Privacy Policy

PicToText ("Pic To Text", "we", "us", or "our") provides OCR and document processing tools at pictotext.io. We are committed to safeguarding personal data in line with GDPR, CCPA, and other applicable regulations. This Privacy Policy explains what data we collect, how we use it, and the rights that are available to you. If you have any questions, contact us at support@pictotext.io

1. Data controller & contact

PicToText is the controller of personal data processed through our web app, API, support inbox, and billing tools. You may reach our data protection contact exclusively via email at support@pictotext.io

2. Information we collect

• Account & profile data. Name and email collected when you create an account or sign in via OAuth.
• Billing & payment data. The payment provider you select collects payment and billing information through its checkout. We receive and retain information needed to manage your purchase, such as customer and order identifiers, amounts, currency, payment and subscription status, refund details, and billing contact information supplied by the provider. PicToText does not directly collect or store full payment card numbers or card security codes through checkout.
• Uploaded images and OCR output. Files you submit for conversion plus generated text, file metadata, and processing results. These items are encrypted at rest and deleted per the retention schedule below.
• Usage & device information. IP address, browser type, language, referrer URL, system events, and request logs needed for security, troubleshooting, and rate limiting.
• Support data. Messages, attachments, and transcripts sent via email.
• Cookies & analytics. Cookies and similar technologies maintain authentication and support analytics and advertising. When enabled, Google Analytics, Microsoft Clarity and Google AdSense may collect device, browsing and interaction information.

3. How we use your data & legal bases

We process personal data only when one of the following legal bases applies:

• Contractual necessity. Provide OCR conversions, manage accounts, deliver API responses, and issue invoices or receipts.
• Legitimate interests. Improve features, monitor abuse, keep services secure, and calculate aggregated analytics. We balance these interests against user rights.
• Legal obligations. Maintain tax/audit records, comply with AML, and respond to lawful requests.
• Consent. Send marketing emails, store optional cookies, or retain uploaded files longer than the default window when you explicitly opt in.

4. Payments & refunds

Paddle or Waffo acts as the merchant of record for a purchase, as identified at checkout and on your receipt. We provide the selected payment provider with information needed to complete and manage the purchase, such as your email address, internal account identifier, and order or product references. The provider processes payment, tax, fraud-prevention and billing information under its own privacy policy and sends us transaction, subscription and refund updates. OCR images and results are not included in our payment checkout requests. Refund eligibility, procedures and timing are governed by our Terms of Service and the original payment provider's applicable rules. For billing or privacy questions, contact us at support@pictotext.io.

5. Retention

• User accounts: retained while your account is active and for up to 24 months after inactivity.
• Billing records: stored for at least seven years to satisfy tax and accounting rules.
• Uploaded files & OCR output: deleted automatically after 30 days unless you manually save them or grant consent for longer retention.
• Support requests: kept for 24 months to resolve issues and maintain audit trails.

6. Sharing & international transfers

We share data needed to provide the Services with payment providers; Cloudflare for hosting, storage and AI request routing; database and rate-limiting services; Google for OAuth sign-in; and email, support, analytics and advertising providers. To perform OCR, uploaded images and processing instructions are sent to configured AI services. Providers may process data in countries other than your own. Payment providers process transaction data under their own privacy policies; other providers handle data according to their role and applicable service terms. International transfers are subject to applicable data-protection requirements, including adequacy decisions or standard contractual clauses where required.

7. Security

We use technical and organizational measures designed to protect personal data, including HTTPS connections, access controls and operational logging. Storage protection also depends on the security controls and configuration of our infrastructure providers. No system is completely secure; please contact us immediately if you suspect unauthorized access.

8. Your rights

Depending on your jurisdiction, you may request access, correction, deletion, restriction, portability, or objection to processing. You can also withdraw consent or lodge a complaint with your local supervisory authority. Submit any request by emailing support@pictotext.io. We verify identity before completing requests.

9. Cookies & tracking

Essential cookies support authentication and security. When enabled, Google Analytics, Microsoft Clarity and Google AdSense use cookies or similar technologies for usage measurement, interaction analysis and advertising. You can manage cookies through your browser settings and available provider controls. Blocking cookies or scripts may affect site functionality. These controls do not replace any consent required by applicable law.

10. Children's privacy

Our services are not directed to children under 13 (or the minimum age required by local law). We do not knowingly collect data from children. If you believe a child provided personal data, please contact us and we will delete it.

11. Changes to this policy

We will post updates on this page and notify account owners via email or dashboard alerts at least 10 days before material changes take effect. Continued use after the effective date constitutes acceptance of the updated Privacy Policy.