Data and privacy

The documents you send#

• The uploaded file is never kept past processing, whatever the settings say. A document read while you wait is processed in memory. A queued document is held in private storage until it is processed, and deleted as soon as its extraction succeeds or fails; the retention sweep deletes any left behind.
• A record of each extraction is kept, so it can be listed and counted: its id, status, document type and version, mode, source and SDK, page count, file type, size and dimensions, a SHA-256 fingerprint of the file (used to recognise a retried request), the options and idempotency key you sent, timings, how many fields were found and whether review was needed. It holds no values and no document text unless you put them in the options, and it outlives the result: it is deleted, with the webhook delivery history of that time, after metadata_retention_days (400 by default, 35 to 730). The metadata you send is deleted with the result, or 7 days after a failed extraction.
• Camera frames never reach ReceViz. The capture SDKs analyse frames on the device and upload only the one picture your code sends.

Results: processing_retention#

The result of an extraction (its values, evidence and checks) is kept for as long as processing_retention says:

A result past its expiry is removed, with the metadata you sent, by the retention sweep, which runs up to once an hour. After that, GET /v1/extractions/{id} still answers, with result_purged: true and no values. Webhook payloads follow the same clock as the result they carry (7 days for extraction.failed); a delivery retried after that sends a stub without data.

Who can read a result while it is kept: your application, through the API, and members of your organization with the developer role or above, in the console, where every opening is recorded in the audit log. A result under zero retention cannot be opened in the console at all. ReceViz's operators see metadata only (usage and quality counts, key and extraction metadata): their tools return no extraction results and no raw keys. The one exception is an improvement sample, described below.

Evidence#

evidence decides how much of the document travels back with each value, and so how much is kept in a stored result:

A request can ask for a stricter level with options.evidence, never a looser one.

Language models: llm#

llm is allowed (the default) or disabled. It decides whether document text may be sent to a language-model provider.

• Allowed: VERIFIED mode sends the recognised lines of a document to the model to re-read its uncertain fields, and when the document OCR service is not available, a model may read the picture itself (model transcription). In the hosted service the document OCR service is Google Document AI and the language models are Google's Gemini models; each result names the recogniser in processing.ocr_provider and the verifier in verification.
• Disabled: VERIFIED mode is refused with 403 verification_disabled rather than run quietly as something weaker, model transcription is not used, and the console's describe-in-words builder proposes definitions from rules instead of a model.

The describe-in-words builder sends only the description you type, never a document, and only when llm is allowed.

Quality measurement: telemetry#

ReceViz measures how often a first reading of a field agrees with a second: the deterministic reader against the verifier in VERIFIED mode, and an SDK's on-device reading against ReceViz's, when the app reports it with POST /v1/quality/feedback. telemetry decides what may be recorded:

An outcome record holds, per field: its name, what the first reader settled on, its confidence (to two decimals) and a confidence band, whether the second reader read a value, and whether they agreed. With it: the document type and version, the platform, SDK and engine versions, the mode, the time taken and whether the document's sums added up. It never holds a value, a line of text, an image or anything about the person the document belongs to. Records are linked to your organization and application, so your console can show them, and are deleted after the organization's telemetry_retention_days: 400 by default, from 7 to 730.

The figure that matters most is sure but wrong: how often the first reader was sure (locked on a phone, or a confidence of 0.9 or more) and the second contradicted it. It is computed from these counts alone.

Improvement samples#

An improvement sample is the text of a misread, kept to build test cases. Three things must all be true:

1. the organization or application set telemetry to enhanced;
2. the request that reports the misread says so, with sample.share: true;
3. the first reading was wrong, or missed a field the second one found. A document read correctly teaches nothing.

A sample holds the recognised lines (text and positions, up to 400) and both readings' values, never an image. It is deleted after improvement_retention_days, 90 by default, from 1 to 365, and a test case built from it expires with it. ReceViz's operators can download a sample as a test fixture (each download is recorded in the audit log) or delete it sooner. The Web, iOS and Android SDKs never send samples.

Who sets the policy#

An organization sets its data policy in the console, under Data and privacy (admins and owners). An application can set its own, but only stricter: a looser setting on an application is ignored, and the stricter of the two applies. A request can make evidence stricter still.

processing_retentionzero | short | standard

How long results are kept. Default short.

evidencefull | boxes_only | none

Default full.

llmallowed | disabled

Default allowed.

telemetrynone | anonymous | enhanced

Default anonymous.

telemetry_retention_days7 to 730

Default 400. Deletion follows the organization's setting.

improvement_retention_days1 to 365

Default 90. An application can only shorten it.

metadata_retention_days35 to 730

Default 400. How long the record of each extraction, and webhook delivery history, is kept. At least 35 days, so this month's document count stays whole. An application can only shorten it.

Deleting your organization#

An owner deletes an organization in the console, under Data and privacy, by typing its name. It closes at once: every key and client token is refused with tenant_closed, documents waiting to be read are dropped, webhooks stop, and the console can still be read but not changed.

Seven days later everything is erased: applications, keys, document types and their versions, results and extraction records, webhook endpoints and deliveries, logs, quality counts, shared samples, members and the audit log. Until then an owner can cancel, and the organization comes back exactly as it was. ReceViz keeps one line of its own saying the organization was erased, when, and how many records went.

Logs#

• The request log holds metadata only: request id, time, endpoint, status, latency, error code, mode, document type, pages, source and SDK. Never a document, a value or a line of text. Kept for 90 days.
• The audit log records what people did in the console: keys created, rotated and revoked, document types published, members changed. Kept for 400 days.

What the settings do not do#

These settings are controls over what ReceViz keeps and where document text goes. They do not by themselves make you, or anyone, compliant with a data-protection law: that depends on everything around your use of ReceViz, such as why you collect documents, what you tell the people they belong to, and how long you keep the values you store.

See evidence levels for exactly what each level removes from a response.