Privacy policy

1. Information we collect

We collect the following information:

• Account data: the email and name provided when you sign up with Google, or the email you use to sign in with an access link (magic link).
• Conversion metadata: file name, detected bank, number of rows processed, conversion status and date.
• Usage data: how many conversions you run each month, so we can manage your plan limits.
• Technical security signals: a cryptographic fingerprint (hash) of your IP address, device and browser, used only to prevent abuse and the fraudulent creation of multiple accounts. We do not store your IP address in the clear.

2. The content of your files

The files you upload are processed automatically to produce the converted file. We keep copies of processed files in private, encrypted storage for a limited time, only as a calibration sample and for quality control and support (for example, to diagnose a failed conversion or fix a formatting error). That content is not shared with third parties, is not used for advertising or outside training, and you can ask us to delete it at any time (section 6).

3. How we use your information

• To provide and maintain the Service.
• To manage your account and subscription plan.
• To enforce the usage limits of your plan.
• To show your conversion history.
• To improve the Service (aggregated, anonymized statistics).
• To contact you about your account or about changes to the Service.
• To measure how our outreach campaigns perform, so we know which channels bring people who actually use the Service (see section 7).
• To prevent fraud and abuse of the Service, including detecting multiple accounts created from the same device or connection.

4. Storage and security

Your account data is stored in Supabase, a platform that encrypts it in transit and at rest. We authenticate with Google OAuth 2.0 or an email access link (magic link) and we do not store passwords. Access to that data is protected by Row Level Security (RLS), which means each user can only see their own data.

5. Data sharing

We do not sell or rent your personal information. We share data only with the providers we need in order to run the Service, and only as far as each function requires:

• Infrastructure and database: Vercel and Supabase.
• Payment processing: Stripe. Your card details are handled directly by the processor: we neither receive nor store them.
• Email delivery: Resend, for sign-in messages, account notices and product news.
• Analytics and advertising: Google (Analytics and Ads) and Meta, as described in section 7.

We may also share information when it is necessary to comply with legal obligations or to protect our rights or the security of the Service.

International transfers: these providers run infrastructure outside your country of residence, mainly in the United States. When you use the Service, your data is processed in those jurisdictions, whose data protection rules may differ from the local ones.

6. Your rights

You have the right to:

• Access your personal data.
• Ask us to correct inaccurate data.
• Ask us to delete your account and the data associated with it.
• Export your data in a readable format.
• Unsubscribe from product news emails, from the link at the bottom of any of them. Notices about your own account (sign-in, payments, renewals) keep arriving.

To exercise these rights, write to us at support@extractpro.app.

7. Cookies and third-party technologies

We use three kinds of cookies:

• Essential: needed for the Service to work. They keep your session active, remember your preferences and store the detected country (epx_geo) and your cookie choice (epx_consent). They include a technical security cookie (epx_device_id, 30 days) used only to prevent abuse.
• Analytics and attribution: Google Analytics 4, to measure site usage in aggregate, and a first-party cookie (epx_attribution, 90 days) that records which page or campaign brought you here.
• Advertising: Google Ads and Meta Pixel, to measure how our campaigns perform.

Analytics and advertising cookies are not needed to use the Service. You can block them from your browser settings; where the law requires it, we ask for your consent before turning them on, and you can change your choice from the "Cookie preferences" link in the site footer.

8. Changes to this policy

We may update this policy. If the change is material, we will tell you by email or with a notice inside the Service. The date of the last update appears at the top of this page.

9. Contact

For any question about this policy or about your data, write to us at support@extractpro.app.

Governing law and supervisory authority

The processing of your data is governed by Applicable state privacy laws (e.g. the California Consumer Privacy Act, CCPA/CPRA) of United States. We answer access, correction and deletion requests within 45 days. If you believe we did not handle your request properly, you can file a complaint with California Privacy Protection Agency (CPPA) (https://cppa.ca.gov).