Legal

Terms of Service

1. The service

DocAI extracts structured data from business documents (PDFs and images) using OCR and AI models, and provides a review interface to verify and correct the results. The Service is operated by SYNAIRO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Złota 75A/7, 00-819 Warszawa, Poland. By using the Service you agree to these terms.

2. AI output requires review

Extracted values are AI predictions, not certified data. They can be wrong, incomplete, or misplaced, including amounts, tax numbers, and dates. You are responsible for reviewing and confirming extracted data before using it in accounting, contractual, or any other consequential context. The Service provides confidence scores and source highlighting to support that review, not to replace it.

You are interacting with an AI system. Under Article 50 of Regulation (EU) 2024/1689 (the EU AI Act), we inform you that uploading a document for analysis, and using "Describe what you need" to generate extraction fields from your own wording, both involve direct interaction with an AI system operated by us. AI-produced content (extracted field values, suggested titles, summaries, and generated field proposals) is a suggestion for your review, not a finished or certified output. The Service does not make automated decisions producing legal or similarly significant effects about you; see the Privacy Policy for the full automated-decision-making statement.

3. Your account and acceptable use

• You must provide accurate account information and keep credentials confidential.
• Only upload documents you have the right to process.
• You are responsible for having a lawful basis to process the personal data in the documents you upload, including any special-category data.
• The Service is not designed or certified for health, biometric, or other special-category personal data (GDPR Art. 9); do not upload such data unless you have ensured it is lawful to do so.
• Do not attempt to disrupt the Service, evade usage limits, probe security, or process unlawful content.
• Free-tier usage limits apply and may change; paid plans are governed by the pricing shown at purchase.

4. Paid plans and billing

Paid plans are currently offered for business or professional use. They renew monthly in USD until canceled. Displayed prices exclude applicable VAT or sales tax; Stripe calculates and adds applicable tax at Checkout based on the billing information you provide.

You can manage payment details, tax information, invoices, plan changes and cancellation through the Stripe billing portal. Cancellation takes effect at the end of the current paid service period, and access continues until then. Downgrades are scheduled for the next period; an upgrade may create an immediate prorated charge and activates only after that payment succeeds.

Payments may be retried after a failure. We do not provide automatic prorated refunds, except where required by law; contact support for an exceptional billing review. Deleting your account schedules any current subscription to stop renewing and does not create an automatic refund.

5. Your data

Document handling, storage, and retention are described in the Privacy Policy, which forms part of these terms. You retain all rights to your documents and extracted data. We claim no ownership and do not train AI models on your content.

6. Availability and changes

The Service is provided "as is" and may change, be interrupted, or be discontinued. During beta, features may be added or removed without notice. We aim for high availability but do not guarantee it.

7. Liability

To the maximum extent permitted by law, we are not liable for indirect or consequential damages, lost profits, or losses resulting from reliance on unreviewed AI output. Our total liability for any claim is limited to the amounts you paid for the Service in the 12 months preceding the claim (or EUR 100 if you paid nothing). Nothing in these terms limits liability that cannot be limited by law.

8. Termination

You may stop using the Service and delete your account at any time. We may suspend or terminate accounts that violate these terms. On termination, saved data is deleted in accordance with the Privacy Policy.

9. Governing law

These terms are governed by the laws of Poland. Disputes are subject to the competent courts of Poland, without prejudice to mandatory consumer protections in your country of residence.

10. Contact

Questions about these terms: legal@synairo.com.

Security

1. Data transmission

All connections to DocAI are encrypted in transit using TLS. Insecure requests are redirected to HTTPS, and a Strict-Transport-Security (HSTS) header is sent over HTTPS so browsers continue to use secure connections.

2. Authentication

• User authentication is handled by Clerk (clerk.com), a third-party identity provider. DocAI never stores raw passwords. Clerk issues short-lived JWT session tokens that are verified on each request, pinned to our own Clerk instance.
• Admin authentication uses PBKDF2-SHA256 password hashing with HttpOnly session cookies and CSRF protection. Admin sessions time out after a configured period.
• API keys are generated with a cryptographically secure random generator. Only a SHA-256 hash of the key is stored. The full key is shown only once at creation and cannot be recovered. Keys are scoped and can be revoked immediately.

3. Webhook security

Each webhook endpoint is assigned a per-webhook HMAC-SHA256 signing secret. Every delivery includes a X-DocAI-Signature: sha256=… header so your endpoint can verify that the payload came from DocAI and was not tampered with in transit.

Verification example (Python):

import hashlib, hmac

def verify_signature(secret: str, payload: str, timestamp: str, header_sig: str) -> bool:
    message = f"{timestamp}.{payload}"
    expected = hmac.new(secret.encode(), message.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(f"sha256={expected}", header_sig)

4. Document storage

• Encryption at rest: the production PostgreSQL database is encrypted at rest by Railway. Stored document objects and their metadata are automatically encrypted at rest by Cloudflare R2 using AES-256-GCM and Cloudflare-managed encryption keys.
• Documents you analyse without saving are processed and not written to your history. When you save an analysis, its results (and, where document storage is enabled, the uploaded file itself) are stored under your account so you can reopen, share, and export them.
• Stored files are kept in an owner-scoped location and downloaded through short-lived links, so one account's stored files cannot be reached from another account.
• Saved analyses are kept until you delete them (unless a retention period is configured for the deployment). You can delete any record, or all of them, at any time. See the Data Retention section below.
• We do not train AI models on your documents.

5. LLM / OCR subprocessors

Document content (page images or OCR text) is sent to an AI provider (currently OpenAI or OVH AI Endpoints, as configured by us) for field extraction. These providers act as subprocessors. Review their data-processing terms, and use the field-masking and redaction tools, before processing sensitive documents.

You are responsible for having a lawful basis to process the documents you upload, including any special-category data. The Service is not specifically designed or certified for health, biometric, or other special-category personal data.

6. HTTP security headers

DocAI sets the following security headers on responses:

• Content-Security-Policy
• Strict-Transport-Security (over HTTPS)
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Referrer-Policy: strict-origin-when-cross-origin
• Cross-Origin-Opener-Policy: same-origin
• Cross-Origin-Resource-Policy: same-origin
• Permissions-Policy (camera, microphone, and geolocation disabled)

7. Responsible disclosure

If you discover a security issue, please email security@synairo.com. We aim to respond within 72 hours and address confirmed issues promptly. Please do not disclose publicly until a fix is available.

8. Infrastructure

DocAI runs on Railway in its EU West region, with TLS terminated at the platform edge. The application connects to PostgreSQL over Railway's private, WireGuard-encrypted network. Stored files are kept in a Cloudflare R2 bucket restricted to the European Union jurisdiction; transfers between the application and R2 use HTTPS/TLS. The database and bucket are not exposed as public application resources. See the subprocessors list below for the providers involved.

Data Trust

1. No model training on your data

Your documents and extracted data are never used to train AI models. When DocAI sends page images or OCR text to an AI provider for field extraction, that transmission is governed by the provider's API terms, which explicitly exclude API request data from model training. OpenAI's API data usage policy and OVH AI Endpoints' terms both reflect this. We claim no rights over your documents.

2. Document retention

Documents you process without saving are not written to persistent storage. They exist only in memory for the duration of the analysis request. When you choose to save an analysis to your History, the extracted results (and, where object storage is enabled, the original file) are kept under your account until you delete them. There is no time-based automatic deletion by default. See the Data Retention section for the full policy.

3. EU data-residency processing

DocAI supports a per-account EU data-residency mode. When a user enables it, AI field extraction and the sensitivity scan are routed exclusively to EU-hosted AI endpoints. This is a per-account setting; an operator-configured default applies for accounts with no explicit preference. EU-capable AI provider configured for this deployment: OVH AI Endpoints (France).

Note: OCR (optical character recognition) and object storage (file retention) are separate processing activities. Their data-residency is determined by the deployment configuration independently of the per-account EU processing setting described above.

4. Access controls

Each saved analysis is stored under the owning account and is accessible only through authenticated requests tied to that account. Sharing requires an explicit action by the account holder; shared links carry expiry dates and can be revoked at any time. Workspace documents are accessible only to members of that workspace.

Data Retention

This section summarises how long DocAI keeps each kind of data. The overall model is simple: nothing you upload or extract is stored unless you save it, and what you save stays until you delete it, bounded by your plan's storage limit rather than a fixed timer.

1. What we keep and for how long

2. No automatic deletion

Saved documents are kept until you delete them. There is no time-based automatic deletion. Your total storage is bounded by your plan's storage limit, and you can free space at any time by deleting documents.

3. Manual deletion

You can delete your data at any time:

• Single analysis: Open the analysis in History, click "Delete."
• All my analyses: Go to History, click "Delete All."
• Account deletion: Request full account and data deletion by emailing privacy@synairo.com. We process deletion requests within 30 days.

Note: documents you have moved into a shared workspace are kept for the workspace and are not removed by your personal "Delete All", so that a team does not lose shared data when one member clears their own history. Remove them from the workspace, or delete them as a workspace owner/admin, to erase them.

4. What we do not do

• We do not use your documents or extracted data to train AI models.
• We do not use web analytics, advertising, or tracking technologies.
• We do not store the raw IP addresses of anonymous visitors, only a hash used for rate limiting.

5. Third-party subprocessors

To provide the Service, document content (page images or OCR text) is transmitted to an AI extraction provider, currently OpenAI or OVH AI Endpoints. These and our other providers may retain request data per their own policies. See the Subprocessors section below for the full list, and the OpenAI privacy policy for their data-handling terms.

6. Questions

Contact privacy@synairo.com for any data retention questions or requests.

Subprocessors

To run DocAI we rely on the service providers below, which process personal data on our behalf as processors (subprocessors). We share data with them only as needed to operate the Service. Some are used only when a corresponding feature is enabled, and the active AI provider can be switched by us.

International transfers

Some providers are located outside the European Economic Area, in particular in the United States. Where personal data is transferred outside the EEA, we rely on an appropriate safeguard such as an adequacy decision (including the EU–US Data Privacy Framework, where the provider is certified) or Standard Contractual Clauses. See section 9 of the Privacy Policy.

Changes

We may add or replace subprocessors as the Service evolves. Material changes will be reflected on this page. For questions or the current DPA position for a specific provider, contact privacy@synairo.com.