1. Who we are

InboxDoc is an AI-powered invoice processing service. We help businesses automatically extract data from PDF invoices received via email. This Privacy Policy explains how we collect, use, and protect your data.

2. What data we collect

Account data: Your email address and name when you register.
Email metadata: Sender, subject, and date of emails containing PDF invoices.
Invoice data: Vendor name, invoice number, amount, date, and currency extracted from PDF or XML attachments.
OAuth tokens: Access and refresh tokens for Gmail or Outlook to scan your inbox on your behalf. For IMAP accounts, an encrypted app password is stored instead.
Approximate location: Your country (e.g. "BG", "DE"), derived once from your IP address at signup for analytics purposes. We do not store the IP address itself.
Forwarded emails (optional): If you use InboxDoc's optional forwarding address, we receive only the content of emails forwarded or sent directly to that address - no access to your actual mailbox. The forwarded email itself is deleted immediately after processing, or within 24 hours at most if processing fails.

3. What we do NOT collect

We do not read or store the body of your emails.
We do not access emails without PDF attachments.
We do not sell your data to third parties.
We do not store your Gmail or Outlook password - access is granted via OAuth. For IMAP accounts, your password is encrypted before storage and never stored in plain text.
We do not store your precise location or IP address - only the derived country.
We do not retain the original PDF or XML file - only the structured data extracted from it.

4. How we use your data

We use your data solely to provide the InboxDoc service: scanning for invoices (PDF or structured e-invoice XML), extracting structured data, and displaying it in your dashboard. Where a document can't be read deterministically from structured XML, invoice data is processed using the Anthropic Claude API under strict data processing terms, as a fallback only.

5. Data storage and security

Your data is stored in Supabase (EU/Ireland region, eu-west-1) with row-level security - meaning only you can access your own data. The application itself runs on Vercel in the EU Dublin region (dub1). OAuth tokens are encrypted at rest. We use HTTPS for all data transmission.

6. Your rights (GDPR)

If you are based in the EU, you have the right to access, correct, delete, or export (data portability) your personal data, and to object to or restrict certain processing, at any time. To exercise these rights, contact us at info@techarenabg.com, or use the self-service options below. You also have the right to lodge a complaint with a data protection supervisory authority - since we are established in Bulgaria, the lead authority is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg; you may also contact the supervisory authority in your own country of residence.

7. Data retention and deletion (Right to Erasure)

We retain your invoice data for as long as your account is active. You can permanently delete your account at any time from Account settings → Danger zone - this immediately and irreversibly:

Deletes all your extracted invoice data - we never store the PDF or XML files themselves, only the data extracted from them
Disconnects your email accounts and revokes their access (OAuth tokens are actively revoked with the provider, not just deleted from our database)
Deletes your notifications, profile, and login information
Cancels any active subscription, so you're never billed after deletion

We send a confirmation email once deletion is complete. We do not use "soft delete" - deleted data is not retained in any recoverable form, except billing records we may be legally required to retain under Bulgarian commercial/tax law.

8. Cookies and consent

We use strictly necessary cookies to keep you signed in and remember your preferences. We additionally use Google Analytics 4 (GA4) to understand usage of our marketing site.

GA4 is wired through Google Consent Mode: analytics cookies default to denied and are only granted after you explicitly accept via the cookie banner; declining keeps them denied. You can change your choice at any time by clearing the cookie banner's cookie in your browser settings. Google Ads conversion tracking is not currently active; we will update this section if that changes.

Our XRechnung & ZUGFeRD viewer page embeds a YouTube video. Nothing is loaded from YouTube before you click - you only see a static preview image. Only once you actively click the play button is the video loaded from YouTube (Google LLC) via the more privacy-friendly youtube-nocookie.com domain; at that point, data may be transferred to the US and cookies may be set.

9. Third-party services (processors)

Supabase - database and authentication (EU/Ireland, eu-west-1)
Vercel Inc. - application hosting (EU region Dublin, dub1)
Cloudflare, Inc. - network/DNS infrastructure, and inbound email routing for the optional forwarding address feature
Resend - transactional email delivery (account, billing, and admin notification emails), EU region
Anthropic, PBC - AI-assisted invoice extraction, fallback path only (USA; Standard Contractual Clauses under Art. 46 GDPR)
Lemon Squeezy, Inc. - payment processing, acting as merchant of record
Google LLC - Gmail API access (with your explicit consent); Google Analytics (GA4), only after cookie consent
Microsoft Corporation - Outlook/Microsoft Graph API access (with your explicit consent)
ipapi.co - one-time IP-to-country lookup at signup; we only retain the resulting country code

For the full, current sub-processor list and our technical and organisational measures, see our Data Processing Agreement (DPA).

10. Contact

For any privacy-related questions: info@techarenabg.com