Privacy Notice

Controller

Financial Technology OÜ, Narva mnt 5, Tallinn 10117, Estonia. Registry code 14703656.

Privacy contact: support@fintech.ee.

Scope

This notice covers the authenticated manual beta at privacy.ly, www.privacy.ly, and the compatibility hostname filter.privacy.ly. It does not cover a self-serve billing launch, separate enterprise deployment, or staging environment.

Data We Process

The demo processes the document content you choose to submit, including text, HTML email content, and selectable PDF text and layout data. Your browser may display the local filename for your own context, but API responses and review reports are designed to omit uploaded source filenames.

Operational metadata can include request timing, workflow type, content type, provider mode, finding counts, PDF verification counts, error categories, and safe request identifiers. It must not include raw source text, PDF bytes, matched values, uploaded filenames, generated artifacts, provider tokens, database URLs, Stripe secrets, auth secrets, or bearer tokens.

Why We Process It

We process submitted content to provide the redaction-assistance workflow you request: detecting likely private data, allowing human review, generating reduced copies, and verifying selectable PDF redactions.

We process limited operational metadata to operate, secure, troubleshoot, measure reliability, prevent abuse, and maintain evidence that the manual beta is running in the stated posture.

Legal Bases

For EU/EEA data protection purposes, processing you initiate through the demo is based on providing the requested service or taking steps at your request before a possible service relationship. Security, abuse prevention, reliability, and non-raw operational measurement rely on legitimate interests. Where a legal obligation requires processing or disclosure, that obligation is the legal basis.

Subprocessors and Recipients

The manual beta is hosted on Cloudflare Workers and Cloudflare Containers. Live detection currently uses Replicate through server-side provider access. Contact emails may be handled by email providers, and we may share limited information with professional advisers or authorities where required.

We do not sell personal data and do not use submitted documents for advertising.

Retention

The manual beta is configured with app-managed artifact retention TTL of zero seconds. Submitted source content and generated artifacts are processed in request memory and returned to the browser; they are not intentionally stored by the app as documents or downloadable artifacts.

Metadata-only operational records, infrastructure logs, and security records may be retained for service operation, debugging, abuse prevention, and legal compliance. These records are designed to exclude raw document content, matched values, filenames, and artifacts.

International Transfers

Cloud providers, model providers, and email providers may process data outside the EEA. Where required, transfers should rely on an adequacy decision, standard contractual clauses, or another valid transfer mechanism. Contact us if you need information about relevant safeguards.

Your Choices and Rights

Do not submit a document unless you have authority to process it through the demo. You may request access, rectification, erasure, restriction, portability, or objection where applicable. You may also complain to the Estonian Data Protection Inspectorate or another competent supervisory authority.

Limitations

Privacy.ly Filter provides redaction assistance. It does not guarantee anonymization, GDPR compliance, legal compliance, or complete removal of every personal-data trace. Human review is required before relying on any output. PDF support is manual beta; coordinate-backed OCR is attempted for scanned or image-based PDFs when safe, residual traces can remain in unsupported, malformed, image-only, encrypted, or unusual-layout PDFs, and PDFs fail closed when OCR cannot provide mapped redaction coordinates.

Automated Decisions

The demo flags likely private data for review. It does not make decisions that produce legal or similarly significant effects about individuals.

Changes

We may update this notice when the product, providers, deployment posture, retention model, or legal requirements change. The latest version is published on this page.