1. Introduction

NxtWaveAI ("we", "our", or "us") operates OCR Agent Pro, an AI-powered document extraction platform available at ocr.nxtwaveai.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By using OCR Agent Pro, you consent to the practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your full name, email address, and password (stored as a bcrypt hash — we never store your raw password). If you sign in with Google, we receive your name, email, and profile picture from Google.

2.2 Company / Workspace Information

For company accounts, we collect your company name, industry, company size, and your role within the organisation.

2.3 Documents and Files

You upload PDF documents and images to our platform for extraction. These files are transmitted securely and stored temporarily on Amazon Web Services (AWS) S3. Uploaded documents are processed by AI models (OpenAI GPT-4 Vision, Anthropic Claude, or a self-hosted model via Ollama if you provide your own API key) to extract structured data. Documents may be retained for your extraction history and result review. You can delete your documents and extraction results at any time from your account.

2.4 Usage and Analytics Data

We collect information about how you use the Service, including extraction jobs submitted, agent configurations, credit usage, API calls, login timestamps, IP addresses, browser and device information, and session data.

2.5 Payment Information

Payments are processed by Stripe. We do not store your credit card numbers. We receive and store billing details such as your billing name, last 4 digits of your card, card brand, expiry date, and Stripe customer/subscription identifiers.

3. How We Use Your Information

• To provide, operate, and maintain the OCR Agent Pro Service
• To process your document extraction requests using AI models
• To manage your account, credits, and subscription
• To send transactional emails (email verification, password reset, invoices, team invitations)
• To detect and prevent fraud, abuse, and security incidents
• To improve and develop new features for the platform
• To comply with legal obligations

4. How We Share Your Information

We do not sell, trade, or rent your personal information to third parties. We share your information only in the following circumstances:

• AI Providers: Documents you upload are processed by OpenAI and/or Anthropic solely for extraction. If you use BYOK (Bring Your Own Key) or a self-hosted Ollama model, your documents are sent directly to the provider you configure — NxtWaveAI does not intermediate that data. Their use of your data is governed by their respective privacy policies and data processing agreements.
• Stripe: For payment processing. Stripe is PCI-DSS compliant.
• Amazon Web Services (AWS): For secure file storage.
• Email Services: To send transactional emails via Gmail or Resend.
• Legal Requirements: If required by law, court order, or governmental authority.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

5. Data Retention

We retain your account data for as long as your account is active. While your account is active, uploaded documents are retained in AWS S3 for the duration of your subscription or until you manually delete them from your extraction history. If you delete your account, we will delete your personal data within 30 days, subject to a 7-day cooldown period before the email address can be re-registered. Extraction results and uploaded files may be retained for up to 30 days after account deletion for backup purposes before being permanently purged. Payment and transaction records may be retained for up to 7 years for accounting and legal compliance.

6. Security

We implement industry-standard security measures including TLS/HTTPS encryption for all data in transit, bcrypt hashing for passwords, JWT-based authentication with short-lived access tokens and rotating refresh tokens, optional two-factor authentication (TOTP), and role-based access control for team workspaces. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your data (available in Settings → Export Data)
• Opt out of non-essential communications

To exercise any of these rights, contact us at hemantgoyal@nxtwaveai.com.

8. Cookies

We use cookies and similar technologies. Please see our Cookie Policy for details.

9. Children's Privacy

Our Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.