Privacy policy.

This policy covers abscode.com and every service reachable through it: Abscode DMS, Abscode Document AI (the hosted extraction and document-analysis APIs), the Mobile Imaging SDK, the Browser Imaging Library and the Server Imaging SDK. It replaces the separate privacy notice previously published for Abscode DMS; that URL now redirects here.

1. Who we are

Abscode Technologies LLP, a limited liability partnership registered in India (LLPIN ACZ-9014), at No. 58, 2nd Floor, LV Complex, 7th Block, 80 Feet Road, Koramangala VI Block, Bengaluru, Karnataka 560095, India.

2. Scope, and our two roles

Our role differs depending on the data, and this distinction governs who answers a data-subject request and who notifies a breach:

• We are the data controller for data about this website and our sales relationship with you — enquiry details, account and sign-up data, billing records, and API or SDK usage metadata.
• We are a data processor for the documents and personal data our customers store and manage inside Abscode DMS (“Customer Content”), and for document payloads submitted to the Document AI APIs. We process these only on the customer's documented instructions, under a Data Processing Agreement. Where you are an end user of a customer's tenant, that customer is your controller and you should direct rights requests to them; we assist them in responding.

3. What data we collect

• Account data — name, email, company, country, phone number, for signup and billing.
• Payment data — processed by Razorpay (India) or Stripe (elsewhere). We do not store card details.
• API and SDK usage — metadata about calls (timestamp, endpoint, response size) for billing and rate-limiting.
• Documents you process — see section 5, which differs by product.
• Technical data — IP address, browser type and server logs.
• Functional browser storage — see section 9.

4. How we use it, and our legal bases

Where the GDPR applies, our legal bases under Article 6 are contract (providing the service you signed up for), legitimate interests (securing and improving the service, preventing abuse), legal obligation (tax and accounting records) and consent where we ask for it, such as marketing email.

• To provide, operate and secure the services.
• To bill you and to enforce rate limits and credit limits.
• To support you and respond to enquiries.
• To meet legal, tax and accounting obligations.

We do not use your data or your documents to train machine-learning models. We do not sell personal data. We do not share it with advertisers.

5. Document handling and retention

The two products handle documents differently, and the difference is deliberate:

Document AI APIs and the SDKs — ephemeral processing

• Documents are auto-purged within 24 hours of the API response being delivered.
• An accelerated 5-minute purge is configurable per API key.
• Enterprise customers can set custom retention or a zero-retention mode.
• Processing happens on-device for the Mobile Imaging SDK and client-side for the Browser Imaging Library, so those documents never reach us at all.

Abscode DMS — retention you control

• Customer Content persists for as long as you keep it: storing records is the purpose of the product.
• Retention is governed by the retention policy you configure in your tenant.
• On termination you may export Customer Content for 30 days, after which it is deleted.
• A free tenant that stays inactive for 90 days is deleted. The Delete Protection add-on makes a free tenant persistent.

Account, billing and usage records are kept for as long as needed for the relationship and then for the period tax and accounting law requires.

6. Sharing and sub-processors

We share personal data only with service providers needed to run the service — hosting, payment processing, email delivery and support tooling — each under contract and only for that purpose. The current sub-processor list is published on our security page. We will give notice before adding a sub-processor that processes Customer Content.

7. Data residency and international transfers

We host in the regions below. If you need a contractual commitment to one of them, say so before you sign — ask [email protected].

• India — GCP Mumbai (asia-south1)
• EU / EEA — GCP Belgium
• Africa and the Middle East — GCP Johannesburg (africa-south1)
• United States

We do not transfer data between regions without customer instruction. Where a transfer out of the EEA or UK is necessary, we rely on the European Commission's Standard Contractual Clauses. Enterprise DMS customers may instead use bring-your-own-storage (Google Drive, OneDrive, S3, Azure or NAS), in which case records live in your own storage and you control their location — and our storage-side commitments in section 8 do not apply to that storage.

8. Security

Data is encrypted in transit with TLS 1.2 or above and at rest with AES-256. Organisational controls include role-based access, maker-checker approval, a tamper-evident audit trail and PII masking for Aadhaar and PAN — Aadhaar and PAN are masked on view and the Aadhaar number is not stored. Full detail, our sub-processor list and our vulnerability disclosure process are on the security page.

9. Cookies and browser storage

We use only functional storage. A first-party cookie remembers your selected region and your chosen theme; nothing else is set. We run no advertising, profiling or third-party analytics — the site loads no third-party scripts at all. You can review your choice at any time through Cookie settings in the footer.

10. Your rights

Subject to applicable law — and in India under the DPDP Act, in the EU/EEA and UK under the GDPR, and in South Africa under POPIA — you may:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted
• Export your data in a structured format
• Object to processing, and withdraw consent for marketing at any time
• Lodge a complaint with your supervisory authority

Email [email protected]. If your request concerns Customer Content inside a customer's DMS tenant, that customer is the controller and we will refer you to them and assist them in responding.

EU/UK representative: contact [email protected] and we will route your request.

11. Children

The services are not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we will delete it.

12. Changes to this policy

We will notify customers by email at least 30 days before any material change to this policy. Every change is also posted here with a new last-updated date. Because of that 30-day commitment, the effective date of a material change is set at least 30 days after the notice email

13. Contact

Privacy and data-subject requests: [email protected]
Contract and legal notices: [email protected]
Security and vulnerability reports: [email protected]
General support: [email protected]