Privacy Policy

1. Information We Collect

We collect the minimum information necessary to provide the Service:

• Email address — collected when you create an account, used for authentication and transactional communications such as purchase confirmations.
• Uploaded PDF documents — collected when you submit a file for auditing. These documents may contain personally identifiable information about drivers (e.g., names, license numbers) as required for Article 19-A compliance review.
• Payment information — we do not store payment card details. All payment data is handled directly by Stripe, our payment processor.
• Session data — we use secure, server-side session cookies to maintain your login state. No third-party tracking cookies are used.

2. How We Use Your Data

We use collected information for the following purposes:

• Authentication — your email address is used to create and manage your account and to authenticate you on subsequent visits.
• AI document processing — uploaded PDFs are transmitted to Google Gemini for AI-powered analysis of Article 19-A compliance fields. Documents are not used to train AI models.
• Payment processing — your email and transaction data are shared with Stripe to process credit purchases and issue receipts.
• Transactional email — we use Resend to send account-related emails such as purchase confirmations. We do not send marketing emails.

3. Data Retention

We apply the following retention policy to your data:

• Paid (unlocked) audits — audit records and associated files for which credits have been applied are retained indefinitely so you can access them from your account dashboard at any time.
• Unpaid (locked) audits — audit records for uploads that were never unlocked with a credit are automatically deleted, along with their associated files, after 7 days.
• Account data — your email address and account record are retained for as long as your account is active. You may request deletion at any time (see Section 5).

4. Third-Party Services

We rely on the following third-party services to operate 19aFile. Each provider has its own privacy policy governing its handling of your data:

• Stripe (stripe.com) — payment processing. Stripe receives your email and payment details when you purchase credits.
• Google Gemini (ai.google.dev) — AI analysis engine. Uploaded PDF content is sent to Gemini for compliance field extraction and analysis.
• Resend (resend.com) — transactional email delivery. Resend receives your email address and message content when we send you account-related emails.
• Vercel (vercel.com) — hosting infrastructure and file storage. All web traffic is served through Vercel's platform, and uploaded files are stored using Vercel Blob.
• MongoDB Atlas — database hosting. Account information, audit records, and audit results are stored in a MongoDB Atlas database.

5. Your Rights

You have the right to request access to, correction of, or deletion of your personal data. To exercise any of these rights, email us at support@19afile.com with your request. We will respond within a reasonable timeframe and in accordance with applicable law.

A deletion request will result in the removal of your account, associated audit records, and uploaded files from our systems, subject to any legal obligations that require us to retain certain information.

6. Security Measures

We take reasonable measures to protect your information from unauthorized access, loss, or disclosure. All data transmitted between your browser and the Service is encrypted using TLS (HTTPS). Authentication is managed through secure, HTTP-only, server-side cookie sessions. File uploads are transferred and stored over encrypted connections. However, no security system is impenetrable, and we cannot guarantee absolute security of your data.

7. Children's Privacy

The Service is not directed to children under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify registered users of material changes via email. The "Last updated" date at the top of this page indicates when the policy was most recently revised. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.