Privacy policy

Who is responsible

OCR-AI ("the service") is an online document-reading service at ocr-ai.com. The operator of the service ("we") is responsible for the information described in this policy. Send privacy requests through the contact form, under "Privacy and data deletion".

The documents you read

• The file opens in your browser. A PDF is turned into page images in your browser, and the file itself is not sent.
• Each page is sent over an encrypted connection (HTTPS) to our server, which passes it to an AI-based reading engine and streams the result back to you as it is read.
• Our server does not store the file, the page image or the extracted text. They are not written to a database, to files or to system logs.
• The reading engine is run by a cloud infrastructure provider, on a paid service whose terms prohibit using the content to train models. The provider may keep requests for a limited time to detect abuse, under its terms.
• Results and page images are kept only in your browser (IndexedDB): up to the last 30 documents, until you delete them. You can delete them all at once, in the workspace or on this page.

The API and MCP

• When an agent or a script reads a document through the API or the MCP server, the whole file is sent to our server, or a link to it from which the server downloads it. The server splits a PDF into pages in memory, sends each page to the reading engine and returns the result. The file, the pages and the result are not stored, and the link is not logged.
• API keys are stored only as a hash, with a short prefix that identifies them on your account page, the name you chose, and when each was created and last used.
• When you ask for API access, you give an email address and, if you choose, a name, a company, a description of your use and a monthly page count. These are kept in our inquiry system so we can give you access and follow up.

What the server keeps, and for how long

An automatic job runs every day and deletes the records that have a deletion date.

Payments

Payment happens on Stripe's secure page. Card details go directly to Stripe and never reach us. From Stripe we receive the email address, the amount and the payment id, so we can add the pages to your account. Stripe processes payment details under its own privacy policy.

Sign-in by email

When you ask for a sign-in link, we send an email to the address you entered, through an email delivery provider. The link is valid for 20 minutes and works once, and the server keeps only a hash of it.

The contact form

The name, email and message you send, and for a business inquiry the company, the monthly page volume and the system you work with, are kept in our inquiry system so we can reply. Please do not attach documents to a message.

Measurement and statistics

The site runs three measurement tools:

• Google Analytics: pages viewed, where visits come from, device type, and events such as button clicks. In the European Economic Area and the UK it stores no cookies unless you allow it on the cookie page. Elsewhere it uses cookies, and you can turn it off on the same page.
• Cloudflare Web Analytics: an aggregate count of visits, with no cookies and no user identifier.
• Our own visit-measurement system: pages viewed, where visits come from and campaign parameters, device type and language, scroll depth, time on page, clicks on main buttons, whether you started or sent a form (not what you typed), and the fact that you copied text or printed (not the text itself). It keeps a random visitor identifier in your browser.

These tools do not receive the content of your documents, the extracted text or file names. The full details, including how to turn them off, are in the cookie policy.

Who else processes data

We do not sell personal information. Providers process data for us only to run the service:

• A cloud infrastructure provider that runs the server, the database and network security.
• A cloud infrastructure provider that runs the reading engine.
• Stripe, for payments.
• An email delivery provider, for sign-in links.
• The measurement providers in the previous section.

These providers may process data on servers outside Israel.

Your rights

You can ask to see the information we hold about you, to correct it or to delete it. You delete the history in your browser yourself; for everything else, use the contact form. When an account is deleted, its page balance is deleted with it. Payment records that the law requires us to keep are kept for the period the law sets.

Security

All traffic is encrypted. Cookies are cryptographically signed and cannot be read by scripts on the page. Sign-in links are stored only as a hash. Reading and sign-in are rate-limited. Above all, what is not stored cannot leak, so document content is not stored on the server at all.

Changes to this policy

When we change this policy, we update the date at the top of the page. A material change will also be announced on the site.