Privacy Policy

Registration Information: When you create an account with Recovoly, we collect essential information including your full name, valid email address, and secure password. For paid subscriptions, we process payment details through our secure payment providers. We do not retain your full payment information but only receive and store a pseudonymized token or reduced payment details from our payment processors for verification and subscription management purposes.

Documents and Input: When you use our document restoration services, we collect the documents you upload, along with your selected parameters such as restoration type, quality settings, and enhancement preferences. This information is essential for delivering the customized document restoration services you request. We also store the restored outputs generated by our AI models temporarily to provide you access to your restored documents.

Communication Data: When you contact our support team, participate in surveys, provide feedback, or communicate with us through any channel, we collect the content of those communications, your contact information, and any other details you choose to share. This helps us provide you with better support and improve our services based on your feedback.

Profile Information: You may choose to provide additional information to enhance your experience, such as your company details, job title, archival preferences, and project descriptions. This information is entirely optional and helps us tailor our services to your specific needs.

Usage and Technical Data: When you access our Services, our systems automatically collect technical information about your device and interaction patterns. This includes your IP address, browser type and version, operating system details, device identifiers, referral URLs, session duration, pages visited, features used, and timestamps. We use this information to monitor service performance, detect and prevent technical issues, and understand how users interact with our platform.

API Usage Data: For developers using our API services, we collect detailed usage metrics including request and response data, rate limiting information, error logs, performance statistics, and integration patterns. This data helps us maintain API stability, optimize performance, and develop improvements to our developer tools.

Location Information: We collect approximate location data derived from your IP address, such as your country, region, and city. This information helps us comply with regional regulations, provide localized experiences, detect and prevent fraudulent activities, and optimize our infrastructure for better performance in different geographical regions.

Social Media Integration: If you choose to register or log in through third-party platforms like Google, GitHub, or other social media services, we receive information from those platforms according to their privacy settings. This typically includes your profile name, profile picture, and email address. We only receive information you have authorized the platform to share.

Business Partners and Service Providers: We may receive information about you from our trusted business partners, such as analytics providers, marketing partners, and resellers. This information is used to enhance our services, provide personalized experiences, and improve our marketing communications.

Publicly Available Sources: In limited circumstances, we may collect information about you from publicly available sources for purposes such as business development, partnership opportunities, or compliance with legal obligations.

Security Training: All Recovoly employees receive regular security awareness training covering data protection, phishing prevention, and secure handling of user data. Our engineering teams receive specialized training in secure development practices specific to AI document restoration systems.

Vendor Management: We carefully vet all third-party service providers for their security practices and require them to maintain appropriate security standards through contractual agreements. Regular security assessments are conducted for critical vendors.

Incident Response: We maintain a formal incident response plan that outlines procedures for detecting, responding to, and recovering from security incidents. Our response team is trained to handle data breaches and security events effectively.

Data Protection Officer: We have designated a Data Protection Officer who oversees our privacy program, ensures compliance with data protection laws, and serves as a point of contact for privacy inquiries.

Our data is hosted in enterprise-grade data centers that implement stringent physical security controls including 24/7 monitoring, biometric access controls, surveillance systems, and environmental controls. These facilities comply with industry standards such as SOC 2, ISO 27001, and other relevant certifications.

Physical access to our offices is controlled through keycard systems, and visitor logs are maintained. Company-issued devices are encrypted and protected with security software. Remote work policies include requirements for secure network connections and proper handling of company data.

While we implement robust security measures, security is a shared responsibility. We encourage you to take the following steps to enhance the security of your account:

• Use a strong, unique password for your Recovoly account and enable two-factor authentication when available
• Keep your API keys secret and rotate them periodically, especially if you suspect they may have been compromised
• Be cautious of phishing attempts and only provide your credentials through our official website
• Log out of your account when using shared computers and keep your devices updated with security patches
• Regularly review your account activity and restored documents for any unauthorized access

In the event of a security incident that affects your personal information, we have procedures in place to:

• Quickly contain the incident and prevent further unauthorized access
• Assess the scope and impact of the incident
• Notify affected users and regulatory authorities as required by law
• Take corrective actions to prevent similar incidents in the future
• Provide guidance to affected users on steps they can take to protect themselves

We are committed to transparency about security incidents and will communicate with affected users in a timely manner, providing clear information about what happened, what information was affected, and what we're doing to address the situation.

Right to Restrict Processing: You have the right to request that we restrict the processing of your personal information in certain circumstances, such as when you contest the accuracy of your data or object to processing while we verify your objection.

Right to Object to Processing: You have the right to object to the processing of your personal information where we are relying on legitimate interests as the legal basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent: Where we are processing your personal information based on your consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

Rights Related to Automated Decision Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

To exercise any of your rights, please contact us using the information in the "Contact Us" section. For security purposes, we will need to verify your identity before processing your request. This may involve asking you to provide specific information to confirm you are the owner of the account or the person authorized to make the request.

We will respond to all legitimate requests within one month of receipt. Occasionally, it may take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated on our progress.

No Fee Usually Required: You will not have to pay a fee to access your personal information or to exercise any of your other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

If you are not satisfied with how we handle your personal information or respond to your rights requests, you have the right to lodge a complaint with a supervisory authority, in particular in the European Union member state of your habitual residence, place of work, or place of the alleged infringement.

We would, however, appreciate the chance to deal with your concerns before you approach a supervisory authority, so please contact us first using the details below. We take all complaints seriously and will investigate them promptly and thoroughly.

Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used by website owners to make their websites work, or to work more efficiently, as well as to provide reporting information.

Cookies set by the website owner (in this case, Recovoly) are called "first-party cookies." Cookies set by parties other than the website owner are called "third-party cookies." Third-party cookies enable third-party features or functionality to be provided on or through the website (e.g., advertising, interactive content, and analytics). The parties that set these third-party cookies can recognize your computer both when it visits the website in question and when it visits certain other websites.

We use first-party and third-party cookies for several reasons. Some cookies are required for technical reasons for our websites to operate, and we refer to these as "essential" or "strictly necessary" cookies. Other cookies enable us to track and target the interests of our users to enhance the experience on our Online Services. Third parties serve cookies through our websites for advertising, analytics, and other purposes.

The specific types of first- and third-party cookies served through our websites and the purposes they perform are described in the table below:

In addition to cookies, we may use other similar technologies such as web beacons (sometimes called "tracking pixels" or "clear gifs"), local storage, and device fingerprinting. These are tiny graphics files that contain a unique identifier that enables us to recognize when someone has visited our website or opened an email that we have sent them.

Web Beacons: These allow us, for example, to monitor user traffic patterns from page to page, deliver or communicate with cookies, understand whether you have come to our website from an online advertisement, and improve site performance.

Local Storage: We use local storage (such as HTML5) to store content information and preferences. Various browsers may offer their own management tools for removing HTML5 local storage.

Device Fingerprinting: In some cases, we may use device fingerprinting as a supplemental security measure to identify and prevent fraudulent activities.

You have the right to decide whether to accept or reject cookies. You can exercise your cookie preferences by clicking on the appropriate opt-out links provided in the cookie table above or by modifying your web browser settings to refuse cookies.

Browser Controls: Most web browsers allow you to control cookies through their settings preferences. However, if you limit the ability of websites to set cookies, you may worsen your overall user experience, since it will no longer be personalized to you. It may also stop you from saving customized settings like login information.

Browser-Specific Instructions:

• Google Chrome: Settings → Privacy and security → Cookies and other site data
• Mozilla Firefox: Options → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Cookies and website data
• Microsoft Edge: Settings → Cookies and site permissions → Cookies and site data

Do Not Track Signals: Some browsers have incorporated "Do Not Track" (DNT) features that can send a signal to the websites you visit indicating you do not wish to be tracked. Because there is not yet a common understanding of how to interpret the DNT signal, our websites do not currently respond to browser DNT signals.

We use third-party advertising companies to serve ads when you visit our website. These companies may use information about your visits to this and other websites in order to provide advertisements about goods and services of interest to you.

We also use third-party analytics services, such as Google Analytics, to help us understand how users engage with our website. These analytics services use cookies and other tracking technologies to collect information about your use of our website and other websites, including your IP address, web browser, pages viewed, time spent on pages, links clicked, and conversion information.

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, and you can opt out of interest-based Google ads using Google's Ads Settings. You can opt out of interest-based ads from Facebook by adjusting your Facebook ad preferences.

Our servers and operations are located in various countries around the world, including the United States, European Union member states, and other regions where we have data centers or service providers. When we transfer your personal information to other countries, we take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy and applicable data protection laws.

Specifically, our primary data processing activities occur in the United States and European Union. We use cloud service providers that operate globally, which means your data may be stored in multiple locations to ensure redundancy, performance, and reliability of our Services.

For transfers of personal information from the European Economic Area (EEA), United Kingdom, and Switzerland to countries that are not considered adequate by the European Commission, we have put in place appropriate safeguards to protect your personal information. These include:

• Standard Contractual Clauses: We use European Commission-approved Standard Contractual Clauses (SCCs) with our service providers and partners who process personal information on our behalf. These clauses require all parties to protect personal information being processed from the EEA in accordance with European data protection law.
• EU-U.S. Data Privacy Framework: We adhere to the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, United Kingdom, and Switzerland to the United States.
• Binding Corporate Rules: Where applicable, we implement Binding Corporate Rules for intra-group transfers of personal information.
• Other Legal Mechanisms: We may rely on other legally-provided mechanisms to ensure adequate protection for personal information transferred outside the EEA, such as adequacy decisions, derogations for specific situations, or your explicit consent where appropriate.

When we share your personal information with third-party service providers, we ensure that appropriate contractual safeguards are in place. We conduct due diligence on our service providers and require them to implement appropriate technical and organizational security measures to protect your personal information in line with our standards and applicable laws.

Our contracts with service providers specify that they can only process personal information for the specific purposes we have engaged them for, and they must delete or return the information at the end of the engagement (unless required by law to retain it).

If you are located in the EEA, United Kingdom, Switzerland, or other regions with specific data transfer regulations, you have certain rights regarding international transfers of your personal information:

• Right to obtain information about the safeguards we have in place for international transfers
• Right to request a copy of the specific safeguards applied to the transfer of your data
• Right to object to specific transfers based on your particular situation

To exercise these rights or to obtain more information about the safeguards we have in place, please contact us using the details provided in the "Contact Us" section.

In certain circumstances, we may be required to disclose personal information in response to valid requests by public authorities, including to meet national security or law enforcement requirements. We will only disclose personal information to government authorities when required by law, and we will notify affected users when permitted by law.

We have procedures in place to carefully review and respond to government access requests, ensuring they are lawful and proportionate. We will challenge requests that we believe are unlawful or overly broad.

Minimum Age Requirement: You must be at least 16 years old to use Recovoly's Services. If you are under 16 years of age, you are not permitted to use our Services, create an account, or provide any personal information to us.

Age Verification: While we do not proactively verify the age of our users, we take reasonable steps to ensure compliance with age restrictions. During the registration process, users must confirm they are at least 16 years old. We rely on this self-declaration but reserve the right to request age verification if we have reason to believe a user is underage.

Parental Consent: For users between 13 and 16 years old in jurisdictions that allow service use with parental consent, we require verifiable parental consent before collecting or processing personal information. Parents or guardians who believe their child has provided us with personal information without their consent should contact us immediately.

Proactive Measures: We have implemented technical and organizational measures designed to prevent the collection of personal information from children under 16. These include age screening during account creation and monitoring for patterns that might indicate underage usage.

Educational Content: While our Services are not designed for children, we recognize that AI document restoration technology can be valuable for educational purposes. We encourage parents and educators to supervise children's use of AI tools and to use our Services together with children in appropriate educational contexts.

Content Moderation: We implement content moderation systems to prevent the generation of inappropriate content. However, AI systems can sometimes produce unexpected outputs, so supervision is particularly important for younger users.

If we learn that we have collected personal information from a child under 16 without appropriate parental consent, we will take steps to delete that information as quickly as possible. Our process for handling such discoveries includes:

• Immediate suspension of the account pending verification of age
• Notification to the email address on file about the suspected underage usage
• Request for age verification documentation if the user claims to be over 16
• Permanent deletion of the account and all associated data if underage status is confirmed
• Refund of any subscription fees paid, prorated based on usage

Parents and guardians have important rights regarding their children's privacy:

• Right to Review: Parents can review the personal information we have collected from their child by contacting us. We will verify the parent's identity before disclosing any information.
• Right to Delete: Parents can request deletion of their child's personal information and account. We will comply with such requests after verifying the parent's identity.
• Right to Refuse Further Collection: Parents can refuse to permit further collection or use of their child's information. We will stop collecting information and delete existing information upon such request.
• Educational Guidance: We encourage parents to discuss online privacy and safety with their children, particularly regarding AI technology. Parents should monitor their children's use of AI tools and discuss appropriate usage guidelines.

Under California Privacy Laws, California residents have the following rights regarding their personal information:

Under California Privacy Laws, certain categories of personal information are considered "sensitive." We may collect the following sensitive personal information:

• Account login credentials (username and password)
• Payment card information (processed by payment providers)
• Precise geolocation data (if you enable location services)

We only use sensitive personal information for purposes permitted by California Privacy Laws, such as providing our Services, ensuring security and integrity, and short-term transient use. We do not use sensitive personal information to infer characteristics about you.

To exercise your rights under California Privacy Laws, you may submit a request by:

• Emailing us at privacy@recovoly.com
• Using the "Privacy Rights" form in your account settings
• Calling our toll-free number: 1-800-RECOVOLY (1-800-732-6865)

Verification Process: We will need to verify your identity before processing your request. For most requests, we will match identifying information provided by you with the information we have on file. For sensitive requests, we may require additional verification.

Authorized Agents: You may designate an authorized agent to make a request on your behalf. We require authorized agents to provide proof of your written permission (such as a power of attorney) and verify their own identity. We may also require you to verify your identity directly with us.

Response Timing: We will confirm receipt of your request within 10 business days and respond to your request within 45 calendar days. If we need more time, we will inform you of the reason and extension period (up to 90 total days).

We may offer financial incentives, such as discounts or special offers, in exchange for your personal information. Participation in these programs is voluntary, and you may opt out at any time. The material terms of any financial incentive program will be presented to you at the time of enrollment.

We have determined that our financial incentive programs are reasonably related to the value of your personal information based on our good-faith understanding of the value of the data collected and the costs associated with offering the incentive.

California's "Shine the Light" law (Civil Code Section 1798.83) permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us using the information provided below.

We do not share personal information with third parties for their direct marketing purposes without your consent.

We will notify you of any material changes to this Privacy Policy through appropriate means, which may include:

• Email Notification: For significant changes that affect how we handle your personal information, we will send an email to the address associated with your account. The email will highlight the key changes and provide a link to the updated policy.
• In-Application Notices: We may display a prominent notice within our application or website when you log in after a policy change. You may need to acknowledge the changes before continuing to use our Services.
• Website Banner: For less significant changes, we may display a banner on our website announcing the updated policy with a link to the changes.
• Account Dashboard: We may include a notice in your account dashboard summarizing recent policy updates.

The notification method we choose will depend on the significance of the changes and applicable legal requirements. In some cases, we may use multiple notification methods to ensure you are adequately informed.

We may make different types of changes to this Privacy Policy:

• Minor Updates: These include grammatical corrections, formatting improvements, clarifications of existing language, or updates to contact information. These changes do not affect your rights or our obligations and typically do not require individual notification.
• Moderate Changes: These include adding new features that involve new data collection, updating data retention periods, or changing our data sharing practices in non-material ways. We will typically notify you of these changes through website banners or in-app notifications.
• Material Changes: These include significant changes to how we collect, use, or share your personal information, changes that affect your rights, or changes required by new laws or regulations. We will provide prominent notice of these changes and, where required by law, obtain your consent.

We maintain a version history of our Privacy Policy so you can review previous versions. You can request access to previous versions by contacting us.

By continuing to access or use our Services after any revisions become effective, you agree to be bound by the updated Privacy Policy. If you do not agree to the updated Privacy Policy, you must stop using our Services and close your account.

We encourage you to review the updated Privacy Policy carefully. If you have questions about any changes, please contact us before continuing to use our Services.

Grace Period: For material changes that may affect your willingness to use our Services, we typically provide a grace period during which you can review the changes and decide whether to continue using our Services. The length of this grace period will be specified in our notification.

We maintain archives of previous versions of our Privacy Policy. You can access previous versions by:

• Requesting specific versions from our support team
• Checking our GitHub repository where we maintain policy version history
• Using the Internet Archive's Wayback Machine to view historical versions of our website

We also maintain documentation of the reasons for significant policy changes, which we can provide upon request to help you understand the context and rationale behind the changes.

For users located in the European Economic Area, we have appointed a representative in the EU as required by Article 27 of the GDPR:

Our EU representative can be contacted directly on all issues related to the processing of your personal information to ensure compliance with the GDPR.

To submit a privacy-related request (such as data access, correction, deletion, or objection), please use one of the following methods:

• Online Form: Use the "Privacy Rights" form in your account dashboard. This is the fastest way to submit requests as it automatically verifies your identity through your account login.
• Email: Send an email to privacy@recovoly.com with "Privacy Request" in the subject line. Include your full name, email address associated with your account, and details of your request.
• Postal Mail: Send a written request to our mailing address above. Include your full name, address, email address, and details of your request. For verification purposes, we may need to follow up by email or phone.
• Phone: Call our toll-free number for assistance. Our representatives can guide you through the request process but may need to follow up by email for verification and documentation purposes.

Response Time: We strive to respond to all privacy inquiries within 30 days. For complex requests, it may take us up to 60 days. We will acknowledge receipt of your request within 10 business days and keep you informed of our progress.

To help us process your request efficiently, please include the following information:

• Your full name and email address associated with your Recovoly account
• A clear description of your request (e.g., "I want to access my personal data" or "I want to delete my account")
• Any relevant details that can help us locate your information
• If you are making a request on behalf of someone else, proof of your authority to act on their behalf

Identity Verification: For security and privacy reasons, we need to verify your identity before processing most requests. We may ask you to provide additional information or complete a verification process. We will only use this information to verify your identity and process your request.

If you have a complaint about our privacy practices, we encourage you to contact us first so we can try to resolve it. If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority.

Supervisory Authorities:

• United States: Federal Trade Commission (FTC) - www.ftc.gov
• European Union: Your local data protection authority (list available at https://edpb.europa.eu/about-edpb/about-edpb/members_en)
• United Kingdom: Information Commissioner's Office (ICO) - www.ico.org.uk
• Canada: Office of the Privacy Commissioner of Canada (OPC) - www.priv.gc.ca

We are committed to working with supervisory authorities to resolve any complaints in accordance with applicable laws.