Privacy Policy

1. Who we are

SensiDocs is operated by 1001449298 Ontario Inc., doing business as “SensiDocs” (“SensiDocs”, “we”, “us” or “our”), a corporation incorporated in Ontario, Canada. You can reach us about anything in this policy, or ask for our postal address, at hello@sensidocs.com.

This policy covers our marketing website, the SensiDocs web application, the SensiDocs API and webhooks, and the private email addresses we provide for sending in documents (together, the “service”).

2. Our two roles: controller and processor

We handle personal data in two different capacities, and it matters which one applies.

• Documents our customers submit. When a customer uploads a document, forwards it to its document address or sends it through the API, we process any personal data in that document, and the data we extract from it, on the customer's behalf and under its instructions. For this data we act as a processor (under GDPR and UK GDPR) or service provider (under US state privacy laws). The customer is the controller or business responsible for it. If your personal data appears in a document a company sent to SensiDocs, please contact that company first; we will help them respond. Our commitments for this data are set out in our Data Processing Addendum.
• Account, billing and website data. For information about the people who use or pay for the service, and for messages sent to us through our website, 1001449298 Ontario Inc.acts as the controller (or business) and decides how that data is used.

3. Information we collect

Account information

When you sign up or are invited to a company account, we collect your name, work email address, company name, your role in the account (for example, admin or operator) and your login details. We also keep records of the teammates and seats on each account.

Billing information

Payments are handled by Stripe. Your card details are entered with and handled by Stripe; SensiDocs does not store them. We receive and keep information about your plan, billing period, subscription status and whether payments have succeeded or failed, so we can manage your account.

Documents and extracted data

Customers submit documents in PDF, JPG or PNG format by uploading them, forwarding them by email to a private document address, connecting a Microsoft Outlook mailbox, or sending them through our API. Our document packs cover logistics documents, accounts payable, insurance submissions, vendor compliance forms, tax forms and staffing paperwork. Depending on what a customer submits, these documents and the data we extract from them can contain personal data such as:

• names and contact details (for example, email addresses, phone numbers and postal addresses);
• taxpayer identification numbers, including Social Security numbers;
• bank account details;
• other information that appears in the document, such as employment, insurance or shipment details.

We also store the corrections, approvals and notes that people at the customer make while reviewing documents, and any emails the product drafts to a customer's suppliers, vendors or other counterparties.

Microsoft Outlook connection

If you choose to connect your Microsoft Outlook mailbox, you sign in with Microsoft and allow SensiDocs to read your mailbox and add categories to emails. We use that access only to:

• look at new emails in your inbox that have attachments, from the start date you choose;
• download PDF and image attachments that may be documents, and process them the same way as an upload;
• add a “SensiDocs: Looks right” or “SensiDocs: Check this” category to the email.

We do not read or store the text of your emails. For an email with a document we check, or one we couldn't check because your plan had no results left, we keep the email's subject, sender, received time and Microsoft's identifier for it, so we can show you the result or what is waiting, and never process it twice. We also keep a fingerprint of each attachment we read, so the same file is never read or charged twice. For an email whose attachments turn out not to be documents, we keep only its identifiers and the time it arrived, so it is not looked at again, and we don't keep the attachments. Emails without attachments leave nothing behind. The access tokens Microsoft gives us are stored encrypted. We don't use mailbox data for advertising or to train AI models, and we don't share it except as described in this policy. You can disconnect at any time in Settings, which deletes the tokens, and you can also remove SensiDocs's access from your Microsoft account settings. If you use the SensiDocs add-in for Outlook, it reads only the email you have open, and sends an attachment to SensiDocs only when you choose to check it.

Usage and log data

When you use the service, our systems record technical and activity information, such as requests made to the app and API, timestamps, and the device and browser information your browser sends. We also keep an audit log that records exports, approvals, API key and integration changes, and changes our staff make to account access.

Contact and waitlist submissions

If you contact us or join a waitlist through our website, we collect what you give us, such as your name, email address, company and message.

4. How we use information

We use the information described above to:

• provide the service, including reading text from documents, extracting fields, verifying them, and storing the results so people at the customer can review, correct, approve, export and send them;
• create and manage accounts, seats and roles, and authenticate users;
• process subscriptions and payments, apply plan limits, and manage failed payments;
• send service emails, such as account and billing notices, and outbound emails to a customer's counterparties that a person at the customer has approved;
• keep the service secure, prevent abuse, and investigate problems;
• respond to questions, support requests, and contact and waitlist submissions;
• comply with legal, tax and accounting obligations, and enforce our terms.

We process documents customers submit only to provide the service to that customer. We do not use customer documents to train AI models.

How AI is used

Text is read from each document and sent to Anthropic's Claude API to extract the relevant fields, and then to verify those fields in a second, independent pass. Anthropic does not use data sent through its commercial API to train its models by default. AI output can be wrong, so every field carries a confidence score, doubtful values are flagged, and people at the customer review and approve data before relying on it.

Emails to people outside your company

When information is missing from a document, the product can draft a request to the customer's supplier, vendor or other counterparty. No email is sent to anyone outside the customer's company unless a person at the customer approves that specific email. Requests to a customer's own teammates are shown as notifications inside the app.

Legal bases (EU and UK)

Where GDPR or UK GDPR applies to data we control, we rely on: performance of a contract (to provide the service you signed up for); our legitimate interests (for example, securing the service, preventing abuse, and responding to enquiries), balanced against your rights; compliance with legal obligations (for example, tax and accounting records); and your consent where we ask for it, which you can withdraw at any time.

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only as described here.

Service providers

We use the following providers to run the service. They process data for us under their own contractual obligations.

Destinations a customer chooses

A customer can export data (CSV or Excel), send it to QuickBooks Online if it connects that integration, retrieve it through the API, or have it delivered to its own systems by webhook. Once data leaves SensiDocs in one of these ways, the customer and the receiving service are responsible for it.

Other situations

• Legal requirements. We may disclose information if we believe in good faith that the law, a court order or a valid government request requires it, or to protect the rights, safety or property of our customers, others or ourselves.
• Business changes. If 1001449298 Ontario Inc. is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.

6. International transfers

Our customers can be located anywhere, and we and our service providers may process information in countries other than the one where you live, including the United States. Those countries may have different data protection laws. Where the law requires it, we take steps to make sure transfers are covered by appropriate safeguards, such as standard contractual clauses.

7. How long we keep information

We keep account information, documents and extracted data while the customer's account is active. We keep some information for longer where we need it to meet legal, tax, accounting or billing obligations, to resolve disputes, or to enforce our agreements.

Customers can ask us to delete documents or their whole account by emailing hello@sensidocs.com. We will delete the data, except for information we are required to keep for the reasons above.

8. Security

The measures we use to protect information include:

• HTTPS/TLS encryption in transit for the website, app, API and webhooks;
• isolation of each company's data, checked on every request;
• role-based access within each account (admins and operators);
• encryption in our database of integration tokens and webhook signing secrets;
• API keys stored only as hashes and shown to you only once, when created;
• HMAC signatures on webhooks, so you can confirm they came from us;
• an audit log of exports, approvals, API key and integration changes, and staff changes to account access.

No system is perfectly secure, and we cannot guarantee the security of information. Please keep your login details and API keys safe and tell us promptly if you think they have been compromised.

9. Cookies and local storage

Our website uses cookies it needs to work, such as the one that remembers your cookie choice. Analytics or advertising cookies are used only if you turn them on in the cookie banner, and you can change that at any time from “Cookie settings” at the bottom of every page. We treat a Global Privacy Control signal from your browser as a request not to sell or share your personal information. The web app keeps your signed-in session in your browser's local storage; signing out, or clearing your browser's site data, removes it. Our Cookie Policy lists every cookie we use.

10. Your privacy rights

Depending on where you live, you may have some or all of the rights below for personal data we control. For personal data in documents a customer submitted, please send your request to that customer; if you contact us, we will pass it on or help the customer respond.

European Economic Area and United Kingdom (GDPR and UK GDPR)

• access the personal data we hold about you and get a copy;
• correct inaccurate or incomplete data;
• have your data erased;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent;
• complain to your local data protection authority.

SensiDocs is offered to businesses in Canada and the United States and is not directed at people in the European Economic Area or the United Kingdom, so we have not appointed a representative there under Article 27 of the GDPR or UK GDPR. If you are in the EEA or the UK and have a question about your personal data, contact us at hello@sensidocs.com and we will help.

California (CCPA as amended by the CPRA)

• know what personal information we collect, use and disclose, and access a copy;
• delete personal information;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information (we do not sell personal information or share it for cross-context behavioral advertising);
• limit the use of sensitive personal information where the law provides that right;
• not be discriminated against for exercising these rights.

You may use an authorized agent to make a request. We may ask for information to verify your identity, and the agent's authority, before acting on it. Residents of other US states with similar laws may have similar rights, and may appeal if we decline a request.

Canada (PIPEDA)

You can ask to access the personal information we hold about you, ask us to correct it, and withdraw consent to certain uses, subject to legal and contractual limits. You can also complain to the Office of the Privacy Commissioner of Canada.

Quebec (Law 25)

Quebec residents can ask to access and correct their personal information, ask for it in a structured, commonly used technological format, withdraw consent, and ask that information no longer be disseminated where the law allows. You can also complain to the Commission d'accès à l'information du Québec. The person in charge of the protection of personal information at 1001449298 Ontario Inc. is [Name or title of person in charge of the protection of personal information to be added], who can be reached at hello@sensidocs.com.

How to exercise your rights

Email hello@sensidocs.com and tell us what you are asking for and which account or email address it relates to. We may need to confirm your identity before we act. We will respond within the time required by the law that applies to you.

11. Children

SensiDocs is a business service and is not directed to children. We do not knowingly collect personal data from children through our website or accounts.

12. Changes to this policy

We may update this policy as the service changes. When we do, we will change the “last updated” date at the top of this page, and where changes are significant we will take reasonable steps to let customers know.

13. Contact us

• 1001449298 Ontario Inc., doing business as SensiDocs
• Postal address: available on request by email
• hello@sensidocs.com