Privacy Policy
Parsurai ("we", "our") operates the API and dashboard at parsurai.com. This policy explains what data we collect, why we collect it, and your rights.
Last updated: 21 September 2026
Owner-approved wording. No external legal review has been performed; external legal review remains recommended before material enterprise use, significant scale, or a material dispute.
What data we collect
We collect: (a) account data — email, hashed API key prefix, billing identifier from Stripe, hashed email verification tokens with their expiry and use timestamps, and outbound webhook configurations (URLs, descriptions, and encrypted secrets); (b) invoice payloads — the text, files, or URLs you submit for extraction. Payloads sent to the extraction API are processed transiently and not retained beyond the request unless you explicitly opt in to history; documents submitted to an accounts-payable workflow are stored for your plan's workflow retention window, described under Retention; (c) usage metadata — request timestamps, endpoint, response status, plan tier, and webhook delivery attempt logs (delivery status, response codes, latency); (d) cookies and local storage — strictly necessary session, security, and interface-preference values only, listed in full in the Cookie Policy.
Legal bases for processing
Account creation, document extraction, and subscription management are processed to perform our contract with you, Art. 6(1)(b) GDPR. Retention of billing records for statutory tax periods rests on our legal obligation, Art. 6(1)(c) GDPR. Service security, abuse prevention, rate limiting, and error diagnostics rest on our legitimate interest in operating a reliable and secure service, Art. 6(1)(f) GDPR. Where Parsurai processes third-party personal data contained in customer-submitted documents solely to provide the contracted extraction and workflow services, the customer acts as controller and Parsurai as processor; that processing is governed by the incorporated Data Processing Addendum (DPA).
Whether you have to provide data
Providing an email address and a password is a contractual requirement within the meaning of Art. 13(2)(e) GDPR: without them no account can be created and the contract cannot be performed. For a paid subscription we additionally need your company legal name, a contact name, a business email address, and your postal address — a contractual requirement, and for the invoices we issue also a statutory one under § 14 UStG; without them no paid subscription can be concluded. The content of the documents you submit is provided voluntarily and you decide what to upload, but the extraction service cannot be performed without it. No law obliges you to provide us with data; the only consequence of withholding it is that the corresponding part of the service cannot be used.
How we use it
We use our own account, contract, billing, security and usage data to provide and secure the service. Personal data contained in customer documents are processed solely to provide the functions requested by the customer and under its documented instructions. We do not sell personal data or use customer invoice content for cross-customer model training.
Automated decision-making
We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22(1) GDPR. Our models extract, classify, and split document content and flag anomalies for attention; every output carries a confidence score, stays editable, and is reviewed by you or your team before it is used. No decision about your account, your price, or your eligibility is made by a model. Automated abuse prevention (Cloudflare Turnstile, rate limiting) can block an individual request to the public demo or the API; that decides nothing about your contract, and you can reach us at contact@parsurai.com if a request is blocked in error.
International transfers
Some subprocessors process data outside the EU/EEA. The transfer mechanism relied on under Art. 46 GDPR is stated per provider in the subprocessor table on this page and on our Subprocessors page. Where a mechanism is shown as pending confirmation, it has not yet been agreed with that provider and remains under legal review.
Recipients
If you use the public demo, Cloudflare Turnstile receives your IP and browser data for verification. Documents you submit to an accounts-payable workflow are stored by Cloudflare R2 on our behalf. Backend error events are transmitted to Sentry for error monitoring. We do not share your documents with identity providers or with Turnstile.
Retention
Account data: kept for the lifetime of your account plus 30 days after cancellation. Invoice payloads submitted to the extraction API: processed transiently and discarded after extraction unless invoice history is enabled. Accounts-payable workflow documents: the source document you upload and the artifacts derived from it are written to object storage and retained for your plan's workflow retention window — 0 days on Free, Hobby and Starter, 30 days on Pro, 90 days on Business — after which they are purged. Webhook delivery logs: retained according to your plan limits (30 days for Pro, 90 days for Business) and automatically pruned. Separately, we retain the following operational and infrastructure records, independent of the account, contract, invoice and statutory periods described above: application and operational logs for up to 7 days; error-monitoring records for up to 30 days; email-delivery records for up to 30 days; and database point-in-time recovery history for up to 6 hours. We may delete these operational records earlier where they are no longer necessary for the purposes described above, and may extend them where necessary to comply with a legal obligation, to establish, exercise or defend legal claims, to investigate security incidents, to prevent fraud, or for another lawful purpose. Proof of accepted legal documents after account deletion: If you delete your account, we delete your account data as described above. One narrowly limited exception remains: evidence that you accepted the legal documents required to use the service. We keep exactly one record per original acceptance, containing only an internal account identifier, the document type (Terms, Privacy Policy, B2B attestation or DPA), its version, the time you accepted it, and the date this retention expires. We do not keep your name, your email address, invoice content, or any other account data. The legal basis is Art. 17(3)(e) GDPR (establishment, exercise or defence of legal claims); the duration follows the regular limitation period of §§ 195, 199(1) BGB, which starts at the end of the year in which the claim arose. Retention ends on 31 December of the third calendar year following deletion of the account. When that period expires, this record is deleted as well.
Your rights (GDPR)
You may request access, correction, deletion, restriction, portability, and objection. Email contact@parsurai.com. We respond within 30 days. You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). On erasure, see the narrowly limited exception for consent evidence described in the "Retention" section.
Data protection officer
We have not designated a data protection officer. The conditions of Art. 37(1) GDPR are not met — our core activity consists neither of regular and systematic monitoring of data subjects on a large scale nor of large-scale processing of special categories of data — and the threshold in § 38(1) BDSG of at least 20 persons constantly engaged in automated processing is not reached. The assessment is documented and is redone whenever the processing changes. Data protection enquiries reach the controller directly at contact@parsurai.com.
Contact
Data controller: Dr. Sadjad Sadeghi, trading as JadayLix Studio, Schieferkamp 41, 30455 Hannover, Deutschland. Email: contact@parsurai.com. For questions about this Privacy Policy, your rights, or other data-protection matters, contact us at this email address.
Sub-processors
We use the following providers to process personal data on our behalf under Art. 28 GDPR. This list is generated from the same source as our Subprocessors page, so the two cannot state different providers.
| Provider | Purpose | Processing location | Transfer mechanism (Art. 46) | Data processing agreement (Art. 28) |
|---|---|---|---|---|
| OpenAI | LLM extraction, classification and anomaly detection | United States | EU Standard Contractual Clauses (2021/914) via the OpenAI DPA | signed |
| Mistral | OCR and bounding-box extraction | EU (eu-west-3) | Not applicable — EU processing | signed |
| Railway | Application hosting (api, worker, publisher) | EU | Not applicable — EU processing | signed |
| Neon | PostgreSQL database hosting | EU (Frankfurt, eu-central-1) | Not applicable — EU processing | signed |
| Vercel | Frontend hosting | EU (fra1) | Not applicable — EU processing | signed |
| Upstash | Rate limiting and task broker | EU (eu-west-1) | Not applicable — EU processing | signed |
| Resend | Transactional email | United States | EU Standard Contractual Clauses (2021/914) via the Resend DPA | signed |
| Stripe | Subscription billing | United States | EU-U.S. Data Privacy Framework (certified), with EU Standard Contractual Clauses (2021/914) incorporated as fallback via Stripe's Data Transfers Addendum | signed |
| Cloudflare | Abuse prevention (Turnstile) and object storage (R2) for workflow documents | United States | EU Standard Contractual Clauses (2021/914) via the Cloudflare Customer DPA | signed |
| Sentry | Backend error monitoring (send_default_pii disabled) | EU (Frankfurt) event storage, with some US-based subprocessors (Twilio/SendGrid, Intercom) | EU-U.S. Data Privacy Framework (Sentry certified), with EU Standard Contractual Clauses (2021/914) incorporated as fallback via Sentry's DPA — also covers onward transfers to Sentry's non-EU subprocessors (Twilio/SendGrid, Intercom) despite EU-region event storage | signed |