Privacy Policy

Last updated: July 2026

The short version: your documents are yours. We don't sell them, don't share them with third parties for marketing, and don't use them to train AI models. We use them only to give you the extracted data you asked for.

1. Who we are

AutoData is operated by GrowSight. If you're in the EU, we act as a data processor for the invoices/documents you upload — you (the customer) are the data controller.

2. What data we collect

Category	Purpose
Account (email, name, password hash)	Authentication and support
Documents you upload (PDFs, photos)	To extract structured data for you
Extracted data (vendor, date, amount, etc.)	Delivered to you in Excel, Sheets or API
Usage logs (login times, API calls)	Security, debugging, billing
Payment info	Handled by AppSumo/Stripe — we don't store card numbers

3. What we do NOT do

❌ We do not sell your data to anyone.
❌ We do not use your documents to train AI models. Our AI provider (Anthropic Claude) processes your data with zero-retention agreements.
❌ We do not share your documents with third parties, except sub-processors listed below.
❌ We do not read your documents manually except when you explicitly ask for support.

4. Sub-processors

Service	Purpose	Data
Anthropic (Claude API)	AI document extraction	Document content (zero retention)
Vercel	Hosting	All app data (SOC 2 Type II)
Neon	Database (Postgres)	Account & extracted data (encrypted at rest)
Stripe / AppSumo	Payments	Payment info only, not documents
Resend / SendGrid	Email delivery	Email address, transactional messages

5. Where data is stored

Data is stored in AWS US East region (via Vercel and Neon). For customers who need data residency in EU or elsewhere, our on-premise agent lets you keep all documents inside your own network — nothing ever reaches our cloud.

6. Retention

Documents are stored while your account is active.
On cancellation: 30-day export window, then permanent deletion.
You can delete individual documents anytime from the app.
Backups are rotated on a 30-day cycle.

7. Your rights (GDPR / CCPA)

You have the right to:

Access your data (available from the app export function).
Correct or update your data (self-serve).
Delete your data (self-serve or by request).
Export your data in a portable format (Excel, CSV, JSON).
Object to processing or withdraw consent.

To exercise any right, email support@growsight.online. We reply within 30 days.

8. Security

All connections use TLS 1.3.
Data at rest is encrypted with AES-256.
Passwords are hashed with bcrypt.
Two-factor authentication available for admin roles.
Regular security audits and penetration tests.

9. Cookies

We use only essential cookies (session token, CSRF protection). No advertising or tracking cookies. Analytics is done in aggregate and cannot be used to identify you.

10. Data breach notification

If a data breach affects your account, we'll notify you within 72 hours of discovery, per GDPR requirements.

11. Children

AutoData is not directed at children under 16. We don't knowingly collect data from anyone under 16.

12. Changes to this policy

Material changes will be notified by email at least 30 days before taking effect. The current version is always at this URL.

13. Contact

For any privacy question: support@growsight.online.

AutoData · A GrowSight product · Back to home