Privacy Policy
This draft explains how Claim Pal processes account, organization, invoice, evidence, claim, billing, support, security, and consent data.
Data we process
We process identity and contact details, memberships and roles, vendor contacts, original invoices, OCR output and normalized fields, products, quantities, issues, photos and annotations, messages, decisions, credit records, audit events, billing metadata, support communications, device and security records, and recorded consent.
Purposes and roles
We use data to provide and secure the service, authenticate users, run OCR, route claims, support decisions, reconcile credits, bill customers, meet legal obligations, prevent misuse, provide support, and improve reliability. The organization determines the lawful basis for claim content; Claim Pal follows documented instructions when acting as processor.
Recipients and subprocessors
Authorized organization members and invited claim participants receive records according to role and claim scope. Supabase supports database, authentication, and storage; Vercel hosts the web service; Claim Pal private PaddleOCR infrastructure performs OCR, with Google Cloud Document AI used only when the configured fallback is enabled; Stripe supports billing and tax; Resend sends email; Expo supports mobile delivery and push; Sentry supports operational diagnostics; and PostHog provides optional consent-gated analytics.
Analytics and monitoring
Optional PostHog analytics and Vercel performance measurement remain off until consent is granted. Sentry is limited to operational diagnostics and should exclude invoice content, evidence, message bodies, authentication tokens, and direct identifiers.
Retention and deletion
Records are retained while an account is active and as needed for claim resolution, billing reconciliation, audit integrity, security, disputes, and legal obligations. Eligible data is deleted or de-identified on approved request; immutable billing, audit, fraud-prevention, backup, or legally preserved records may remain. Exact category periods require approval before launch.
International processing and security
Providers may process data in the United States and other documented locations. Approved transfer mechanisms will be stated in the DPA. Controls include role-based access, tenant row-level security, private storage, encrypted transport, signed file access, audit logging, backups, and incident procedures.
Rights and requests
Subject to applicable law and the organization’s instructions, individuals may request access, correction, export, deletion, restriction, or objection through privacy@claimpal.com. Claim Pal may verify identity and route requests to the organization controlling the data.
Children and sensitive data
Claim Pal is a business service not directed to children. Users must not upload unnecessary card data, health data, government identifiers, biometric data, or other highly sensitive personal information.
Open counsel terms
Counsel must approve the controller identity and address, jurisdiction notices, lawful bases, retention periods, international transfers, request procedure, and regulator details.