Privacy Policy
Website usage measurement
When usage measurement is enabled, we use Umami on our own server to measure visits to public product pages without tracking cookies or session recording. We record the known referral source and page language, and count registration, the first successful operation and the first payment from application records. Document content, filenames, email addresses and account identifiers are not sent to Umami. Detailed measurements and the link between an account and its referral source are retained for up to 90 days. We do not link visits across devices. Page measurement respects Do Not Track and Global Privacy Control signals.
Personal data and processing purposes
Account identifiers and email, login security records, support correspondence, orders and credit movements are processed to provide services, reconcile payments, ensure security and keep required legal records. Publications and prompts may contain personal data. Data comes from account forms, uploads, usage records and payment provider notifications.
Depending on purpose, processing relies on performing the contract, legal obligations, necessary and balanced security interests or separate consent where required. Marketing communication is sent only with your separate permission.
Upload only books, articles, writings and similar publications that you are authorised to upload and process using OCR, transliteration, translation and APIs.
Identity documents, medical reports, bank statements, personal or organisational invoices and private financial documents, personnel files, private correspondence and confidential content must not be uploaded. Sensitive personal data, professional and state secrets, and payment card or authentication secrets are also excluded. Including these materials in a publication does not make uploading them permissible.
Your content and service providers
Your rights in documents remain yours. You grant no general right of use beyond storage, conversion, relevant API processing and access for people you authorise as needed to provide the service. We do not sell your documents, publish them for advertising or use them to train our own model. Output does not remove rights in the source or third-party rights.
Images, text, prompts and context needed for your selected job may be sent directly to AI model services or through API routing services. You choose whether to share a work; removing access cannot delete a copy someone already downloaded.
Authorised staff may access data only as needed for service delivery, support, security, incident investigation and legal duties. Hosting, email, payment and other service recipients process data only for their purposes; legally required information may be provided to competent authorities.
Retention and erasure
- Source files for completed jobs become eligible for scheduled cleanup 270 days after the work was created for accounts that have made a payment, and after 14 days for other accounts. Ongoing jobs and sources marked Keep are excluded from this period.
- Source file cleanup does not completely remove page images, texts, corrections, versions or outputs. These are removed separately when the work or account is deleted. Upload drafts that have not been started are cleaned up 3 days after their last activity, except while preparation is running.
- In the HTML → Markdown tool, conversion runs on our server without AI; uploaded files are deleted when the conversion finishes, and results after 24 hours. Results are not added to your library and are not included in backups. Processing records without file names are kept for 90 days for statistics.
- Order, invoice, payment, acceptance and necessary dispute records are retained with restricted access for as long as applicable tax, accounting and legal obligations require. This period does not justify retaining the entire account or its documents.
- Login events become eligible for cleanup after 180 days. Necessary evidence relating to a security incident is subject to separate limits; providers' technical logs have their own retention conditions.
- The stated maximum backup cycle is 30 days. Deletion from the active system does not mean simultaneous physical erasure from backups. If a backup is restored, deletion requests are reapplied.
- AI providers' temporary file, security and legal retention conditions depend on the processing route used. A request to delete a temporary file does not mean that all of the provider's records are deleted at the same time.
Security and payment
Passwords are hashed; account authorisation, form security and login rate limits are applied. Absolute security is not guaranteed. Card details are entered at Lemon Squeezy; document content is not sent to the payment provider. Service notifications concern your account; marketing consent is separate and revocable.
Your rights and contact details
You may request information and access, correction, erasure, restriction, objection and, where applicable, portability. You may withdraw consent for consent-based processing. Only necessary identity verification is requested and requests are answered within applicable legal deadlines. Your right to contact the competent data protection authority is preserved.
Send requests from your registered email to our contact address or use the Privacy and Data page. Account erasure does not prevent required financial and dispute records from being retained with limited access for the legal retention period.
Privacy & data · Contact · Cookie and Local Storage Policy
Data controller and service provider: Nüsha OCR
Last updated: 2026-10-27 · For questions: info@nushaocr.com