Privacy Policy

This Privacy Policy describes how Structurify.ai ("we", "us", or "our"), operated by Discovery AI Limited (UK) together with its Indian operational site Redscvry Technology Private Limited, collects, uses, and protects your information when you use our document extraction service.

1. Information We Collect

Account Information

When you create an account, we collect:

• Name and email address
• Company name (optional)
• Password (encrypted)
• Payment information (processed by our payment partners)

Document Data

When you use our service, we process:

• Documents you upload for extraction
• Extracted data from your documents
• Extraction templates you create

Usage Information

We automatically collect:

• Log data (IP address, browser type, pages visited)
• Device information
• Usage patterns and preferences

2. How We Use Your Information

We use your information to:

• Provide and improve our document extraction service
• Process your transactions and manage your credits
• Send service-related communications
• Provide customer support
• Analyze usage to improve our service
• Comply with legal obligations

3. Data Storage and Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Documents are processed in isolated environments
• Access to data is strictly controlled and logged
• Regular security audits and penetration testing

Your uploaded documents are retained only as long as necessary to provide the service. Extracted data is retained until you delete it or close your account.

4. Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights regarding your personal data under the GDPR/UK GDPR. We respond to verified requests within 30 days (acknowledged within 5 business days).

Right to Access (Art. 15)

You can request a copy of all personal data we hold about you at any time through your account settings or by contacting us.

Right to Rectification (Art. 16)

You can update your account information at any time through your account settings, or ask us to correct inaccurate or incomplete data.

Right to Erasure / "Right to be Forgotten" (Art. 17)

You can delete your data at any time:

• Delete individual documents and extractions from your account
• Delete your entire account and all associated data
• Request complete data deletion by contacting us

When you delete data, it is permanently removed from our systems within 30 days.

Right to Restrict Processing (Art. 18)

You can ask us to restrict (pause) processing of your data while a dispute about its accuracy or lawfulness is resolved, or where processing is unlawful but you do not want it erased.

Right to Data Portability (Art. 20)

You can export your data, including extracted results and templates, in a structured, commonly used, machine-readable format at any time using the export feature in the application, or by contacting us.

Right to Object (Art. 21)

You can object to processing of your data for direct marketing purposes at any time — we will stop immediately. You can also object to processing based on our legitimate interests.

Rights Related to Automated Decision-Making (Art. 22)

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without human involvement. Where any such processing exists, you have the right to request human review.

Right to Withdraw Consent (Art. 7(3))

Where we rely on your consent as the legal basis for processing (for example, non-essential cookies, marketing communications, or optional product-usage data), you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You can withdraw consent:

• For cookies: via the cookie preference centre, linked in the site footer
• For marketing emails: via the unsubscribe link in any marketing email
• For other consent-based processing: via your account settings or by emailing [email protected]

Right to Lodge a Complaint

If you believe our processing of your personal data infringes GDPR, you have the right to lodge a complaint with a supervisory authority — in particular, in the EU member state or UK where you live, work, or where the alleged infringement occurred. In the UK, this is the Information Commissioner's Office (ICO), ico.org.uk. We encourage you to contact us first at [email protected] so we can try to resolve your concern directly.

5. Cookies and Tracking

We use cookies and similar technologies for:

• Strictly necessary cookies — required for the site/service to function (e.g. session, authentication, security). These are set without consent as they are necessary for service delivery.
• Functional cookies — remember your preferences (e.g. language). Set only with your consent.
• Analytics cookies — measure site usage and performance. Set only with your consent.
• Marketing cookies — used for advertising. Set only with your consent.

When you first visit our site, a cookie consent banner lets you accept all, reject all, or choose which categories to allow. You can change your choice at any time via the "Cookie Settings" link in the site footer. See our full Cookie Policy for details on each cookie category, retention, and how to manage your preferences. You can also control cookies through your browser settings, though disabling strictly necessary cookies may affect site functionality.

6. Third-Party Services

We use the following third-party services (sub-processors):

• Payment Processing: Stripe, PayPal (for credit purchases)
• Cloud Infrastructure, Email & Productivity: Microsoft Azure / Microsoft 365 (Standard Contractual Clauses + Microsoft DPA)
• Security, CDN & DDoS Protection: Cloudflare (Standard Contractual Clauses)
• Analytics: Google Analytics / Google Ads (only loaded after you consent via the cookie banner)

Each third-party service has its own privacy policy governing its use of your data. A current sub-processor list is also maintained in our Data Processing Agreement, and customers will be notified of material changes to sub-processors.

7. Data Sharing

We do not sell your personal data. We may share data only:

• With your consent
• With service providers (sub-processors) who assist our operations, under a Data Processing Agreement
• To comply with legal obligations
• To protect our rights and prevent fraud

8. International Transfers

Your data may be processed in countries outside your residence, including the United States. We ensure appropriate safeguards are in place for these transfers, including Standard Contractual Clauses (EU Commission 2021/914) and, where applicable, the UK International Data Transfer Addendum, or reliance on an adequacy decision.

9. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect data from children.

10. Data Processing Agreement

If you are a business customer acting as a data controller, our Data Processing Agreement (DPA) is published on our site and governs our processing of personal data on your behalf as processor, including sub-processors, security measures, and data subject rights assistance under GDPR Article 28. You can also request a countersigned copy at [email protected].

11. Data Protection Officer

We have appointed a Data Protection Officer (DPO) responsible for overseeing our data protection practices and compliance with GDPR/UK GDPR. You can reach our DPO with any questions about this policy or how we process your personal data:

• Name: Sharad Bapat
• Title: Data Protection Officer (DPO)
• Email: [email protected]

12. Privacy Contact

For privacy-related questions or to exercise your rights, contact our Privacy Contact:

• Email: [email protected]
• Registered address (UK): Discovery AI Limited, 167-169 Great Portland Street, London, England, W1W 5PF
• Operational site (India): Redscvry Technology Private Limited, WeWork Krishe Emerald, Kondapur Main Road, Laxmi Cyber City, Hyderabad, Telangana 500081

13. EU Representative

For EU privacy matters, including requests from individuals in the European Union and communications from EU data protection supervisory authorities, we have appointed James Stevenson as our EU representative / Europe privacy contact under Article 27 GDPR. Contact: [email protected].

14. Policy Updates

We may update this policy from time to time. We will notify you of significant changes via email or through the service. Your continued use after changes constitutes acceptance of the updated policy.