Privacy
Your documents are your customers’ commercial data. This page says plainly what happens to them.
What we keep, and for how long
A document you upload is deleted 30 days after it is converted. The deletion date is shown on the document itself, and we e-mail you three days before it happens.
With privacy mode on, a document is deleted 24 hours after you download it instead. You can also delete any document immediately, at any time.
Deletion is permanent: the file and every value read out of it are destroyed. What survives is contentless bookkeeping — how many documents you converted, when, and what they cost — plus the formats you defined, which contain your template, not your customers’ data.
What we never do
We do not train AI models on your documents, and neither does Anthropic, the model provider we use — that is contractual, not a promise of goodwill.
We do not record your screen. The review screen shows a customer document side by side with the output, so session recording is switched off everywhere in the product.
Document contents are never written to our logs or our error reports.
Where it lives
Your account, documents and extracted data are stored in the United Kingdom (London). Conversion runs on a server in Germany. Sending a document to the AI model involves a transfer to the United States under a data processing agreement.
Subprocessors
Every company that can come into contact with your data, and why:
| Company | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in and document storageYour account, your formats, uploaded documents and extracted values | London, United Kingdom |
| Hetzner | The server that runs the application and converts documentsDocuments pass through memory while being converted; nothing is kept on the server | Falkenstein, Germany |
| Anthropic | The AI model that reads a document and maps it to your formatThe contents of a document being converted. Sent under a data processing agreement; not used to train models | United States |
| Resend | Transactional e-mail (deletion reminders, account e-mails)Your e-mail address and document file names — never document contents | European Union (Ireland) |
| Sentry | Error reports, so we find out when something breaksError type and stack trace. File names, e-mail addresses and storage paths are masked before sending, and request bodies are removed | Germany |
| Cloudflare | Domain name, and forwarding mail sent to our addressesConnection metadata; mail you send us | Global network |
Payments are not enabled during the pilot. When they are, Stripe will be added to this list and will receive your billing details — never your documents.
Your rights
You can export or delete your data at any time from inside the product. To ask what we hold about you, to correct it, or to have your account erased entirely, write to privacy@yourformat.com. Security issues go to security@yourformat.com.
Accuracy
YourFormat marks every value it is unsure of instead of quietly guessing, but it can still be wrong. Check a converted document before you send it to a customer — the output is yours, and so is the responsibility for it.