Legal
Policy change history
What changed in each of our policies, and when — newest first. Material changes are also emailed to account holders before they take effect.
Last updated , 3 min read
Privacy Policy
Read the current Privacy Policy
- Clarifies that original statements and source/OCR text may retain full printed numbers until deletion; only structured account fields are masked.
- Describes upload links as short-lived and file-restricted, not single-use.
- Discloses Namecheap forwarding and Google Gmail for support email, separate from uploaded statement storage and expiry.
- Lists every cookie and browser-storage item in one table: who sets it, for how long and why.
- Describes the sign-in session exactly: a cookie scripts can’t read, plus a five-minute access token kept in page memory and sent to our API.
- Discloses that WorkOS’s hosted sign-in page loads Datadog and Sentry, and sets Cloudflare cookies, under WorkOS’s privacy policy.
- Says that Stripe’s cookies and fraud checks start only once you open checkout.
- Adds where your data is processed for people in the US, Canada, the UK and EU, and elsewhere.
- Removes Microsoft and Apple sign-in, which aren’t offered.
- Explains Download my data, receipts on the Account page, and exactly what is kept after you delete your account, including the monthly free-allowance record.
- Explains exactly how hashed IP addresses are used: a limit of 60 new anonymous sessions per network per hour, and daily free pages counted per network.
- Signed in, you can keep a batch for 7 or 30 days instead of the default 24 hours; adds the storage backstops and deletion receipts.
- Explains opt-in category rules: what they keep, where to delete them, and that they’re deleted with your account.
- Lists the bank export details a signed-in account can save (bank or routing number, last 4 of the account number), that Download my data includes them, and that they’re deleted with your account.
- Says precisely which names are stored: a name from your sign-in provider is only shown from your session; a display name you set yourself is kept with your account.
- States that file storage keeps no access logs, so your IP address isn’t recorded there either.
- First published (draft for legal review).
Terms of Service
Read the current Terms of Service
- Aligns the sign-in provider wording with the offered email and Google methods.
- Clarifies how pages are counted: uploading the same PDF again while the first copy is still here is free, and deleting a file doesn’t return pages already used.
- Notes that, signed in, you can keep a batch for up to 30 days instead of the default 24 hours.
- First published (draft for legal review).
Subprocessors
Read the current Subprocessors
- Adds Namecheap and Google Gmail for existing support email handling.
- Names the services WorkOS’s sign-in page uses (Datadog, Sentry, Cloudflare) and links WorkOS’s own subprocessor list.
- Commits to 30 days’ notice, by email and on the change history, before a new subprocessor starts, with a right to object.
- Removes Microsoft and Apple sign-in, which aren’t offered.
- First published (draft for legal review).
Security
- Clarifies original-file number retention, upload-link lifetime and the limits of Content Security Policy.
- Adds sign-in methods, multi-factor authentication status, session length and how to sign out everywhere.
- Describes the session cookie and the short-lived access token precisely, and links the full storage table.
- Notes that, signed in, you can keep a batch for up to 30 days instead of the default 24 hours, and that every deletion leaves a receipt.
- Lists a display name you set yourself among what your account keeps.
- First published.
Data Processing Addendum (draft)
Read the current Data Processing Addendum (draft)
- Clarifies original-file number retention and short-lived upload links.
- First published as a draft for legal review, with a downloadable copy.