Privacy notice
You upload commercial documents here. This page says exactly what happens to them.
What is collected
- Your email address, because your account is known by it: you sign in with a link emailed to it, or through Google or Microsoft. From Microsoft, only your email address is requested. Google is also asked for your basic profile, so a Google sign-in stores your name and a link to your Google profile photograph with your account. Rateslip does not use or show either.
- The documents you upload, stored as the original file plus a rendered image of each page.
- The values read from those documents: descriptions, quantities, rates, freight, tax and the calculated landed costs.
- A record of each read: when it ran, whether it succeeded, why it failed if it did, and what it cost to run.
No advertising identifiers, no third-party analytics, no tracking pixels, and no cookies beyond the one that keeps you signed in.
Who can see your documents
Only the account that uploaded them. Access is enforced by row-level security in the database, which means a query from one account cannot return another account's rows even if the application code were wrong. Storage is a private bucket, not a public URL.
The operator can technically access stored data for support and debugging. This is done only when you ask for help with a specific document, or where required to keep the service running.
Processors used
Supabase
Database, authentication and file storage. Region: ap-south-1, in Mumbai, India.
Cloudflare
Hosting, network and request logs, and the Turnstile spam check on the contact form.
Anthropic
The model that reads the page images. Only the page images are sent. The text layer inside your PDF is never sent to the model; it stays here and is used only to cross-check what was read. Content sent through the API is not used to train models.
Resend
Delivering outbound email: the sign-in link, a message sent through the contact form, and the acknowledgement that follows one. Click and open tracking are turned off, so nothing records whether you opened an email or what you pressed in it.
Hostinger
The mailbox. Correspondence sent to contact@rateslip.in or support@rateslip.in is held there, including anything the contact form delivers and any reply to it.
These providers process data on instruction. Nothing is sold, and nothing is shared for marketing.
A message sent through the contact form is not written to the database. It becomes an email to us and an acknowledgement to you, and the form keeps no copy of either.
Where data is held
The database, sign-in and file storage are Supabase's, in its ap-south-1 region in Mumbai. Your account, your documents, their page images and everything read from them are stored there.
A document you upload
-
You
Upload a PDF, or photographs of its pages.
-
The file
Supabase Mumbai, India
Stores your account, the file, its page images and everything read from them.
-
Each page image out, the reading back
Cloudflare Any data centre, including outside India
Runs the code that carries each page image to the model and the reading back to the database. Keeps its request logs for 7 days.
-
The page image out, what was read back
Anthropic Outside India
Reads each page image and returns what it read. It is sent nothing else from your documents.
The text layer inside your PDF is never sent to the model. It is used only to cross-check what was read.
A message through the contact form
-
You
Send a message through the contact form.
-
The message
Cloudflare Any data centre, including outside India
Runs the contact form's spam check.
-
The message
Resend Outside India
Delivers it to the mailbox and sends you an acknowledgement. It also sends every sign-in link. Click and open tracking are off.
-
The message
Hostinger
The mailbox for contact@rateslip.in and support@rateslip.in. It holds what the form delivers and any reply to it.
A message sent through the form is not written to the database, and the form keeps no copy.
Three processors handle data outside India:
- Anthropic, the model provider, receives each page image while it reads the page, and returns what it read. It is sent nothing else from your documents.
- Cloudflare serves the site, runs the contact form's spam check, and runs the code that carries each page image to the model and the reading back to the database. Any of its data centres can handle a request, including ones outside India. Its request logs are kept for 7 days.
- Resend sends the sign-in emails and the contact form's messages, so it handles your email address and the text of those emails.
If that matters for your documents, do not upload them.
How long it is kept
Documents and their extracted values are kept until you delete them or ask for your account to be removed. Deleting a document deletes its pages, every reading of it and every record of those readings along with it; deleting your account does the same for all of them. One thing outlives them: a spend ledger holding an identifier, the account and what a reading cost, with no document content in it, because a cost ceiling measured against a figure that can go down is not a ceiling. Request logs at the hosting layer are retained for 7 days.
Your choices
- Get a copy of everything stored for your account.
- Have your documents and account deleted. This cannot be undone.
- Correct an email address held against your account.
How to make a request
Write from the address you signed in with to support@rateslip.in. Requests are answered within 30 days.
Security
Traffic is encrypted in transit. Files are stored privately with per-account access rules. Secrets are held in the hosting platform's secret store, not in code. No system is beyond compromise, and if a breach affects your documents you will be told what happened and when.
Children
Rateslip is a business tool and is not directed at anyone under 18.
Changes
Material changes to this notice will be announced by email to signed-up accounts before they take effect.
Contact
Questions about this notice go to contact@rateslip.in. Anything held for your account, including a copy or a deletion, goes to support@rateslip.in from the address you signed in with. The terms that sit alongside this notice are in the terms of use.