deletes each file the moment its job finishes, and a scheduled sweep removes anything a failure leaves behind.
- Extracted results (the text and fields we produced) are kept for up to 30 days so you can retrieve them, then deleted automatically.
- Your usage history keeps only metadata — file name, page count, confidence score and date — not the document or its contents.
- We never use your documents to train models, our own or anyone else’s.
- We do not sell, rent or share your documents.
Account data
If you create an account we store your email address, authentication identifiers, organisation membership, and a usage record of how many pages and AI extractions you have consumed. Authentication is handled by Firebase Authentication.
When you buy a plan or a credit pack, PayPal sends us your name, email address and a transaction reference so we can issue your invoice. We never receive card numbers.
Usage records are how we apply your plan limits and produce your invoices, so they are retained for as long as the account exists plus any period required for tax and accounting purposes.
Technical data
To keep the free tools fair and the service available we process a small amount of technical data: your IP address and a visitor identifier are used for rate limiting and expire from that system within about 48 hours; server logs record requests for debugging and abuse investigation. Our analytics is aggregated and never receives document content: Vercel Analytics stores nothing in your browser at all, and Google Analytics stores an identifier only where the law allows it or you have agreed to it, as the Cookie Policy sets out. Neither follows you to other sites, and neither feeds advertising.
Legal basis for processing
We process document content and account data to perform the contract you enter into when you use the service. We process limited technical data on the basis of legitimate interest, specifically to prevent abuse of the free tools and to keep the service available.
Marketing email is sent only where you have given separate, specific consent. Creating an account is not consent to marketing, and the consent checkbox is never pre-ticked.
Your rights
You can access, correct or export your data at any time from your account. To delete your account and its data, write to us from the email address on the account and we will complete the deletion within 30 days; self-service deletion from the dashboard is planned but not yet built, and we say so rather than imply otherwise. You can also object to processing, request restriction, and withdraw marketing consent without affecting the service.
If you believe we have handled your data improperly you have the right to complain to your local supervisory authority.
Who receives data, and where it goes
The only third parties that touch your data are the sub-processors listed on our Sub-processors page, each for the single purpose stated there. Document processing and storage stay in Frankfurt, Germany; where a sub-processor moves supporting data outside the EEA, the transfer relies on Standard Contractual Clauses or an adequacy decision.
Children, and automated decisions
The service is not directed at children and we do not knowingly hold an account for anyone under 16. If you believe a child has created one, write to us and we will delete it.
AI extraction reads documents; it does not make automated decisions about people. Nothing in the service produces a legal or similarly significant effect on a person without a human deciding — extracted data is returned to you, and what happens next is your decision.
Security
Traffic is encrypted in transit. Servers are key-only access with password authentication disabled, a default-deny firewall, and automated intrusion banning. Credentials are held outside the application repository with restricted file permissions.
No system is perfectly secure. If a breach affects your data we will notify you and the relevant authority without undue delay.
Changes to this policy
When this policy changes, the change appears here with a new date. If a change meaningfully reduces your rights or expands what we collect, we will tell signed-in users in the product before it takes effect — a policy that changes quietly is not a policy.
Contact
Questions about this document, or a request relating to your data, go to VisionParse@senithu.lk. We answer data requests within 30 days.