Privacy Policy

1. Introduction

This Privacy Policy explains how Extraly ("we", "us", "our"), operated by FOP Melnyk Y. S. (Ukraine), collects, processes, stores, and protects information when you use our AI-powered document processing platform at extraly.ai. We are committed to safeguarding your privacy and handling your data with transparency. By using Extraly, you agree to the practices described in this policy.

2. Information We Collect

2.1 Personal Information

When you create an account, subscribe to a plan, or contact us, we may collect:

• Full name and email address
• Billing information (processed and stored by WayForPay; we do not store full card numbers)
• Company name, if provided
• Communication records when you reach out to support

2.2 Document Data

When you upload files for processing, we temporarily store the original document and the structured data extracted from it. Document data may include financial figures, transaction details, dates, account identifiers, and any other content present in the uploaded file. This data is stored in encrypted form and is subject to your configured retention period.

2.3 Usage Data

We automatically collect certain technical and behavioral information when you interact with the Service, including:

• IP address, browser type, operating system, and device identifiers
• Pages visited, features used, and timestamps of interactions
• API request metadata (endpoint, method, response codes, latency)
• Referral source and session duration

3. How We Use Your Data

We use the information we collect for the following purposes:

• To provide, maintain, and improve the document processing Service
• To authenticate your identity and manage your account
• To process payments and manage subscriptions
• To send transactional emails (account confirmation, password resets, billing receipts)
• To respond to support requests and communicate service updates
• To monitor system performance, detect abuse, and ensure platform security
• To generate aggregated, anonymized analytics that help us improve the product

4. AI Processing and Your Documents

Your uploaded documents are processed by our AI models solely to extract and structure the data you have requested. We want to be explicit about an important commitment: we do not use your documents, extracted data, or any content you upload to train, fine-tune, or improve our machine learning models. Your data is yours — it is processed on demand, delivered to you, and then retained only for the duration you specify.

AI processing occurs on secured infrastructure and document content is never shared with third-party model providers for training purposes.

5. Data Security

We implement robust technical and organizational measures to protect your data:

• All stored documents and extracted data are encrypted at rest using AES-256 encryption
• Data in transit is protected via TLS 1.2 or higher
• Access to production systems is restricted to authorized personnel with multi-factor authentication
• We perform regular security audits and vulnerability assessments
• Database backups are encrypted and stored in geographically separate locations

While no system can guarantee absolute security, we continuously work to protect your information against unauthorized access, alteration, disclosure, or destruction.

6. Data Sharing

We do not sell, rent, or trade your personal information. We may share data only in the following limited circumstances:

• Payment processing: Billing details are shared with WayForPay to process transactions. WayForPay operates under its own privacy policy and PCI DSS compliance.
• Infrastructure providers: We use cloud hosting services to operate the platform. These providers process data on our behalf under strict data processing agreements.
• Legal obligations: We may disclose information if required by law, subpoena, court order, or to protect the rights, property, or safety of Extraly, our users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the transaction, subject to equivalent privacy protections.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data. We honor these rights for all users, regardless of location, to the extent feasible:

7.1 Under GDPR (European Economic Area)

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we limit processing of your data in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing.

7.2 Under CCPA (California)

• Know: Request disclosure of the categories and specific pieces of personal information collected.
• Delete: Request deletion of personal information we have collected.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

8. Cookies

Extraly uses cookies and similar technologies to maintain your session, remember your preferences, and understand how the Service is used. We use the following types of cookies:

• Essential cookies: Required for authentication, session management, and security. These cannot be disabled.
• Functional cookies: Remember your settings and preferences (such as language or display options).
• Analytics cookies: Help us understand usage patterns and improve the platform. These are anonymized and do not track you across other websites.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service.

9. Data Retention

Uploaded documents and extracted data are retained for the period you configure in your account settings, which can be set between 1 and 365 days. Once the retention period expires, documents and associated data are permanently and irreversibly deleted from our systems.

Account information (name, email, billing history) is retained for as long as your account remains active and for a reasonable period afterward to comply with legal and accounting obligations. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law.

10. International Data Transfers

Extraly is operated from Ukraine. If you access the Service from outside Ukraine, your data may be transferred to and processed in Ukraine or other jurisdictions where our infrastructure providers operate. We ensure that any such transfers are protected by appropriate safeguards, including data processing agreements with standard contractual clauses where applicable.

11. Children's Privacy

Extraly is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email or by displaying a notice within the Service at least 14 days before the changes take effect. We encourage you to review this page regularly.

13. Contact

For any privacy-related questions, data requests, or concerns, contact us at:

• Email: [email protected]
• Operator: Extraly (FOP Melnyk Y. S., Ukraine)
• Website: extraly.ai