Form Digitizer Privacy Policy

Effective July 18, 2026 · Last updated October 15, 2026 · Prometheus Labs, Kitchener, Ontario, Canada · formdigitizer@prometheuslabs.ca

1. Two roles

Your account data (email, organization details, purchase history): we are responsible for it under PIPEDA. Your uploaded documents (form images and extracted data, which may contain other people's personal information): you are the responsible organization; we process them only on your instructions to provide the service. Section 5 is our data-processing commitment to you.

2. What we collect and why

• Email address: sign-in and receipts. Each sign-in email carries a link and a 6-digit code; we store only a keyed hash of the code, and both expire after 20 minutes.
• Organization name/mailing address: only if you use the email feature (CASL sender identification).
• Uploaded form images and extracted values: to run the conversion/extraction you request.
• Free test page: to keep it to one per person, we store a keyed hash of your email address in a standard form (lowercase, without the dots in a Gmail address and without any "+" tag). The hash can't be turned back into your address, but it is linked to your account. We keep it after your result is deleted, for as long as the one-free-page rule applies, so the same address can't claim a second free page. Email us to ask for it to be deleted.
• Abuse limits: to stop misuse of sign-in, the free test page and uploads, we count requests per network and per account. Network counts use a keyed hash of your IP address, never the address itself, and are deleted within 4 days.
• Human check: the sign-in form and the free test page use Cloudflare Turnstile to tell people from automated traffic. It runs in your browser, and Cloudflare handles what it collects under its own privacy policy.
• Reading costs: for each AI read we record the account it was for, the number of tokens used and how long it took, so we can track what reading costs. These records hold none of your form content and are deleted after 400 days.
• Basic operational logs (errors, request metadata): to keep the service working; no advertising, no analytics trackers, no sale of data, no use of your content to train AI models.

3. Retention and deletion

• While your account is active, uploaded images auto-delete after your configured retention period (default 90 days, settable 7–365). This includes the photos of a form you added; the form's fields stay, so you can keep using it.
• Deleting a batch immediately deletes its images and extracted data.
• Free test page: your photo is read once and never stored by Form Digitizer. What was read from it is deleted 7 days after it was read.
• To close your account, email formdigitizer@prometheuslabs.ca from your sign-in address. We delete your stored documents and close the account within 2 business days, not at the end of the 90-day retention window.

4. Where data lives (cross-border disclosure)

Form Digitizer runs on infrastructure provided by US companies; your data may be processed or stored outside Canada and is subject to the laws of those jurisdictions. Subprocessors:

• Cloudflare (US): hosting, storage, database, email delivery, and the Turnstile human check.
• Fireworks AI (US): AI reading of your form images, including the free test page (API terms: not used to train its models).
• Resend (US): backup email delivery, used when Cloudflare cannot send a message.
• Stripe: payments; we never see card numbers.

Quebec customers: this list plus section 4's disclosure is designed to support your Law 25 cross-border assessment; contact us for our security summary.

5. Our processing commitments to you

For documents you upload, we: process them only to provide the service and on your instructions; keep them confidential; protect them with safeguards appropriate to their sensitivity (private storage, encrypted transit, per-account isolation, access logging); notify you without undue delay of any breach affecting your data with the detail you need for your own legal assessment; assist reasonably with access/correction requests about data we hold for you; and delete your documents at the end of the retention period, on batch deletion, or when we process your account-closure request (see section 3). We keep a record of any breach for 24 months as required by PIPEDA.

6. Safeguards

Private storage buckets (no public access), authenticated image access scoped to the owning account, encrypted transit everywhere, session cookies signed and HTTP-only, minimal data in indexes, least-privilege API keys, and two-factor authentication on our infrastructure accounts.

7. Email and unsubscribe

Result emails include the sender's identification and a working unsubscribe link; unsubscribed addresses are suppressed platform-wide within 10 days (in practice, immediately). Sign-in emails are transactional. Free test page results can't be emailed from Form Digitizer.

8. Contact and complaints

Privacy questions or requests: formdigitizer@prometheuslabs.ca. You may also contact the Office of the Privacy Commissioner of Canada.