Privacy & data handling
How your documents are stored, GDPR compliance, retention policies, and how data is (and is not) used.
Last updated
Do you share my data with third parties?
No. Your documents and OCR results are never shared with third parties.
Do you train your AI models on my data?
No — your documents are never used to train or improve our models. We train only on licensed datasets and public-domain material we have explicit rights to.
This is a deliberate product commitment, not just a policy: customers in healthcare, legal, government, and other sensitive fields rely on it, so we don't take it lightly. Specifically:
- Files are processed only to deliver the OCR result you requested.
- Customer documents are never added to a training corpus, even in anonymised form.
- Our staff don't open your documents unless you've explicitly granted access for support reasons.
- Files are deleted automatically based on your retention setting (default 7 days, configurable down to 15 minutes).
If your use case requires this commitment in writing, a GDPR Data Processing Agreement (DPA) is available on the Business plan.
How do you handle GDPR and European data regulations?
Yes — Handwriting OCR is fully GDPR compliant. We're operated by Automatic Eye Limited, a UK-registered company, and our service is designed to meet both GDPR and UK Data Protection requirements.
EU-only data residency
European customers can opt for all uploads, processing, and storage to take place exclusively within EU datacenters. This is particularly relevant for organisations subject to data sovereignty rules.
Data Processing Agreement (DPA)
A signed DPA is available on the Business plan. It covers our role as data processor, security measures, sub-processors, and your rights as the data controller. Contact us to request one.
Your rights
- Access and portability — download your transcriptions at any time via dashboard or API.
- Erasure — delete any document instantly; default auto-deletion runs after 7 days (configurable to 15 minutes).
- No training — your data is never used to train our models.
If you have specific questions about how your use case maps to GDPR obligations, get in touch and we'll walk through the details.
Is my data private and secure?
Yes. Privacy is a core part of how Handwriting OCR is designed.
- Encryption in transit and at rest — bank-grade encryption protects your files from upload through to deletion.
- Auto-deletion — documents are automatically deleted after a configurable window (default 7 days, configurable from 15 minutes to 14 days, with the floor in place to ensure you have time to download results).
- No training on customer data — your documents are never used to train or improve our AI models.
- No third-party sharing — files are processed only to deliver the OCR service.
- Access controls — only you can access your documents. Our staff can view files only with your explicit prior authorisation, typically for support investigations.
- EU data residency — European customers can have all data processed and stored exclusively in the EU.
- Compliance frameworks — GDPR Data Processing Agreement (DPA) available on Business.
Full details are in our privacy policy.
What is your document deletion policy?
Handwriting OCR doesn't keep your documents around longer than needed.
Automatic deletion
- Default: files are deleted 7 days after upload.
- Configurable range: 15 minutes to 14 days.
- The 15-minute floor ensures you have time to download your results before they're removed.
Manual deletion
You can delete any document on demand from the dashboard or via the API — deletion is immediate and permanent.
Enterprise retention
Business-tier customers can request shorter retention defaults or specific data-handling commitments as part of a Data Processing Agreement (DPA).
What gets deleted
When a document is deleted we permanently remove the original file and any cached intermediate data. Your transcribed text is also removed, so make sure you've downloaded results before deletion.