Security & Data Privacy

Images are deleted immediately after OCR processing completes — typically within seconds. Files are never written to a persistent database. They are passed to the OCR engine in memory or via short-lived cloud storage, and the deletion is triggered as part of the same request lifecycle.

We operate a no-persistent-storage policy for uploaded files and extracted text. Specifically:

• ✓Uploaded files are never written to a permanent database.
• ✓Extracted text output is returned directly to your browser and is not logged or stored on our servers.
• ✓No copies of your documents are made for training AI models.
• ✓No copies are made for quality review, research, or any other internal purpose.
• ✓We do not create thumbnails, previews, or cached versions of uploaded files beyond what is needed for immediate processing.
• ✓Paid subscriber account data (email, billing info) is stored separately from file processing infrastructure.

When you click "Extract Text", the following happens:

1. 1Your browser sends the image file to our server over HTTPS.
2. 2Our OCR engine (Google Cloud Vision API) processes the image and returns raw text.
3. 3Our server forwards that text back to your browser over HTTPS.
4. 4The image file is deleted from temporary storage.
5. 5The extracted text lives only in your browser tab. It is never written to our database.

We use a small number of trusted sub-processors to operate the service. Each is listed below with its role and data handling relevance.

We do not sell your data to any third party. We do not use your files or extracted text for advertising targeting. No sub-processor receives your extracted text.

The OCR engine we use (Google Cloud Vision API) is a production inference API. Google's terms for this API prohibit the use of submitted data for model training without explicit consent. Your images are not used for that purpose.

No member of our team views, reviews, or accesses the content of your uploaded images or documents. Processing is fully automated.

The only exception is if you voluntarily submit a file to our support team as part of a bug report. In that case we will only use it to diagnose the reported issue and will delete it afterwards.

For users on a paid plan, we store the following account data in Firebase:

• Email address (used for login and billing communications)
• Subscription status and plan type
• Usage count (number of OCR conversions, for quota enforcement)
• Payment records managed by Paddle (we do not store card details)

Free (unauthenticated) users do not have accounts and we store no personal data linked to them beyond anonymized analytics.

Because uploaded files are automatically deleted within 1 hour, there is typically nothing left to delete by the time you finish using the tool. However, if you are a registered user and wish to delete your account and all associated personal data, you can request deletion using any of the methods below.

• ✓Legal basis for processing: Our lawful basis for processing your uploaded image is the performance of the service you requested (Article 6(1)(b) GDPR — contract). No consent is required because you are requesting the OCR conversion yourself.
• ✓Data minimization: We collect only the image file necessary to perform OCR. No metadata beyond what is technically required is collected.
• ✓Storage limitation: Images are deleted immediately after processing. No retention period applies because we do not store them.
• ✓Data subject rights: You have the right to access, rectify, erase, restrict, and port your personal data. For file data, nothing is retained; for account data (paid users), submit a request to support@extractimagetotext.org.
• ✓Data Protection Officer (DPO): We are a small business and currently do not have a designated DPO. Privacy inquiries can be directed to support@extractimagetotext.org.
• ✓Data Processing Agreement (DPA): Enterprise or institutional customers requiring a signed DPA may contact us at support@extractimagetotext.org to arrange one.
• ✓Cross-border transfers: Processing occurs via Vercel (US-based) and Google Cloud Vision API (US-based). Both providers maintain EU-US Data Privacy Framework compliance or Standard Contractual Clauses (SCCs) to cover data transfers from the EEA.

• ✓We do not sell your personal information. This includes uploaded file content and any extracted text.
• ✓We do not share your personal information with third parties for cross-context behavioral advertising.
• ✓Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you (paid account users only; free users have no account data stored).
• ✓Right to Delete: You may request deletion of personal information we have collected about you. File content is already deleted immediately after processing.
• ✓Right to Correct: You may request correction of inaccurate personal information in your account.
• ✓Right to Opt-Out of Sale / Sharing: We do not sell or share personal information, so no opt-out mechanism is required. If this changes, we will update this page and provide a "Do Not Sell or Share My Personal Information" link.
• ✓To exercise your CCPA rights, contact us at support@extractimagetotext.org with the subject "CCPA Privacy Request".

Regardless of where you are located, we respect the following rights in relation to your personal data:

To exercise any of these rights, email support@extractimagetotext.org.

If we make material changes to how we handle your data (for example, introducing a new sub-processor or changing retention windows), we will update this page and revise the "Last updated" date at the top. For significant changes affecting paid users, we will send a notification to your registered email address.