Privacy Policy

Last updated: February 2026

Cretac.ai ("Cretac", "we", "us", or "our") operates the document processing platform at cretac.ai. This Privacy Policy explains how we collect, use, store, and protect information when you use our services.

1. Information We Collect

Account information. When you sign up, we collect your name and email address through Google OAuth. We do not collect or store your Google password.

Documents you upload. We process the documents you upload (PDFs, images) to extract structured data according to your instructions. Uploaded documents and extracted data are stored securely on your behalf.

Usage data. We collect basic analytics such as feature usage frequency, processing timestamps, and error logs to improve service quality.

2. How We Use Your Information

• To provide, maintain, and improve the document processing service
• To authenticate your identity and manage your account
• To process documents according to your templates and instructions
• To send transactional emails (e.g., approval workflow notifications)
• To diagnose technical issues and ensure platform security

3. Data Storage and Security

All data is hosted on Amazon Web Services (AWS) infrastructure in secured, access-controlled environments.

• Documents and files are stored in Amazon S3 with server-side encryption (AES-256).
• Structured data (extracted fields, metadata) is stored in Amazon DynamoDB with encryption at rest.
• Data in transit is protected using TLS 1.2+ (256-bit encryption).

Access to production infrastructure is restricted to authorised personnel and protected by multi-factor authentication.

4. Third-Party Services

We use the following third-party services to deliver our platform:

• Google OAuth — For secure authentication. Google receives only the authentication request; we do not share your documents with Google's authentication service.
• Amazon Textract — For optical character recognition (OCR) and table extraction from your documents. Documents are sent to AWS Textract for processing and are not retained by AWS beyond the processing request.
• Google Gemini — For AI-powered data extraction and validation. Document text is sent to Google's API for processing according to your rules. Google's data usage policies for API consumers apply.

5. Data Sharing

We do not sell, rent, or trade your personal information or document data to third parties. We share data only as described above (with infrastructure and AI providers necessary to deliver the service) or when required by law.

6. Your Rights (GDPR)

If you are located in the European Economic Area, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Export your data in a portable format
• Object to or restrict certain processing activities

To exercise any of these rights, contact us at hello@cretac.ai.

7. Data Retention

We retain your documents and extracted data for as long as your account is active. If you delete a document, it is permanently removed from our storage within 30 days. If you close your account, all associated data is deleted within 30 days.

8. Cookies

We use essential cookies for authentication session management. We do not use advertising or tracking cookies.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the application. Continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions about this Privacy Policy, contact us at hello@cretac.ai.