1. Who we are

InboxDoc is an AI-powered invoice processing service. We help businesses automatically extract data from PDF invoices received via email. This Privacy Policy explains how we collect, use, and protect your data.

2. What data we collect

Account data: Your email address and name when you register.
Email metadata: Sender, subject, and date of emails containing PDF invoices.
Invoice data: Vendor name, invoice number, amount, date, and currency extracted from PDF attachments.
OAuth tokens: Access and refresh tokens for Gmail or Outlook to scan your inbox on your behalf. For IMAP accounts, an encrypted app password is stored instead.
Approximate location: Your country (e.g. "BG", "DE"), derived once from your IP address at signup for analytics purposes. We do not store the IP address itself.

3. What we do NOT collect

We do not read or store the body of your emails.
We do not access emails without PDF attachments.
We do not sell your data to third parties.
We do not store your Gmail or Outlook password - access is granted via OAuth. For IMAP accounts, your password is encrypted before storage and never stored in plain text.
We do not store your precise location or IP address - only the derived country.

4. How we use your data

We use your data solely to provide the InboxDoc service: scanning for PDF invoices, extracting structured data, and displaying it in your dashboard. Invoice data is processed using the Anthropic Claude API under strict data processing terms.

5. Data storage and security

Your data is stored in Supabase (EU region) with row-level security - meaning only you can access your own data. OAuth tokens are encrypted at rest. We use HTTPS for all data transmission.

6. Your rights (GDPR)

If you are based in the EU, you have the right to access, correct, or delete your personal data at any time. To exercise these rights, contact us at info@techarenabg.com, or use the self-service options below.

7. Data retention and deletion (Right to Erasure)

We retain your invoice data for as long as your account is active. You can permanently delete your account at any time from Account settings → Danger zone - this immediately and irreversibly:

Deletes all your extracted invoice data - we never store the PDF files themselves, only the data extracted from them
Disconnects your email accounts and revokes their access (OAuth tokens are actively revoked with the provider, not just deleted from our database)
Deletes your notifications, profile, and login information
Cancels any active subscription, so you're never billed after deletion

We send a confirmation email once deletion is complete. We do not use "soft delete" - deleted data is not retained in any recoverable form.

8. Third-party services

Anthropic Claude API - used for AI invoice extraction
Supabase - database and authentication
Google Gmail API / Microsoft Outlook API - email access with your explicit consent
LemonSqueezy - payment processing
ipapi.co - one-time IP-to-country lookup at signup; we only retain the resulting country code

9. Contact

For any privacy-related questions: info@techarenabg.com