← Home

Privacy Policy

Last updated: April 2, 2026

This Privacy Policy explains how Formalbyte SRL (“we”, “our”, or “us”) collects, uses, and protects your information when you use OCRskill (the “Service”). We are committed to privacy-by-design and transient data processing.

Who We Are

Formalbyte SRL
Romania
Email: legal@formalbyte.eu
Website: https://ocrskill.com

We act as the data controller for personal data processed through the Service.

What We Process

We process different categories of data depending on your interaction with the Service:

1. OCR Content (Images and Extracted Text)

When you upload an image for OCR processing, we temporarily handle:

  • The image file you upload
  • The text extracted from that image

2. Account and API Data

If you generate an API key or contact us, we may process:

  • API key identifiers and usage metadata
  • Email addresses (if you contact us)
  • Request timestamps and IP addresses (for rate limiting and security)

3. Technical and Log Data

Our servers automatically collect:

  • IP addresses
  • Request timestamps
  • HTTP headers
  • Error logs
  • Security event logs

4. Analytics Data

We use Vercel Analytics and Vercel Speed Insights to understand site performance. These tools may collect:

  • Page view statistics
  • Performance metrics
  • Device/browser information (anonymized)

How OCR Content Is Handled

Transient Processing

We do not retain your images or extracted text.

  • Images are processed in memory and discarded immediately after OCR completes
  • Extracted text is returned to you and not stored on our servers
  • We use only short-lived technical buffering necessary for processing (typically milliseconds to seconds)
  • No persistent storage of customer content

What This Means

  • We cannot retrieve your previously uploaded images
  • We cannot access your extracted text after processing completes
  • We cannot provide historical OCR results
  • In the unlikely event of a security incident, your content data would not be at risk because it does not persist

No Training / No Dataset Building

Your data is never used to train AI models.

We explicitly commit that:

  • Customer images and extracted text are never used to train, fine-tune, or improve our OCR models
  • We do not build datasets from customer uploads
  • We do not use your content to improve our service algorithms
  • We do not share customer content with AI/ML providers for training purposes

Our OCR models are trained on publicly available and licensed datasets, completely separate from customer data.

Operational Metadata and Logs

While we do not store your content, we retain certain operational data:

Retained Data

  • API usage logs: Request counts, timestamps, and rate limit data (retained for billing and abuse prevention)
  • Security logs: IP addresses, request patterns, and security events (retained for 30 days)
  • Error logs: Technical errors and debugging information (retained for 7 days)
  • Support communications: Emails and messages you send us (retained for as long as necessary to resolve your inquiry)

Purpose

This data is retained for:

  • Service security and abuse prevention
  • Technical debugging and service improvement
  • Compliance with legal obligations
  • Responding to support requests

Analytics and Similar Technologies

We use the following analytics and performance tools:

Vercel Analytics

  • Purpose: Understanding site usage and performance
  • Data collected: Anonymized page views, performance metrics
  • Retention: As per Vercel’s policies
  • Opt-out: You can use browser privacy features to limit tracking

Vercel Speed Insights

  • Purpose: Measuring site performance
  • Data collected: Performance timing data, Core Web Vitals
  • Retention: As per Vercel’s policies

We do not use advertising cookies or third-party marketing trackers.

Why We Process Data

We process your data based on the following legal grounds:

Purpose Legal Basis
Providing OCR service Contract performance (processing your request)
Security and abuse prevention Legitimate interests (protecting our service)
Legal compliance Legal obligation
Support and communication Contract performance or legitimate interests
Analytics and improvement Legitimate interests (improving service)

Sharing and Service Providers

We share data only as necessary to operate the Service:

Infrastructure Providers

We use cloud infrastructure providers to host our service. These providers process data on our behalf under data processing agreements.

Analytics Providers

Vercel provides analytics and performance monitoring services.

We may disclose data if required by law, court order, or to protect our rights, property, or safety.

No Sale of Data

We do not sell your personal data to third parties.

International Transfers

Our infrastructure providers may process data in various jurisdictions. We ensure appropriate safeguards are in place, including:

  • Data processing agreements with standard contractual clauses where applicable
  • Provider commitments to GDPR-equivalent protection levels

Retention

Different categories of data are retained for different periods:

Data Type Retention Period
OCR images and extracted text Not retained (transient processing only)
API usage metadata Up to 12 months
Security logs 30 days
Error logs 7 days
Support communications 3 years after case closure

Security

We implement appropriate technical and organizational measures to protect your data:

  • Encryption in transit (TLS 1.2+)
  • Transient processing architecture (no persistent content storage)
  • Access controls and authentication for API endpoints
  • Regular security reviews
  • Infrastructure security through our cloud providers

While we take these measures, no internet service is completely secure. We encourage you to protect your API keys and use the service responsibly.

Your Rights

Depending on your jurisdiction, you may have the following rights:

  • Access: Request information about data we hold about you
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your personal data
  • Restriction: Request restriction of processing
  • Portability: Request transfer of your data
  • Objection: Object to certain processing activities
  • Withdraw consent: Where processing is based on consent

To exercise these rights, contact us at legal@formalbyte.eu.

Response Time

We aim to respond to requests within 30 days. Complex requests may take longer, in which case we will notify you.

Contact

For privacy-related questions, data requests, or concerns:

Email: legal@formalbyte.eu
Company: Formalbyte SRL, Romania

Frequently Asked Questions

Do you keep uploaded images?

No. Images are processed in memory and immediately discarded. We do not store, archive, or retain your images after OCR completes.

Do you keep the text extracted from my images?

No. Extracted text is returned to you in the API response and is not stored on our servers.

Do you train AI models on my data?

No. Your images and extracted text are never used to train, fine-tune, or improve our OCR models. We do not build datasets from customer uploads.

Can you retrieve my previous OCR results?

No. Because we don’t store your content, we cannot retrieve, restore, or provide historical OCR results.

What data do you actually keep?

We retain operational metadata such as request counts, timestamps, IP addresses (for security), and support communications. This does not include your images or extracted text.

Is my data encrypted?

Yes. All data transmission uses TLS encryption. Processing occurs in our secure infrastructure.

Do you share my data with third parties?

We share data only with infrastructure providers necessary to operate the service (under data processing agreements) and analytics providers. We do not sell your data.

I’m from the EU. Is this GDPR compliant?

We design our service with GDPR principles in mind, including data minimization, purpose limitation, and transient processing. Contact us for our Data Processing Agreement if needed.

How do I request deletion of my data?

Email legal@formalbyte.eu with your request. Note that since we don’t store OCR content, there is no content to delete-only operational metadata.

What if there’s a data breach?

Given our transient processing architecture, your OCR content would not be at risk in a breach. We would notify affected users and authorities as required by law for any operational data involved.

This Privacy Policy may be updated from time to time. We will post any changes on this page with an updated date.