Privacy Policy for Ingestly

Effective Date: 3/8/2026

Last Updated: 4/10/2026

1. Introduction and Scope of Policy

Ingestly (“we,” “our,” or “us”) provides a cloud-based Intelligent Document Processing (IDP) platform designed to extract, analyze, and structure data from uploaded documents through our web application, APIs, and associated integrations (collectively, the “Services”). We recognize that the documents processed through our platform contain highly sensitive, proprietary, and personal information, including financial records, personally identifiable information, and confidential corporate data.

This Privacy Policy defines our rigorous protocols for the collection, use, retention, security, and disclosure of information. To ensure maximum operational transparency and security, this policy distinguishes fundamentally between Account Data (information related to the individuals and corporate entities who subscribe to our Services) and Document Payload Data (the unstructured or structured content contained within the documents uploaded to our Services for extraction).

By accessing or using the Services, you acknowledge that you have read, understood, and agree to the data practices described in this Privacy Policy.

Important Notice Regarding HIPAA: Ingestly is not a HIPAA-certified service and does not support health data related use-cases. While we take data security and data privacy very seriously, we have not undergone an official HIPAA certification process. You should not use Ingestly to process Protected Health Information (PHI) or any data subject to the Health Insurance Portability and Accountability Act (HIPAA).

2. Definitions of Data Categories

To provide clarity regarding our data handling practices, we categorize the data we interact with into two distinct classifications:

• Account Data: This refers to the personal and corporate information provided by the user to establish, bill, and manage an account with Ingestly. This includes names, email addresses, payment details, and telemetry data regarding interaction with our dashboard.
• Document Payload Data: This refers to all structured, unstructured, or semi-structured data, text, images, spatial coordinates, and variables extracted from or contained within the documents, PDFs, emails, or images uploaded by the user to the Services for the purpose of data extraction.

3. Information We Collect and the Mechanics of Ingestion

3.1. Collection of Account Data

When you register for an account, interact with our customer support personnel, or process subscription payments, we actively collect the following information:

• Identity and Contact Information: First name, last name, corporate email address, and company name.
• Financial and Billing Information: Billing addresses, tax identification numbers, and payment processing details. We do not store raw credit card numbers on our servers; all payment processing is handled securely by our PCI-DSS compliant third-party payment processor.
• Technical and Telemetry Data: IP addresses, browser types, device identifiers, access times, and interaction telemetry within our web application. This data is collected automatically to ensure service reliability, prevent fraud, and optimize the user interface.

3.2. Processing of Document Payload Data

To perform the core extraction functionality of our Services, our infrastructure must ingest and temporarily process the documents you transmit to us via direct web upload, HTTP, or email. These documents may inadvertently or purposely contain sensitive information, including Social Security numbers, financial routing numbers, medical histories, or proprietary trade secrets.

Role Acknowledgment and Controller Obligations:In regard to all Document Payload Data, you (the customer) remain the Data Controller. Ingestly operates strictly as a Data Processor. We do not control what data you choose to upload, nor do we determine the legal basis for processing the individuals' data contained within those documents. It is your sole responsibility to ensure you have the appropriate consent and legal authority to upload such documents to our Services.

4. Purpose and Limitations of Data Utilization

4.1. Utilization of Account Data

We utilize Account Data to provision, maintain, and support the Services. This includes processing subscription billing, managing secure account authentication, and communicating administrative notices, technical alerts, and security updates. Furthermore, we monitor and analyze usage trends using aggregated Account Data to optimize platform stability and develop new features.

4.2. Strict Limitations on Document Payload Data

We apply absolute, uncompromising operational boundaries regarding your Document Payload Data. Under no circumstances do we sell, rent, license, or commoditize your original documents or the structured data extracted from them. We use Document Payload Data exclusively to execute the extraction rules, Optical Character Recognition (OCR) processes, and algorithmic analysis requested by your specific HTTP requests, email submissions, or dashboard configurations.

4.3. Artificial Intelligence and Machine Learning (AI/ML) Training Policy

Ingestly leverages advanced machine learning models to facilitate highly accurate data extraction. To protect your proprietary and sensitive information from memorization and inadvertent disclosure, our policy regarding AI training is absolute:

• Zero Training on User Data:Ingestly does not use your Document Payload Data—whether in raw, aggregated, or de-identified formats—to train, retrain, or fine-tune any Artificial Intelligence or Large Language Models (LLMs). We explicitly reject the use of “de-identified” payload data for generalized algorithmic research.
• Third-Party AI Service Providers: To execute document extraction, analysis, and structuring operations, Document Payload Data is transmitted to third-party AI service providers. These providers process data solely to fulfill extraction requests on our behalf and are contractually prohibited from using your data for model training. We maintain strict Data Processing Agreements (DPAs) with all AI service providers.
• Strict Tenant Isolation: Any custom extraction templates, specific parsing rules, or localized spatial models generated by your specific usage of the platform remain strictly isolated to your secure tenant environment. These custom models are never generalized or deployed to benefit other customers on our platform.

5. Storage, Retention, and Deletion

Minimizing data retention is our primary architectural safeguard against unauthorized access and regulatory liability. Our data retention protocols are designed to comply with data minimization principles mandated by global privacy frameworks.

• Per-Pipeline Configurable Retention: Ingestly operates on a per-pipeline configurable retention architecture. Each processing pipeline has a required retention period (ranging from one to three hundred and sixty-five days) that governs how long Document Payload Data is stored. This allows organizations to tailor retention to specific compliance requirements on a pipeline-by-pipeline basis.
• Permanent Deletion: Upon the expiration of the pipeline-configured retention window, or upon a manual deletion command triggered by the user via the dashboard or HTTP request, all associated documents, extracted data, and database rows are permanently deleted from cloud storage and the database.
• Account Data Retention: We retain Account Data for as long as your account remains active, or as required to comply with our binding legal, tax, and accounting obligations.

6. Data Sharing and Sub-processor Architecture

To deliver a reliable, highly available, and globally scalable IDP platform, we engage specialized third-party sub-processors. We maintain rigorous Data Processing Agreements (DPAs) with each vendor, ensuring they are contractually bound to adhere to security, confidentiality, and privacy standards that are equal to or more stringent than our own. We share data only to the strict extent necessary for the sub-processor to perform their specified function.

Authorized Sub-processor Matrix

7. Security Protocols and Incident Response

We implement commercially reasonable, industry-standard administrative, technical, and physical safeguards designed to protect your information against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure.

• Encryption Standards: All data transmitted between your local environment and our servers is secured using Transport Layer Security (TLS) 1.2 or higher. All data stored within our infrastructure (during your configured retention windows) is encrypted at rest using Advanced Encryption Standard (AES-256) encryption provided by the cloud infrastructure provider.
• Access Controls:Access to our production environments and underlying databases is strictly limited to authorized engineering personnel. Authentication is managed by a third-party identity provider which supports multi-factor authentication (MFA) configuration. All access is logged extensively. Our multi-tenancy architecture enforces strict data isolation between organizations, ensuring that no organization can access another organization's Document Payload Data or Account Data.

7.1. Breach Notification and FIPA Compliance

In the event of a confirmed security breach resulting in the unauthorized acquisition of unencrypted personal information, Ingestly will immediately enact our formal Incident Response Plan. In strict compliance with the Florida Information Protection Act (FIPA) and relevant global statutes, we will notify affected Data Controllers without unreasonable delay, and in no event later than thirty (30) days following the discovery of the breach. We will provide all necessary forensic cooperation to assist the Data Controller in fulfilling their own notification obligations to end-users and respective regulatory authorities.

8. Regional Privacy Rights and Jurisdictional Compliance

8.1. California (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), California residents have the right to know what personal information is collected, request deletion, and opt-out of the sale or sharing of personal information. We explicitly declare that Ingestly does not sell your personal information or Document Payload Data to any third parties.

8.2. Florida Digital Bill of Rights (FDBR)

While Ingestly may not meet the massive revenue thresholds that define a primary “Controller” under the Florida Digital Bill of Rights, we remain deeply committed to transparent data practices that facilitate our enterprise clients' compliance. We expressly prohibit the sale of sensitive personal data or the utilization of consumer data for undisclosed targeted advertising or profiling. If you are a covered Controller under the FDBR utilizing our Services, we legally agree to process data strictly per your documented instructions to ensure your downstream compliance with Florida law.

8.3. European Economic Area (GDPR and UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights with respect to your personal data under the General Data Protection Regulation (GDPR) and equivalent legislation:

• Right of Access: You may request confirmation of whether we process your personal data and obtain a copy of that data.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data, subject to our legal retention obligations.
• Right to Restrict Processing: You may request that we limit the processing of your personal data under certain circumstances.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to the processing of your personal data, including for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at support@ingestly.ai. We will respond to verified requests within thirty (30) calendar days. With respect to Document Payload Data, Ingestly acts as a Data Processor, and rights requests relating to that data should be directed to the Customer (Data Controller) that uploaded the data. Ingestly will cooperate with and assist the Data Controller in responding to such requests in accordance with the applicable Data Processing Agreement.

9. Modifications to this Privacy Policy

We reserve the right to update or modify this Privacy Policy periodically to reflect changes in our operational practices, evolving regulatory environments, or technological advancements. We will notify active account holders of any material changes via email or a prominent notification within the application dashboard at least thirty (30) calendar days prior to the change becoming effective. Your continued use of the Services after the effective date of the revised Privacy Policy constitutes your acceptance of the updated terms.

10. Contact and Governance Information

If you have questions, concerns, or formal legal requests related to this Privacy Policy, our sub-processor ecosystem, or our security practices, please contact our Data Protection Officer at:

Email: support@ingestly.ai