Privacy Policy for NanoDoc

Effective Date: September 22, 2026

NanoDoc ("we", "us", or "our") is a document parsing service that converts PDF documents into structured Markdown and JSON data. NanoDoc is available through two distinct deployment modes:

1. Cloud API Mode — A cloud-based Application Programming Interface (API) service. Your documents are transmitted to NanoDoc's servers over encrypted connections, processed on our cloud infrastructure, and the structured results are returned to you through API responses.

2. Private Deployment Mode — A NanoDoc deployment instance licensed to you and installed within your own infrastructure, including your private cloud (VPC), on-premise servers, or an air-gapped environment. All document parsing and data extraction are performed entirely within your own infrastructure.

We are committed to protecting your privacy and ensuring that your data is handled with care across both deployment modes. This Privacy Policy explains our data practices for each mode and the safeguards we implement to protect your information and data security.

1. Cloud API Mode — Cloud Data Handling

When you use NanoDoc in Cloud API Mode, the following data handling practices apply:

1.1 Data You Provide

When you call the Cloud API, you transmit the following data to NanoDoc's servers:

• Document Content: The PDF files you submit for parsing.
• API Request Metadata: Information such as your API key identifier, request timestamps, request volume, IP address, and response status codes.
• Account Information: If you register for an API account, we collect your email address and billing information necessary for account management, authentication, and invoicing.

1.2 How We Process Your Data

• Document Processing: Your uploaded PDF documents are parsed and converted into structured Markdown and JSON data on our cloud infrastructure. The results are returned to you via the API response.
• Encryption in Transit: All data transmitted between your system and our servers is encrypted using Transport Layer Security (TLS 1.2 or above).
• Encryption at Rest: Your temporarily stored documents and generated outputs are encrypted at rest on our servers using industry-standard encryption algorithms.

1.3 Data Retention

• Processed Documents: Your uploaded PDF documents and generated outputs are retained on our servers only for the minimum period necessary to process your request and deliver the API response, after which they are permanently and automatically deleted from primary storage. Any residual backup copies will be securely overwritten or deleted in accordance with our standard backup retention schedule.
• API Logs: We retain API request metadata (timestamps, request volume, API key identifiers, response status codes) only for as long as necessary for the purposes of service monitoring, billing verification, abuse prevention, and security investigation, and thereafter delete it.
• Account Data: Your account information (email, billing records) is retained for the duration of your active account and deleted upon account termination, except where retention is required by applicable tax, accounting, or financial regulations.

1.4 Data Deletion Requests

You may request expedited deletion of your processed documents at any time by contacting us at contact@nanodoc.ai. We will process such requests within a reasonable time after identity verification. Upon deletion, your documents and associated generated outputs will be permanently removed from primary storage, and any residual backup copies will be securely deleted in accordance with our standard backup retention schedule.

2. Private Deployment Mode — The "Data Stays Local" Principle

When you use NanoDoc in Private Deployment Mode, the following principles apply:

• Processing Within Your Infrastructure: All document parsing and data extraction are performed by the deployment instance running in your own infrastructure. No document content is transmitted to NanoDoc's servers.

• Storage Within Your Infrastructure: Your source PDF files, generated Markdown/JSON outputs, configuration files, and operational logs are stored exclusively within your own infrastructure.

• No Document Uploads: We do not host, store, or have access to your documents at any time. Your data never leaves your environment unless you explicitly initiate a transmission, for example by granting us temporary access for support or by connecting third-party integrations.

• No Telemetry: We do not collect usage telemetry, diagnostic data, or error reports from a Private Deployment. No data of any kind is transmitted from your infrastructure to us.

3. Information We Do Not Collect

Regardless of the deployment mode you choose, we never:

• Use your document content or generated data for training, fine-tuning, or improving any machine learning models.
• Sell, rent, or share your data with third parties for marketing or advertising purposes.
• Access or read your document contents for any purpose other than processing your explicit API requests (Cloud API Mode) or troubleshooting issues you proactively report to us.

Private Deployment Mode — Additional Non-Collection

When operating in Private Deployment Mode, we additionally never collect, access, or store:

• Contents of your documents
• Metadata of processed files
• Generated structural data (Markdown, JSON)
• Your directory paths, file names, or file structure
• Personally identifiable information contained in your documents
• Your processing logs or system resource usage data

4. Computational Resources

4.1 Cloud API Mode

All computational resources required for document parsing are provided by NanoDoc's cloud infrastructure. You are billed based on your API usage as described in your service agreement and applicable pricing plans.

4.2 Private Deployment Mode

All computational resources required for document parsing are provided by your own infrastructure. NanoDoc does not perform parsing on your behalf in this mode, and does not consume, meter, or monitor your infrastructure usage.

5. Data Security

5.1 Cloud API Mode

For the Cloud API Mode, we implement the following security measures:

• Encryption in Transit: All API communications are secured with TLS 1.2 or above.
• Encryption at Rest: All stored documents and data are encrypted at rest using industry-standard encryption algorithms.
• Access Control: Access to your data is restricted to authorized personnel with a legitimate business need, enforced through role-based access controls and audit logging.
• Infrastructure Security: Our cloud infrastructure is hosted on reputable cloud service providers that apply industry-recognized security controls and undergo regular independent security assessments.
• API Key Security: Each API request is authenticated using your unique API key. You are responsible for safeguarding your API key and must not share it with unauthorized parties. You must notify us immediately upon discovery of any unauthorized use or compromise of your API key.
• Regular Audits: We conduct regular security reviews and vulnerability assessments of our infrastructure and APIs.

5.2 Private Deployment Mode

In Private Deployment Mode, all files and data reside solely within your own infrastructure. You are the controller of that data and are fully responsible for securing your operating environment, file system, storage encryption, access permissions, and network controls.

We strongly recommend that you:

• Restrict file system permissions for input and output directories.
• Apply encryption at rest for stored documents and outputs.
• Enforce role-based access control and audit logging for administrative access.
• Maintain regular security updates for the operating system and container runtime.
• Isolate the deployment within a dedicated network segment or VPC.

We do not provide encryption, backup, or cloud-side data management for data held within your infrastructure, as all such data management is under your exclusive control.

5.3 Sub-Processors

For the Cloud API Mode, we may engage trusted third-party service providers (sub-processors) to support our infrastructure operations, including cloud hosting, data storage, and monitoring. We require all sub-processors to adhere to applicable data protection standards and enter into appropriate data protection agreements. A current list of sub-processors is available upon request.

For the Private Deployment Mode, no sub-processors are involved in the processing of your documents.

6. Data Breach Notification

6.1 Cloud API Mode

In the event of a confirmed data breach affecting your documents or personal information processed through the Cloud API, we will:

• Notify affected users without undue delay, and in accordance with applicable legal requirements.
• Provide a description of the nature of the breach, the categories and approximate number of affected records, the likely consequences, and the measures we are taking or propose to take.
• Take immediate remedial action to contain the breach, mitigate its effects, and prevent recurrence.
• Document all relevant facts and actions related to the breach for regulatory accountability where applicable.

6.2 Private Deployment Mode

As we do not collect or store your documents in Private Deployment Mode, data breach notifications by us are not applicable. You are responsible for detecting, managing, and reporting security incidents within your own infrastructure in accordance with applicable law.

7. Your Data Protection Rights

7.1 Cloud API Mode

For users of the Cloud API Mode, depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to Restrict Processing: Request that we limit the processing of your personal data.
• Right to Data Portability: Request your data in a structured, commonly used, and machine-readable format.
• Right to Object: Object to the processing of your personal data for legitimate interests.

To exercise these rights, please contact us at contact@nanodoc.ai. We will respond to your request within the timeframe required by applicable law. We may need to verify your identity before processing your request.

7.2 Private Deployment Mode

We do not collect or process your documents or the personal data contained in them in Private Deployment Mode. All such data remains under your exclusive control within your own infrastructure, and you act as the data controller in respect of it. Rights requests relating to data held in your infrastructure are handled by you under your own policies.

8. International Data Transfers

8.1 Cloud API Mode

When you use the Cloud API, your data may be processed on servers located in a country or jurisdiction different from your own. We ensure that such transfers are conducted in compliance with applicable data protection laws, including through standard contractual clauses, adequacy decisions, or other legally recognized transfer mechanisms. Where your data is transferred to a jurisdiction without an adequacy decision, we will implement appropriate safeguards as required by applicable law.

8.2 Private Deployment Mode

Not applicable. Your documents are not transferred to NanoDoc's servers and remain within the infrastructure and jurisdiction you have chosen.

9. Changes to This Policy

We may update this Privacy Policy from time to time for business, legal, or regulatory reasons.

Any revisions will be published on our official website. For material changes, we will also notify registered users and customers with an active Private Deployment license via email at least 30 days before the changes take effect, except for changes required by law which may take effect immediately. Your continued use of NanoDoc after policy changes constitutes your acceptance of the updated Privacy Policy.

10. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the jurisdiction in which NanoDoc's servers are hosted (for Cloud API Mode), and by the governing law specified in the applicable written agreement between you and us (for Private Deployment Mode), without regard to conflict of law principles.

11. Limitation of Liability

11.1 Cloud API Mode

To the maximum extent permitted by applicable law, NanoDoc shall not be liable for any indirect, incidental, special, or consequential damages, including but not limited to loss of profits, data loss, business interruption, or any other indirect economic losses arising from your use of or inability to use the Cloud API. Our total aggregate liability for all claims arising from the Cloud API shall not exceed the fees paid by you to NanoDoc in the three (3) months preceding the event giving rise to the claim.

11.2 Private Deployment Mode

We shall not be liable for any data leakage, loss, or damage arising from your configuration, operation, or inadequate protection of your own infrastructure, or from unauthorized access to your environment.

The above limitations shall not apply to liabilities that cannot be limited under applicable mandatory law, including liability for our intentional misconduct, gross negligence, or violations of applicable data protection laws.

12. Minor Users

NanoDoc is intended for use by developers and enterprise users. We do not knowingly provide services to minors under the age of 18. If you believe a minor has provided us with personal information through the Cloud API, please contact us, and we will take steps to delete such information.

13. Contact Us

If you have any questions, suggestions, or complaints regarding this Privacy Policy or NanoDoc's data practices, please contact us via:

Email: contact@nanodoc.ai