Privacy Policy

Last updated: October 2026

ParseRelay ("we", "our", or "us") provides an enterprise intelligent document processing (IDP) platform designed to extract structured data from business documents with sub-millimeter precision, human review workflows, and automated relay integrations.

We believe data privacy, security, and tenant isolation are fundamental engineering requirements. This Privacy Policy explains how we collect, process, secure, and handle your information.

1. Information We Process

1.1 Account & Authentication Data

When you create a ParseRelay account or invite team members to an organization, we collect:

  • Full name and business email address
  • Password hash (processed via Better Auth with Argon2id)
  • Session timestamps and IP addresses for fraud prevention and audit logs
  • Organization name and tenant settings

1.2 Customer Document Data & Extraction Payloads

When you submit documents (invoices, receipts, bank statements, bills of lading) via our web application, REST API, native MCP server, or dedicated email forwarders, we process:

  • Raw document files (PDF, PNG, JPEG, TIFF, WEBP)
  • Extracted key-value pairs, multi-page tables, and scalar fields
  • Coordinate bounding boxes [ymin, xmin, ymax, xmax]
  • Human reviewer corrections and approval timestamps

Zero Model Training Commitment: We never use customer document data, extracted values, or reviewer feedback to train public, open-source, or third-party artificial intelligence models.

2. Data Sovereignty: BYOS and BYOK

ParseRelay is engineered for zero-trust enterprise compliance:

  • Bring Your Own Storage (BYOS): You can configure ParseRelay to store document payloads directly in your customer-owned AWS S3 or Cloudflare R2 bucket. In this configuration, raw files are processed ephemeral in GPU memory and never persisted on ParseRelay disks.
  • Bring Your Own Key (BYOK): You can provide your own API credentials (e.g. OpenAI or Google Gemini). Invocations are billed under your own enterprise commercial terms.

3. How We Use Information

We process data strictly to provide and maintain our services:

  • Executing OCR and vision-LLM extraction pipelines
  • Rendering the two-column human review verification workbench
  • Relaying approved structured data to configured downstream endpoints (QuickBooks Online, signed HMAC webhooks, cloud buckets, MCP tools)
  • Managing billing quotas, refill credit packs, and automatic failure refunds
  • Investigating system security incidents and monitoring uptime

4. Data Retention & Deletion

  • Default Retention: Extraction jobs, bounding box coordinate metadata, and review audit trails are retained for the duration of your active subscription or in accordance with your organization's configured data lifecycle rules.
  • Immediate Deletion: Organization administrators can trigger hard deletion of documents and extracted JSON at any time. When deleted, files are permanently purged from all active and backup storage within 30 days.

5. Subprocessors & Security Standards

We partner only with security-hardened infrastructure providers:

  • Cloud Hosting & GPU Clusters: Hosted in SOC 2 Type II and ISO 27001 certified data centers with encrypted interconnects.
  • Data in Transit: All data transmitted between your browser, our API, and processing clusters is encrypted using TLS 1.3.
  • Data at Rest: All persisted metadata is encrypted with AES-256.

6. Your Rights Under GDPR & CCPA

Regardless of geographic location, all ParseRelay organizations have the right to:

  • Access, export, and download all processed document records in structured CSV or JSON formats.
  • Request immediate rectification of inaccurate account information.
  • Request complete deletion of organization accounts, document histories, and team memberships (Right to Erasure).
  • Execute a Data Processing Addendum (DPA) with standard contractual clauses.

To exercise these rights or request our DPA, contact our privacy engineering team at privacy@parserelay.com.