Privacy and Cookie Policy

The controller for personal data processed on parsevix.com and in the Parsevix service is Endoi, a sole proprietorship under Turkish law, 08000 Merkez/Artvin, Turkey, e-mail hello@parsevix.com (“we”, “us”).

Because we are established in Turkey and offer the service in the EU, both the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK) apply to what we do.

• We don't sell your data, show no advertising and use no third-party analytics or tracking tools; visits to our public pages are counted by our own software on our own server, without cookies (section 8). The only thing we may remember about how you reached us is an affiliate's referral code, and only if you allow it (section 8).
• Your documents are never used to train AI models, neither ours nor anyone else's.
• Before document text goes to an AI service, personal data in it is detected and masked automatically.
• Our server and our file storage are in Germany.

• Your account: name, e-mail address, password (stored only as a one-way hash), language, when you accepted the Terms, and, if you sign in with Google or Microsoft, the account ID that provider gives us. Purpose: providing your account. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Billing: company name, tax ID, billing address, plan and subscription status. Payment itself is handled by Paddle (section 5); we never see card details. Legal basis: contract and our obligations under tax law (Art. 6(1)(b) and (c) GDPR).
• Documents and results: the files you upload or send to a project's e-mail address, the text read from them and the extracted data. Where they contain other people's personal data, we process it on your behalf, as your processor, under our Data Processing Agreement; you decide what is processed. For your own data the legal basis is the contract (Art. 6(1)(b) GDPR).
• Security and abuse prevention: the IP address and browser type (user agent) when you sign up and sign in, a record of sign-ins, refused sign-up attempts, and short-lived counters of failed sign-ins. We use them to protect accounts and to stop one person from opening many free accounts (limits per network and per e-mail domain). Legal basis: our legitimate interest in a secure service that isn't abused (Art. 6(1)(f) GDPR).
• Web server logs: when you visit the website, the server records the IP address, time, requested page, browser type and errors, to keep the service running and secure. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Communication: support tickets, e-mails you send to hello@parsevix.com, and our replies. Legal basis: the contract, or for questions before one, our legitimate interest in answering (Art. 6(1)(b) and (f) GDPR).
• Service e-mails: address confirmation, password resets, security notices, notices about your documents, billing and plan, and announcements about the service itself. We send no advertising newsletters. Legal basis: the contract (Art. 6(1)(b) GDPR).
• API usage: for each API call, the key used, the endpoint, time, result and IP address. Legal basis: the contract and our legitimate interest in security (Art. 6(1)(b) and (f) GDPR).
• Affiliate referrals: if you open an account after following an affiliate's link and allowing the referral to be remembered, we record which affiliate referred you and use your subscription's payments (date, amount without tax, refunds and chargebacks) to calculate the affiliate's commission. To prevent affiliates from referring themselves, we compare the network (IP address range) of your sign-up with the affiliate's. Purpose: running our affiliate program. Legal basis: our legitimate interest in paying affiliates correctly and preventing fraud (Art. 6(1)(f) GDPR). You can object (section 9); your account is then no longer credited to the affiliate.
• Affiliates: if you take part in our affiliate program, we process the date and version of the terms you accepted, your affiliate code, the visits, sign-ups and commissions credited to it, your payouts, and the payout and tax details you give us (legal name, whether you take part as an individual or a business, country of tax residence, address, tax and VAT numbers, tax status in Turkey, and bank details). Purpose: running the program, paying you and meeting our tax obligations. Legal basis: the contract and our obligations under tax and commercial law (Art. 6(1)(b) and (c) GDPR).

You don't have to give us this data, but without the account details and the documents we can't provide the service.

1. Upload and reading: the file is stored in our file storage and read on our own server in Germany. Text recognition (OCR) runs there, without any outside service.
2. Masking: before any text goes to the AI service, our software automatically finds personal data, such as names, companies, addresses, phone numbers, e-mail addresses, IBANs and ID numbers, and replaces it with placeholders like <PERSON_1> or <PHONE_NUMBER_1>. Detection is automatic: it finds most such values, but it can't guarantee to find every one, especially in unusual layouts or poor scans. If masking fails, the document is not sent on.
3. AI extraction: only the masked text is sent to Google's Gemini API, which returns the fields you asked for. Under Google's terms for the paid API, Google doesn't use it to train its models.
4. Restoring: on our server, the placeholders in the result are replaced with the original values.
5. Storage: the file and the result stay in your account until you delete them. Files uploaded through the API are deleted right after processing unless you set the project to keep them.

To suggest a document's category, we compare it with examples you approved in the same project. This comparison runs on our own server; the vectors it uses contain no readable text.

• Hetzner Online GmbH, Gunzenhausen, Germany: runs our server, including our own mail server that sends our e-mails, in a data centre in Germany (processor).
• Microsoft Ireland Operations Ltd. (Azure Blob Storage): stores uploaded files, in Germany (processor).
• Google (Gemini API): receives the masked document text for extraction and, where needed, classification (processor).
• Cloudflare, Inc. (Turnstile): a bot check on the sign-up, sign-in and password forms. Only on those pages, Cloudflare receives your IP address and browser data (processor).
• Paddle.com Market Ltd., London, UK: our reseller and Merchant of Record. Paddle sells you the subscription, takes payment and issues the invoice as an independent controller under its own privacy policy. Its checkout loads only when you start a payment.
• Google and Microsoft as sign-in providers, only if you choose to sign in with them (independent controllers).
• Google Ireland Ltd. (YouTube): the tutorial videos in our documentation. Nothing is loaded from YouTube until you click play on a video; then the player loads from youtube-nocookie.com, and Google receives your IP address and browser data and may store cookies (independent controller).
• Affiliates: if you signed up through an affiliate's link, that affiliate sees on their affiliate page that an account was opened through it and the monthly totals of the commission it earns. They never see your name, e-mail address or company, but if they know you, they may be able to tell from this that you signed up or pay for a plan.
• Banks: when we pay an affiliate, our bank in Turkey and the banks along the transfer receive the payee's name, address, bank details and the amount, as independent controllers.
• Services you connect yourself, such as Zapier or your own webhook endpoints, receive the data you decide to send them.
• Authorities and courts, where the law requires it.

Our server and file storage are in Germany. Google and Cloudflare may process data in the USA; those transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. Paddle is in the United Kingdom, for which an EU adequacy decision exists.

We run the service from Turkey. For documents that our business customers have us process, the Standard Contractual Clauses in our Data Processing Agreement apply. Under the KVKK, transfers from Turkey abroad follow Article 9 KVKK.

• Account data: as long as your account exists. When you delete your account, it is closed at once and deleted after a 30-day grace period in which you can still cancel the deletion.
• Documents and results: until you delete them or your account. API uploads: right after processing, unless the project keeps them. After a plan downgrade, projects, keys, inbound addresses and webhooks beyond the new plan's limits are paused and deleted 30 days later.
• Sign-in history and API request logs: 30 days.
• Refused sign-up attempts: 90 days.
• Counters of failed sign-ins: at most 30 minutes.
• Web server logs: only as long as needed for security and error analysis; they are overwritten automatically.
• Support tickets and e-mail conversations: until the matter is settled and the conversation is deleted, at the latest with your account. Unsolicited spam: 30 days.
• Undeliverable addresses: which address each of our e-mails went to, 30 days (to match a bounce to it). An address our e-mails don't reach or that reported them as spam is put on a suppression list and gets no notices or product updates: as long as the address keeps bouncing; cleared when you verify it again (verification or password reset link), at the latest with your account.
• Database backups: 14 days.
• Billing records: as long as tax and commercial law requires (up to 10 years).
• Affiliate program: the link between your account and an affiliate, while your account exists; an affiliate's payout and tax details until they change them or delete their account; commission and payout records, including the masked account a payout went to, as long as tax and commercial law requires (up to 10 years), also after the account is deleted.

We use no advertising, analytics or tracking cookies. Apart from the referral code described below, what we store in your browser is strictly necessary for the service you asked for, so it needs no consent (§ 25(2) TDDDG; Art. 5(3) ePrivacy Directive):

• pvx_rt (cookie): keeps you signed in on this device for up to 7 days. HttpOnly, so scripts can't read it, and sent only to our sign-in endpoint.
• pvx_oauth (cookie): ties a Google or Microsoft sign-in to your browser, for a few minutes.
• Local storage: a note that you are signed in, your language, the selected project, your notifications and the language of the API docs.
• Referral code (local storage, only with your consent): if you arrive through an affiliate's link (?ref=…), we ask whether we may remember it. If you choose “Allow”, we keep the affiliate's code for 30 days, so that an account you open in this browser is credited to them, and count the visit once for the affiliate, without any other data about you. We ask first because this isn't needed for the service you came for (§ 25(1) TDDDG). If you decline, nothing is stored. You can remove the code at any time with “Remove” on the sign-up form or by clearing this site's data.
• On the sign-up, sign-in and password forms, Cloudflare Turnstile may store what it needs for the bot check. When you pay, Paddle's checkout uses the cookies it needs for the payment.
• Visit statistics (no cookie, nothing stored in your browser): on our public pages (not in the dashboard), our own copy of the open-source tool Umami, running on our server in Germany, counts which pages are viewed, the referring website, browser, operating system, device type, screen size, language and the country and city derived from your IP address. Your IP address is not stored: with your browser data and a daily-changing secret it forms an anonymous visit code, so we can't tell who you are, and nothing is shared with anyone. Browsers sending “Do Not Track” are not counted. We do this to see how our website is used and improve it (legitimate interest, Art. 6(1)(f) GDPR). The script only reads an opt-out flag (<code>umami.disabled</code>) from local storage, if you set it.
• When you click play on a tutorial video in our documentation, YouTube's player (youtube-nocookie.com) may store cookies and similar data in your browser. Your click on play is the request for that video; before it, nothing from YouTube is loaded.

Our fonts are served from our own server; no font or other service is loaded from Google or anyone else while you browse, unless you start a tutorial video.

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object at any time, on grounds relating to your situation, to processing based on our legitimate interests (Art. 21). You can also complain to a data protection supervisory authority, in particular the one where you live or work.

Under the KVKK you have the rights in Article 11 KVKK. Please contact us first; you can then complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu). Our notice under Article 10 KVKK is at the end of the Security & GDPR page (in Turkish).

To use any of these rights, write to hello@parsevix.com. You can delete your account yourself in your account settings. We reply within one month (under the KVKK, within 30 days).

We make no decisions with legal or similarly significant effects based solely on automated processing. Sign-up limits are applied automatically; if one refuses you by mistake, write to us and we will look at it.

The service is for people aged 18 and over. We don't knowingly collect data from children; if we learn that we have, we delete it.

We update this policy when our processing changes; the date at the top shows the current version. If a change affects you significantly, we tell you by e-mail.