Privacy Policy

Zerodoc is a private document extraction API and the trading name of Rocsoft Ltd, a limited company incorporated in the Isle of Man (“Zerodoc”, “we”), which acts as the data controller for the account data described below. For documents you submit for processing, we act as a data processor on your behalf.

• Account data: your email address (for sign-in via magic link).
• API credentials: a one-way SHA-256 hash of your API key (never the key itself).
• Usage metadata: per-request page counts, document size, timing, and status — used for quotas and billing.
• Billing data: handled by Stripe; we store only your Stripe customer reference, not card details.

We do not use advertising or third-party tracking cookies. Your browser’s local storage is used only to operate the site: your sign-in session token, your post-login redirect, a display name you optionally set, how you first found us (referrer/UTM, recorded once at sign-up), and an optional onboarding answer. Signing out clears your session token; you can clear the rest at any time via your browser.

We do not store the documents you submit, nor the text or fields extracted from them. Documents are processed in memory and discarded immediately after the API response. There is no document retention, archival, or training on your content.

Account and usage data are used solely to operate the service: authenticate you, enforce plan quotas and rate limits, bill subscriptions, and send transactional sign-in emails. We do not sell personal data or use your content to train models.

We process account and usage data to perform our contract with you (providing the API) and on the basis of our legitimate interests in operating and securing the service.

• Cloudflare — authentication, billing and usage metadata storage (EU data localization).
• Stripe — payment processing.
• Resend — transactional email delivery.
• netcup (EU, Germany) — stateless document processing (no storage).

Document processing takes place in the EU. Where a sub-processor processes personal data outside the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and the provider’s data-localization options.

Documents and extracted content are never retained. Account data is kept for the life of your account; usage metadata is kept as needed for billing and then aggregated or deleted. You can request deletion of your account data at any time.

Subject to applicable law, you have rights to access, correct, delete, and port your personal data, and to object to or restrict certain processing. To exercise these, contact us at [email protected].

Our Data Processing Agreement is incorporated into our Terms of Service and applies automatically to all customers.

We may update this policy; material changes will be notified via the dashboard or email. Questions: [email protected].