Privacy

What we collect

• Account details — your email address and name, held by Supabase Auth. Signing in with Google or Facebook shares the name and email those providers expose, nothing further.
• Documents — the files you upload to be read. Their lifecycle is the next two sections.
• Guest usage — the no-account tier counts pages against a salted hash of your IP address. The raw address is not stored.
• Payment details — we never see them. Cards are processed by Lemon Squeezy as merchant of record; VietQR bank transfers are confirmed by SePay. What reaches us is the order status, not the instrument.

Where your documents go

Reading is done by Mistral Document AI, so the document you upload is sent to Mistral’s API for processing. Files too large to travel inline go through our storage (Supabase Storage) first — uploaded over a signed, private flow, so the document never sits behind a URL a third party could fetch. Once the read completes, both the storage object and the file copy on Mistral’s side are deleted.

How long results are kept

• OCR jobs and their extracted results are deleted 24 hours after the job reaches a terminal state, and after 7 days if it never does.
• Guest runs are not persisted at all — the result exists only in your browser tab.
• The credits ledger (grants, usage, orders) is kept for billing accounting. It records amounts and page counts, never document contents.

Cookies and analytics

The only cookies are the Supabase Auth session cookies that keep you signed in. There are no advertising or cross-site tracking cookies. Vercel Analytics ships in the codebase but is not enabled; if that changes, this page changes with it.

Contact

Questions about this page or a deletion request: support@airzom.com. Deleting your account removes the account, its memberships and its stored results; the billing ledger is retained as described above.