Privacy Policy

This policy applies to recutr.com and the Recutr invoice and purchase-order workspace (the “Service”). Recutr (“Recutr”, “we”, “us”) is the controller of account, billing, and website data. For the documents, invoices, purchase orders, comments, and audit records in a customer workspace, we act as a processor on the customer’s instructions.

If you use the Service through an employer or another organisation, that organisation controls the workspace. Contact them first for requests about workspace content. We will assist them as required.

We collect the following categories of information:

• Account data: name, email address, password hash, role, workspace name, and authentication and session data.
• Workspace content: documents you upload or receive, invoices, purchase orders, line items, supplier details, comments, approvals, rejection reasons, and audit history.
• Connected-service data: email messages and attachments you choose to sync from Gmail or IMAP; Sheets and Drive files; Slack messages and approval actions; and accounting data exchanged with QuickBooks Online or Xero.
• Billing data: plan, subscription status, and payment-processor identifiers. Full card details are handled by our payment provider, not stored by Recutr.
• Usage and technical data: IP address, browser and device information, log events, and feature usage.
• Support communications: messages you send us and the information needed to resolve your request.

We use information to:

• provide, operate, and secure the Service;
• extract invoice and purchase-order fields, run reviews, match purchase orders, and produce exports and accounting postings;
• authenticate users, enforce roles, and maintain audit trails;
• process subscriptions, setup fees, invoices, and payments;
• provide support, investigate incidents, and prevent abuse;
• improve features and reliability; and
• comply with legal, tax, and accounting obligations.

We do not sell personal data. We do not use Customer Data to train models for other customers.

Extraction reads the document’s text layer or page images to produce structured fields. Depending on your deployment, extraction may use a local model or a contracted external model provider. When an external provider is used, text PDFs are sent as extracted text and scans or images are sent as page images.

Before the AI reviewer checks an extraction, personal details such as names, addresses, email addresses, phone numbers, bank details, and tax identifiers are masked. The reviewer receives masked text and does not receive page images. Review results are unmasked locally so they can be shown against the source.

Self-hosted deployments can run more of the pipeline inside your own infrastructure. We require model providers to process data only to provide the Service.

Where data protection law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and securing the Service, your consent where requested, and compliance with legal obligations. You may withdraw consent at any time where processing is based on consent, without affecting processing already carried out.

We share information with service providers that help us run the Service, including hosting and infrastructure, AI model providers, email delivery, payment processing, and support tooling. We also exchange data with integrations you connect, such as Google, Slack, QuickBooks Online, or Xero.

We may disclose information to professional advisers, auditors, or authorities where required by law, or as part of a reorganisation, merger, or sale of the business. We do not sell personal data.

Our providers may process information in countries other than yours. Where required, we use contractual safeguards or other lawful transfer mechanisms. You can contact us for more information about the safeguards that apply to your workspace.

We retain account and workspace data while your workspace is active. After termination, we delete or de-identify workspace content within a reasonable period, subject to backups and legal retention requirements. Backups may persist for a limited period before expiring.

We retain billing, tax, and audit records for as long as required by law. Support communications are retained only as long as needed to resolve the request and maintain records.

Managed workspaces run on dedicated deployments and databases. We use encryption in transit, encrypt integration credentials, apply role-based access controls, maintain backups, and monitor the Service for failures and abuse. Access to customer data is limited to personnel and providers who need it to operate and support the Service.

No system is completely secure. You are responsible for your users, devices, connected accounts, and the accuracy of the data you submit. Notify us promptly at [email protected] if you suspect an incident.

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or object to processing, and to receive a portable copy of your data. You may also withdraw consent where processing is based on consent. Contact [email protected] to make a request. We may verify your identity and will respond within the period required by law.

If your data is in a customer workspace, contact that customer first. You may also complain to your local data protection authority, including Malaysia’s Personal Data Protection Commissioner or, if you are in the EEA or UK, your local supervisory authority.

We use essential cookies and local storage to keep you signed in, remember preferences, and protect the Service. We do not currently use third-party advertising or analytics cookies. If we introduce analytics, we will update this policy and provide choices where required.

The Service is intended for business use by adults. It is not directed to children under 18, and we do not knowingly collect their personal data. If you believe a child has provided data, contact us and we will take appropriate steps.

We may update this policy. We will post the updated version and change the last updated date. If a change is material, we will provide reasonable notice by email or in the Service. Where required, we will ask for consent.

Our Terms & Conditions govern use of the Service. For security questions, see the security section above.

Questions or requests? Email [email protected].