Privacy Policy

Tagjet is operated by SIA "MICRON", a sabiedrība ar ierobežotu atbildību (limited liability company) registered in the Republic of Latvia on 7 November 2017 under number 42103081578, VAT LV42103081578, with its registered office at Aldaru iela 36/38 – 21, Liepāja, LV-3401, Latvia.

For personal data relating to your account, billing and use of the Service, we are the controller. For personal data contained in the Documents you submit to the API, you are the controller and we act as your processor — see §14 and the Data Processing Agreement.

We have not appointed a Data Protection Officer, as we are not required to. Data-protection enquiries go to privacy@tagjet.app.

Submitted Documents are receipts and invoices. They routinely contain the merchant’s details and transaction data, and they may incidentally contain personal data — a cardholder name, the last digits of a payment card, a loyalty number, a delivery address, or a signature. You decide what you send us.

• Directly from you, when you sign up, verify your email, configure two-factor authentication, enter billing details or contact support.
• From your use of the Service, when your integration calls the API — request metadata, IP address, timestamps, response codes and correlation identifiers are logged.
• From the Documents you submit, which we process to produce Extracted Data.
• From Stripe, which returns billing status, invoice records and a customer identifier after processing a payment. We never receive your full card number.

• Performance of a contract (Art. 6(1)(b) GDPR) — creating and running your account, processing your requests, billing you, and providing support.
• Legitimate interests (Art. 6(1)(f)) — securing the Service, preventing abuse and fraud, enforcing quotas and rate limits, debugging, and improving reliability. We balance these against your rights and you may object at any time.
• Legal obligation (Art. 6(1)(c)) — retaining invoices and accounting records, and responding to lawful requests from authorities.
• Consent (Art. 6(1)(a)) — where we ask for it, for example for optional communications. You may withdraw consent at any time without affecting prior processing.

• To operate the Service: authenticate requests, run the extraction pipeline, return results, and deliver webhooks you configure.
• To meter usage: enforce quotas and rate limits, calculate overage, and show usage in your dashboard.
• To bill you and to issue compliant invoices with the correct VAT treatment.
• To communicate with you about your account: email verification, password resets, security notices, billing notices and material service changes.
• To keep the Service secure: detect abuse, investigate incidents, and maintain an audit log of sensitive administrative actions.
• To comply with our legal, tax and accounting obligations.

• We do not train models on your Documents or Extracted Data. Our extraction provider operates under paid API terms that prohibit using submitted content to train or improve its models.
• We do not sell personal data and we do not share it with data brokers or advertisers.
• We run no advertising or cross-site tracking, and no third-party analytics — see the Cookie Policy.
• We do not read your Documents manually as a matter of course. Staff access to stored content is restricted to what is necessary to investigate a fault or a security incident, and is logged.

You choose which Documents to send us. You are responsible for having a lawful basis to process them, for giving any notices and obtaining any consents required from the individuals concerned, and for not sending us more personal data than your purpose requires.

Do not submit special-category data (Art. 9 GDPR) — such as health, biometric, or trade-union data — or data relating to criminal convictions, unless you have separately agreed this with us in writing. The Service is not designed or assessed for those categories.

Tagjet is not a system of record and is not a backup service. Keep your own copies of every Document and every result you need to retain, and verify Extracted Data before relying on it. Stored originals are deleted automatically at the end of the retention period, immediately on an erasure request, and are never written at all when you use parse-only mode. Deletion is permanent and we cannot restore deleted content.

We share personal data only with the categories of recipient below, each engaged under a written data-processing agreement that limits them to our documented instructions, and with professional advisers, authorities or an acquirer where law or a corporate transaction requires it.

The identity of each sub-processor is available on request. Write to privacy@tagjet.app and we will send the current named list. Customers also receive it under the Data Processing Agreement, together with at least thirty (30) days’ notice before any entry changes, so you have an opportunity to object.

Documents you submit are transmitted to an automated extraction provider for processing. We select that provider on quality, cost and privacy terms and may change it; the category, the processing activity and the transfer safeguard above continue to describe it accurately, and the notice period above applies to any change. If a specific provider is incompatible with your own commitments, ask for the named list before integrating.

Where we are the controller, you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on it.

You can exercise most of these yourself: your dashboard lets you update your details and delete your account, and an authenticated request to DELETE /api/me/data erases your stored originals together with your account, scans, API keys, usage records and webhook delivery history. Otherwise, write to privacy@tagjet.app and we will respond within one month.

Where an individual’s personal data reached us inside a Document you submitted, you are the controller and we will refer the request to you, assisting you as set out in the DPA.

You may lodge a complaint with your local supervisory authority. Ours is the Latvian Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Riga, LV-1050, Latvia — www.dvi.gov.lv.

We use one strictly necessary cookie to keep you signed in, and no analytics or advertising technologies. Full detail is in the Cookie Policy.

• Submitted Documents — retained for the period configured for your account, 30 days by default, then deleted automatically. Requests made in parse-only mode are processed in memory and never stored.
• Extracted Data and scan records — retained while your account is active, so you can retrieve results and reconcile usage, and deleted when you delete your account.
• Account data — retained while your account is active and deleted on account deletion.
• Billing and invoice records — retained for the period required by Latvian tax and accounting law, currently five years, even after account deletion.
• Security and audit logs — retained for a limited period proportionate to their purpose, after which they are deleted or aggregated so they no longer identify anyone.

We encrypt data in transit with TLS and at rest, store passwords using a modern password-hashing function, store API keys only as salted hashes, and encrypt sensitive fields with a dedicated data key. Access to production is restricted, authenticated and logged; the object store is private with no public access; and sensitive administrative actions are written to an audit log. We offer two-factor authentication and recommend you enable it.

No system is perfectly secure. We do not guarantee that the Service cannot be compromised. If a personal-data breach occurs that is likely to result in a risk to individuals, we will notify the competent supervisory authority and affected customers without undue delay, as GDPR requires.

Our Data Processing Agreement forms part of your contract with us and satisfies Art. 28 GDPR for the Documents you submit. It applies automatically to every customer; you do not need to sign a separate copy. If your procurement process requires a countersigned version, write to privacy@tagjet.app.

Hosting, the database and the object store are in the European Union. Some sub-processors listed above process data outside the EEA, in which case we rely on the European Commission’s Standard Contractual Clauses, an adequacy decision, or the EU–US Data Privacy Framework, together with supplementary measures where appropriate. You may request further information at privacy@tagjet.app.

The service and all extracted data are provided “as is” and “as available”, without warranty of accuracy, completeness, fitness for a particular purpose, or uninterrupted operation. Nothing in this policy creates a warranty of any kind.

We do not guarantee any level of uptime unless a separate written service-level agreement is in place, and we may modify or discontinue parts of the Service as set out in the Terms.

To the maximum extent permitted by law, we are not liable for indirect, incidental, special or consequential loss, loss of profits, revenue, goodwill or data, or loss arising from reliance on extracted data. Our total aggregate liability is capped at the greater of the fees paid in the preceding twelve months or EUR 100.

This mirrors §14 of the Terms, which governs in the event of any inconsistency. Nothing here limits liability that cannot lawfully be limited, including under GDPR Art. 82 for our own breach of our processor obligations, or for death or personal injury, fraud, intentional misconduct or gross negligence.

You will indemnify us against claims, fines, penalties, losses and reasonable costs arising from personal data you submitted without a lawful basis, without required notices or consents, or in breach of your obligations as controller — including claims brought by individuals or supervisory authorities. The full terms are in §16 of the Terms.

We are not liable for failures or delays caused by events beyond our reasonable control, including failures of third-party infrastructure, network or power outages, denial-of-service attacks, governmental action, or natural disasters.

If any provision of this policy is held invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions continue in full force.

This policy is governed by the laws of the Republic of Latvia, with the courts of the Republic of Latvia having exclusive jurisdiction, without prejudice to mandatory consumer protections or your right to complain to your local supervisory authority.

We may update this policy. The “last updated” date at the top always reflects the current version, and we will give reasonable advance notice of material changes — including the addition of a sub-processor — by email or in the dashboard.

Privacy and data-protection: privacy@tagjet.app. General support: support@tagjet.app. Postal: SIA "MICRON", Aldaru iela 36/38 – 21, Liepāja, LV-3401, Latvia.