Privacy Policy

Last Updated: October 18, 2026

Welcome to Siftspindle ("we", "our", or "us"), accessible at https://siftspindle.com/. We are dedicated to providing fast, automated document extraction while upholding the highest standards of data security, user confidentiality, and global privacy compliance (including EU GDPR and US CCPA/CPRA).

Key Privacy Principles: We do not view your uploaded documents, we never sell your personal information, all uploaded documents and extracted outputs are automatically deleted within 24 hours, and your data is never used to train artificial intelligence or machine learning models.

1. Google OAuth & Google API Services User Data Policy Compliance

Siftspindle enables users to sign in seamlessly using their Google accounts via Google OAuth 2.0. We request only the minimum profile scopes required to authenticate you:

Google Data Accessed: Your primary email address, full name, and avatar profile picture.
Purpose of Access: We use your Google profile information solely to authenticate your account, maintain your active session, track your monthly extraction credits, and associate your processed documents with your user ID.
Limited Use Disclosure: Siftspindle's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
No Transfer or Sale: We never sell, rent, license, or share Google user data with third parties, brokers, or advertising platforms.
No Human Inspection: Siftspindle employees and system administrators do not view, inspect, or manually read your Google account data or uploaded document files.

2. Information We Collect

A. Account and Authentication Information

When you register or sign in using Google OAuth or email OTP, we collect your verified email address and basic name. We do not store or collect passwords.

B. Document Uploads & Extraction Data (Ephemeral 24-Hour Processing)

When you submit documents (such as invoices, receipts, spreadsheets, PDFs, or images) and optional extraction instructions, the file is parsed by our automated processing pipeline.

Files and parsed JSON/Excel outputs are stored ephemerally.
Automated 24-Hour Deletion Policy: All uploaded files, intermediate processing states, and extracted results are permanently and irreversibly purged from our database within 24 hours of upload.

C. Usage & Diagnostics Data

We collect standard technical information generated automatically during visits, including device type, operating system, browser version, and aggregated system performance logs.

3. How We Use Your Information

We process your data strictly for legitimate operational purposes:

To provide, operate, and maintain the document extraction service.
To authenticate your identity and allocate your monthly free extraction credits (10 credits per month).
To respond to your support and data removal inquiries.
To maintain system stability, security, and uptime.

4. Zero AI Model Training & Google Cloud Gemini API Processing

We recognize the critical confidentiality of business files. Siftspindle does NOT use customer documents, text, prompts, or Google user data to train, retrain, fine-tune, or improve any artificial intelligence or machine learning models.

Our extraction pipeline is powered via Google Cloud using the Google Gemini API. Under Google Cloud enterprise terms, your data remains strictly confidential and encrypted: Google does not use customer data (prompts, uploaded files, or output responses) to train Google foundation models.

You can review Google's official privacy and API data governance terms at:

5. Prohibited Content & User Responsibility

Important Notice: Strictly Prohibited Sensitive Data

Siftspindle is engineered for unclassified business documents, invoices, receipts, spreadsheets, and tabular records. Users are strictly prohibited from uploading:

Government IDs: Passports, Social Security Numbers (SSN), National ID cards, Driver's Licenses, or Birth Certificates.
Financial Credentials: Banking passwords, credit/debit card numbers, PINs, CVVs, or online banking secret keys.
Protected Health Information (PHI): Medical records or health data subject to HIPAA regulations.
Classified or Unlawfully Acquired Data: Proprietary trade secrets or materials violating third-party intellectual property rights.

6. European Union & UK Data Protection (GDPR / UK GDPR Notice)

If you are located in the European Economic Area (EEA), European Union (EU), or United Kingdom (UK), your personal data is handled in accordance with the General Data Protection Regulation (GDPR):

Legal Basis (Article 6): Contractual necessity to deliver requested document parsing (Art. 6(1)(b)) and user consent (Art. 6(1)(a)).
Data Minimization (Article 5): We collect only necessary identifiers and enforce automatic 24-hour file erasure.
Your GDPR Rights:
- Right of Access (Art. 15): Request a copy of your personal data.
- Right to Rectification (Art. 16): Correct inaccurate personal details.
- Right to Erasure / "Right to be Forgotten" (Art. 17): Request immediate manual deletion of your account and records.
- Right to Data Portability (Art. 20): Export your extracted data at any time in standard JSON or Excel (.xlsx) formats.
- Right to Lodge a Complaint: You have the right to lodge a complaint with your local EU/UK data protection supervisory authority.
International Data Transfers: Processing through Google Cloud servers utilizes EU Standard Contractual Clauses (SCCs) to ensure equivalent data protections.

7. United States Privacy Notice (California CCPA / CPRA & State Laws)

For residents of California, Virginia, Colorado, Connecticut, Utah, Texas, and other US states:

We Do NOT Sell or Share Personal Information: Siftspindle has never sold, rented, or shared personal information or uploaded document content for monetary or commercial consideration, nor do we share data for cross-context behavioral advertising.
Right to Know & Delete: You have the right to know what personal information we collect and request its deletion.
Non-Discrimination: We will never discriminate against you, deny access, or charge differential prices for exercising your statutory privacy rights.

8. Data Retention & How to Delete Your Account

Uploaded files and extracted results are purged automatically by scheduled database triggers 24 hours after upload. If you wish to permanently delete your account, authentication records, and all associated usage history immediately:

Send an email from your registered email address to support@siftspindle.com with the subject line "Delete My Account & Data". We will complete your request within 48 business hours.

9. Contact Information

If you have questions, feedback, or privacy inquiries regarding this Privacy Policy or Google OAuth compliance, contact us directly:

Company / Service: Siftspindle
Website: https://siftspindle.com/
Privacy & Support Email: support@siftspindle.com