Privacy Policy
Last updated:
This Privacy Policy explains what personal information Interval Limited (operating as Ztract) collects, how we use it, who we share it with, and what rights you have. It applies to ztract.com, app.ztract.com, and any other service we make available under the Ztract brand.
1. Who we are
Ztract is operated by Interval Limited, a company incorporated in Hong Kong with its registered office at Unit 2A, 17/F, Glenealy Tower, No.1 Glenealy, Central, Hong Kong S.A.R. For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and similar laws, Interval Limited is the data controller for personal information collected about visitors to ztract.com and account holders on app.ztract.com.
When a business uses Ztract to process its own customers' or employees' documents, that business is the controller of the personal information in those documents and Ztract is its processor. Section 7 of this policy and our Data Processing Agreement govern that relationship.
2. Information we collect
2.1 Information you give us
- Account information. When you create an account we collect your email address, a password (stored as a salted hash by our authentication provider — we never see your password in plaintext), and any profile information you choose to add.
- Billing information. When you buy a page pack, our payment processor Stripe collects and processes your payment-card details, billing address, and VAT or tax identifier if you provide one. We do not store or receive full card numbers; we receive only a tokenized customer identifier and the metadata Stripe shares (such as the last 4 digits and country).
- Communications. When you email support@ztract.com we receive your email address, the contents of your message, and any attachments. We retain these emails for as long as needed to support you and to meet our legal obligations.
- Documents and schemas you upload. When you use Ztract you upload documents (PDFs, Office files, images, etc.) and define schemas that describe what to extract from them. These are your "Customer Content".
2.2 Information we collect automatically
- Usage and log data. Our servers automatically record limited information when you interact with the Service: IP address, browser type and version, operating system, the pages you visit on ztract.com, and the API calls your account makes on app.ztract.com. These logs are kept for operational and security purposes.
- Cookies and local storage. See our Cookie Policy for the full list. We do not run third-party analytics, advertising pixels, or cross-site trackers.
2.3 Information we do not collect
We do not buy personal information from data brokers, we do not collect special-category data about you for marketing purposes, and we do not track your activity across other websites.
3. How we use your information
We use the information described above to:
- Provide, operate, and maintain the Service.
- Authenticate you, keep your account secure, and prevent abuse.
- Process payments and send purchase receipts.
- Run the document-extraction workflow you've requested, including invoking the AI providers listed in section 5.
- Respond to your support requests and other communications.
- Send service-related emails (security alerts, billing notices, material changes to terms or this policy).
- Comply with our legal obligations and enforce our Terms.
Our legal bases under the GDPR are: contract (to deliver the Service you've signed up for), legitimate interests (to keep the Service secure and operational), consent (where you have provided it, for example for non-essential marketing emails — currently we send none), and legal obligation (to retain records required by tax or other law).
4. Customer Content and AI processing
Documents and schemas you upload are your Customer Content. We process them only to provide the Service to you. Specifically:
- We do not train our own models or any shared models on Customer Content. Your documents are not used to make the engine better at someone else's job.
- Customer Content is not shared with any party other than the sub-processors listed in section 5, and only to the extent each sub-processor needs to deliver the service it's contracted for.
- Extracted results (the structured fields the engine returns) are tied to your account and visible only to you and people you have authorized.
Use of third-party AI providers. Document understanding is performed by large language model (LLM) APIs from third-party providers. We currently route requests through one or more of the following, depending on the document type and current routing decisions:
- OpenAI, L.L.C. (United States)
- Anthropic, PBC (United States)
- Google LLC (United States)
Each of these providers operates its commercial API under terms that prohibit training on customer data submitted via the API. We rely on those contractual commitments. When your document is sent to one of these providers it is transmitted over TLS, processed to produce the extraction result, and is not retained for training. Provider-side abuse-monitoring retention is typically 30 days or less; refer to each provider's API terms for current specifics.
5. Sub-processors
The following service providers help us deliver Ztract. We have data processing agreements with each of them where applicable.
| Sub-processor | Purpose | Processing location |
|---|---|---|
| Fly.io, Inc. | Application hosting and compute | United States (LAX region — Los Angeles) |
| Supabase, Inc. | Database and authentication (built on AWS) | United States (AWS us-east-2, Ohio) |
| Cloudflare, Inc. | Object storage (Cloudflare R2) for uploaded documents and extracted results | Western North America (R2 WNAM region) |
| Stripe, Inc. | Payment processing, invoicing, and tax handling | Global; primarily United States |
| Resend, Inc. | Transactional email delivery (account, billing, security emails) | United States |
| OpenAI, L.L.C. / Anthropic, PBC / Google LLC | Large language model APIs used to perform document extraction | United States |
We will update this list as our infrastructure changes. Where you have a Data Processing Agreement with us, we will give you 30 days' notice before adding a new sub-processor that processes Customer Content.
6. Where your data is stored and international transfers
Although Interval Limited is based in Hong Kong, the technical infrastructure that runs Ztract is hosted in the United States. Uploaded documents and extracted results are stored in Cloudflare R2's Western North America region. Account and metadata are stored in Supabase (AWS US East 2, Ohio). Application logic runs on Fly.io's Los Angeles region.
If you access Ztract from the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction with cross-border-transfer restrictions, your personal information will be transferred to the United States. For those transfers we rely on the European Commission's Standard Contractual Clauses (or the UK addendum, where applicable) as the appropriate safeguard under GDPR Articles 44–49. The Standard Contractual Clauses are incorporated by reference into our Data Processing Agreement.
7. Data retention
- Documents and extracted results. Stored for as long as your account is active and you have not deleted them. When you delete a document or a project, we delete it from object storage immediately and remove the associated extracted results at the same time. Routine backup tapes may retain a copy for up to 14 days before being overwritten.
- Account information. Retained while your account is open. When you close your account we delete personal account data within 30 days, subject to records we must retain for tax, accounting, or legal reasons.
- Billing and tax records. Retained for as long as required by applicable tax and accounting law (typically 7 years).
- Support correspondence. Retained for up to 3 years after the issue is resolved unless we agree with you to delete it sooner.
- Logs. Operational and security logs are retained for up to 90 days.
8. Your rights
Depending on where you live, you have the following rights regarding personal information about you:
- Access. Request a copy of the personal information we hold about you.
- Rectification. Ask us to correct information that is inaccurate or incomplete.
- Deletion. Ask us to delete information about you, subject to our right or obligation to retain certain records.
- Restriction and objection. Ask us to limit how we use your information or object to particular uses.
- Portability. Ask us to provide your information in a structured, commonly used machine-readable format.
- Withdrawal of consent. Withdraw any consent you have given to processing.
- Complain to a regulator. Lodge a complaint with your local data-protection authority. In Hong Kong this is the Office of the Privacy Commissioner for Personal Data (PCPD); in the EU it's your national data-protection authority.
To exercise any of these rights, email support@ztract.com. We will respond within 30 days. We may need to verify your identity before acting on a request.
California residents. If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and CPRA, including the rights to know, to delete, to correct, to opt out of "sales" and "sharing" of personal information, and to non-discrimination. We do not sell personal information. To exercise CCPA rights, email support@ztract.com with the subject line "CCPA request".
9. Security
We protect your information using industry-standard administrative, technical, and organizational measures, including encryption in transit (TLS 1.2+) and at rest, least-privilege access controls for staff, isolated processing for Customer Content, periodic credential rotation, and incident-response procedures. No system can be guaranteed perfectly secure; we will notify you and any applicable regulator of a personal-data breach affecting your information without undue delay and in any event within 72 hours of becoming aware where required by law.
10. Children
Ztract is not directed at children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact support@ztract.com so we can delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top. If a change is material, we will give notice through the Service or by email at least 30 days before the change takes effect. If you continue using the Service after the change you are deemed to have accepted the updated policy.
12. Contact
You can reach us about this policy at support@ztract.com or by mail at:
Interval Limited
Unit 2A, 17/F, Glenealy Tower
No.1 Glenealy
Central, Hong Kong S.A.R