How Pocket Archive handles personal information.
This Privacy Notice for XIA TECHNOLOGIES LTD. explains how we may access, collect, store, use, share, and otherwise process personal information when you use Pocket Archive or related services.
- Documents you chooseYou can upload documents on any subject, including records containing sensitive personal information, subject to supported file formats and our Terms of Use.
- Processing providersService providers help us store documents, recognize text, generate AI results, authenticate accounts, and process payments.
- AI features disclosedAI search, insights, text analysis, image analysis, and NLP are covered in the policy.
- Rights requestsUsers can exercise privacy rights in-app or by contacting support.
Questions or concerns? Reading this notice will help you understand your privacy rights and choices. If you do not agree with the policies and practices described here, please do not use the Services.support@pocketarchive.io
Summary
Summary of key points
This summary highlights key points from the Privacy Notice. The full sections below provide the details, definitions, and jurisdiction-specific rights.
- Personal informationWe may process personal information depending on how you interact with us, the choices you make, and the features you use.
- Sensitive informationUploaded documents may contain financial, health, identity, family, employment, or other sensitive information about you or others. We process that content to provide the archive features you use.
- Processing reasonsWe process information to provide, improve, and administer the Services, communicate with users, support security and fraud prevention, comply with law, and act with consent where required.
- User rightsDepending on your location, you may have rights to access, correct, delete, obtain a copy of, restrict, object to, or withdraw consent for certain processing.
Section 1
What information do we collect?
In short: We collect personal information that you provide to us, and some information is collected automatically when you use the Services.
Personal information you disclose to us
We collect personal information that you voluntarily provide when you register on the Services, express interest in our products and Services, participate in activities on the Services, or otherwise contact us. This may include names, phone numbers, email addresses, usernames, passwords, and billing addresses.
Document content and sensitive information. Pocket Archive accepts documents on any subject within supported file formats and our Terms of Use. We collect and process the files you upload, including images and scans, document contents, recognized text, extracted fields, tags, notes, search queries, AI questions and answers, and related metadata. Depending on what you upload, this may include identity documents, government identifiers, financial and tax records, health information, employment and education records, information about children, and other sensitive personal information. Upload only information that you have the right to provide, including any required permission to provide information about another person.
Saved payment methods. To organize documents and match recognized payment details, Pocket Archive may store a payment-method label, type or network, institution name, and the last four digits or characters of a card or account number. These limited identifiers cannot authorize a payment. Pocket Archive does not request or store full card numbers, full bank account numbers, security codes, PINs, or online banking credentials as saved-payment-method data. An uploaded document may independently contain financial information, which is processed as document content under this notice.
Payment data. If you choose to make purchases, payment data necessary to process the transaction may be handled and stored by Stripe and Apple. Their privacy notices are available at stripe.com/privacy and apple.com/ca/legal/privacy.
Information from service providers. If you use social sign-in, we may receive profile and authentication information from that provider. Payment providers may send subscription status and transaction confirmations. OCR and AI providers return recognized text, extracted details, embeddings, and generated answers as part of processing your documents.
Application data. If you use the app, we may request access to mobile device features such as camera and storage. You can change permissions in your device settings. We may also collect mobile device data, operating system information, device identifiers, IP address or proxy server information, mobile carrier information, and information about application features you accessed.
Information automatically collected
We automatically collect certain technical information when you visit, use, or navigate the Services. This may include IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, usage timing, pages and files viewed, searches, features used, crash reports, and hardware settings. This information is primarily needed for security, operation, troubleshooting, analytics, and reporting.
Like many businesses, we may collect information through cookies and similar technologies. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Section 2
How do we process your information?
In short: We process your information to provide, improve, and administer the Services, communicate with you, support security and fraud prevention, comply with law, and otherwise act with prior explicit consent where required.
We process personal information for reasons that depend on how you interact with the Services.
- Account creation and authentication. We may process information so you can create and log in to your account and keep it working.
- Service delivery. We process uploaded documents and related personal information to store and sync your archive, recognize text, extract document details, index and search records, organize collections, generate source-linked AI answers and financial views, identify attention items, and provide exports or sharing features you choose.
- User support. We may process information to respond to inquiries and solve potential issues.
- Orders and payments. We may process information to fulfill and manage orders, payments, returns, and exchanges.
- Product improvement. We may process information to evaluate and improve our Services, products, marketing, and user experience.
- Usage trends. We may process information about how the Services are used so we can improve them.
Section 3
What legal bases do we rely on to process your information?
In short: We only process personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.
If you are located in Canada, this section applies to you. We may process your information if you have given express consent for a specific purpose, or where permission can be inferred as implied consent. You can withdraw consent at any time.
Because documents often contain financial, health, or identity information, each Pocket Archive app asks for your express consent to cloud processing before it processes your documents, and we record the version of the disclosure you accepted and when.
In some exceptional cases, applicable law may permit processing without consent, including for investigations and fraud detection, business transactions, compliance with subpoenas or court orders, certain insurance and emergency-related situations, publicly available information, and approved research or statistics projects subject to ethics oversight and confidentiality commitments.
Section 4
When and with whom do we share your personal information?
In short: We may share information in specific situations described in this notice and with specific third parties.
We may need to share personal information in connection with business transfers, including during negotiations of any merger, sale of company assets, financing, or acquisition of all or part of our business by another company.
We disclose information to service providers as needed to operate the features you use. These include Amazon Web Services (AWS) for infrastructure, document storage, authentication, and text recognition where enabled; Mistral AI for document text recognition; OpenAI for AI analysis, embeddings, and answers; Anthropic, alongside or instead of OpenAI, for AI analysis and answers; Stripe and Apple for payment and subscription processing; Resend for account email and email import; Sentry for error monitoring; and, only if you allow analytics, Google Analytics. Processing can include sensitive information contained in your documents. When you choose a document-sharing feature, recipients with access to the resulting link may be able to view the shared document. We do not sell personal information or share it for cross-context behavioral advertising. Service-provider processing and sharing that you request are described separately here.
Section 5
Do we use cookies and other tracking technologies?
In short: Optional analytics load only after you allow them, and you can change that choice later.
Cookies, web beacons, pixels, and similar technologies may help maintain the security of the Services and your account, prevent crashes, fix bugs, save preferences, and support basic site functions.
Pocket Archive uses Google Analytics only after you choose Allow analytics. We send coarse page categories and conversion milestones such as account creation, email verification, first upload, first completed extraction, first Archive AI answer, checkout start, and subscription start. URL parameters and dynamic record identifiers are removed before page measurement.
We do not send document names, filenames, document contents, recognized text, search text, AI questions, merchant or payment details, email addresses, account identifiers, or advertising identifiers to Google Analytics. Advertising storage, advertising personalization, and Google Signals remain disabled.
Your analytics choice is stored in this browser. You can withdraw consent from Analytics choices in the site footer or from Privacy and security in app settings; withdrawing consent disables future analytics collection and removes accessible Google Analytics cookies from this browser.
Section 6
Do we offer artificial intelligence-based products?
In short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.
Pocket Archive offers AI Products as part of the Services. These features are designed to enhance the user experience and provide search, analysis, and insight functions. The terms in this Privacy Notice govern use of AI Products within the Services.
We use Mistral AI and, where enabled, Amazon Web Services (AWS) for text recognition, and OpenAI for document analysis, embeddings used in retrieval, and Archive AI answers. We may also use Anthropic, alongside or instead of OpenAI, for document analysis and Archive AI answers, sending it the same kinds of data. Uploaded files or document images may be sent for text recognition; recognized text, relevant document excerpts, extracted metadata, questions, and conversation context may be sent for AI processing. This can include sensitive information in the documents you choose to upload. Text recognition, document analysis, and indexing can run automatically after upload; processing is not limited to occasions when you ask an AI question. Users must not use AI Products in a way that violates provider terms or policies.
AI Products are designed for text analysis, AI search, AI insights, image analysis, and natural language processing. Personal information processed using AI Products is handled in line with this Privacy Notice and agreements with third parties.
Before any document or question is sent to these AI services, the Pocket Archive apps and website ask for your permission. You can withdraw it in the iOS app under Account → Privacy & processing, or by contacting us. We send each AI provider only the data needed for the feature you use. Each provider processes that data as our processor under a written data processing agreement that limits its use to providing the provider's service to Pocket Archive and requires confidentiality, security safeguards, breach notification, and deletion, so your information receives the same or equal protection as described in this Privacy Notice.
Section 8
How long do we keep your information?
In short: We keep information as long as necessary for the purposes in this notice unless a longer period is required or permitted by law.
No purpose in this notice will require keeping personal information for longer than six months past termination of the user's account, unless a longer retention period is required or permitted by law for tax, accounting, or other legal requirements.
When there is no ongoing legitimate business need to process personal information, we will delete or anonymize it. If deletion or anonymization is not possible, such as because information is stored in backup archives, we will securely store it and isolate it from further processing until deletion is possible.
Section 9
How do we keep your information safe?
In short: We aim to protect personal information through organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect personal information we process. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Although we do our best to protect personal information, transmission to and from the Services is at your own risk, and you should access the Services only within a secure environment.
Section 10
Do we collect information from minors?
In short: Pocket Archive is intended for adult account holders. Documents uploaded by adults may contain information about children.
By using the Services, you represent that you are at least 18 or the equivalent age in your jurisdiction, or that you are the parent or guardian of a minor dependent and consent to that dependent's use of the Services. An adult may upload family, school, health, or other records containing a child's information when authorized to do so. We process that information as part of the document services described in this notice. We do not direct the Services or marketing to children. If you believe a child is using an account without the required consent or that a child's information was uploaded without appropriate authority, contact support@pocketarchive.io.
Section 11
What are your privacy rights?
In short: Depending on your state of residence in the US or region such as Canada, you may have rights allowing greater access to and control over your personal information.
Rights may include requesting access to and a copy of personal information, requesting rectification or erasure, restricting processing, data portability where applicable, objecting to processing, withdrawing consent, and not being subject to automated decision-making. If a solely automated decision produces legal or similarly significant effects, we will inform you, explain the main factors, and offer a simple way to request human review.
You can review, change, or terminate your account at any time depending on your country, province, or state of residence. Account information can be updated in account settings or by contacting us. Upon account termination, we will deactivate or delete the account and information from active databases, while retaining information where needed to prevent fraud, troubleshoot, assist investigations, enforce legal terms, or comply with legal requirements.
If you have questions about privacy rights, email support@pocketarchive.io.
Section 12
Controls for do-not-track features
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track feature or setting. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized, so we do not currently respond to DNT browser signals or other automatic choice mechanisms. If a standard is adopted that we must follow in the future, we will inform you in a revised Privacy Notice.
California law requires disclosure of how we respond to DNT signals. Because there is currently no industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.
Section 13
Do United States residents have specific privacy rights?
In short: Residents of listed US states may have rights to request access, details, correction, copies, deletion, and consent withdrawal, subject to limits under applicable law.
The notice references rights for residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.
The categories below describe information we collect through account and service use or may receive within uploaded documents. A category marked as document-dependent is processed only if it appears in content you provide; it is not required to create an account. Retention follows Section 8. We may also receive personal information through support requests.
Rights under certain US state data protection laws may include the right to know whether personal data is processed, access personal data, correct inaccuracies, request deletion, obtain a copy of data previously shared, non-discrimination for exercising rights, and opt out of targeted advertising, sale, sharing, or profiling where applicable.
To exercise rights, users can visit the app, email support@pocketarchive.io, or use the contact details below. We may need to verify identity and may require additional information from an authorized agent. Appeals may be submitted by email if a request is declined.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Contact details, online identifiers, IP address, email address, and account name. | YES |
| B. California customer records personal information | Name, contact information, education, employment history, and financial information. | YES |
| C. Protected classification characteristics | Gender, age, date of birth, race, ethnicity, national origin, marital status, and demographic data. | If included in uploaded documents |
| D. Commercial information | Transaction information, purchase history, financial details, and payment information. | YES |
| E. Biometric information | Fingerprints and voiceprints. | If included in uploaded documents |
| F. Internet or network activity | Service usage, pages and features accessed, searches, and technical logs, as described in Section 1. | YES |
| G. Geolocation data | Approximate location from technical data, or location information contained in uploaded documents. | YES / document-dependent |
| H. Audio, electronic, sensory, or similar information | Uploaded document images, scans, and other content in supported file formats. | YES |
| I. Professional or employment-related information | Business contact details, job title, work history, and professional qualifications. | If included in uploaded documents |
| J. Education information | Student records and directory information. | If included in uploaded documents |
| K. Inferences | Document classifications, extracted details, summaries, suggested tags, and other AI-generated results. | YES |
| L. Sensitive personal information | Sensitive personal information. | If included in uploaded documents |
Section 14
Where is your information processed?
In short: Mostly in the United States, with document text recognition by Mistral AI in the European Union.
Pocket Archive is operated from Canada. The providers below process your information outside Canada, so your information is transferred to these countries. While it is there, it is subject to their laws and may be accessible to their courts, law enforcement, and national security authorities.
- Amazon Web Services (AWS), United States: hosting, document storage, authentication, and text recognition where enabled.
- Mistral AI, European Union: document text recognition (OCR).
- OpenAI, United States: AI extraction, embeddings for search, and Archive AI answers.
- Anthropic, United States: AI extraction and Archive AI answers, when used alongside or instead of OpenAI.
- Stripe, United States: web payments and subscriptions. Apple processes App Store purchases.
- Resend, United States: account email and email import.
- Sentry, United States: error monitoring.
- Google Analytics, United States: coarse usage analytics, only if you allow analytics.
Section 15
Do residents of Québec have specific privacy rights?
In short: Yes. Québec residents have rights under the Act respecting the protection of personal information in the private sector.
If you live in Québec, you may ask to access your personal information, have it corrected, withdraw your consent, and receive information you provided in a structured, commonly used technological format. You may also ask us to stop disseminating your information or to de-index any hyperlink attached to your name that gives access to it, where the law allows.
Pocket Archive does not make decisions about you based exclusively on automated processing. Automated text recognition and AI extraction organize your own documents, and you can review and correct the results.
Your information is communicated outside Québec to the providers listed in Section 14. We notify the Commission d'accès à l'information and affected people of any confidentiality incident that presents a risk of serious injury.
To exercise these rights, contact our Privacy Officer as described in Section 17. You may also file a complaint with the Commission d'accès à l'information du Québec.
Section 16
Do we make updates to this notice?
In short: Yes. We will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated revised date at the top. If we make material changes, we may notify you by prominently posting a notice or by sending a direct notification. We encourage you to review this notice frequently.
Section 17
Who is responsible for your information, and how can you contact us?
XIA TECHNOLOGIES LTD. is responsible for the personal information it controls. Our Privacy Officer is accountable for compliance with this notice and for handling privacy requests and complaints.
To reach the Privacy Officer, email support@pocketarchive.io with "Privacy" in the subject line, or write to:
Privacy Officer, XIA TECHNOLOGIES LTD. | 42 Warrington Way, Markham, Ontario L6C0B8, Canada
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, if you live in Québec, the Commission d'accès à l'information du Québec.
Section 18
How can you review, update, or delete the data we collect from you?
You have the right to request access to the personal information we collect from you, details about how it has been processed, correction of inaccuracies, or deletion of personal information. You may also have the right to withdraw consent to processing. These rights may be limited in some circumstances by applicable law.
To request review, update, or deletion of personal information, please visit the in-app request flow or contact support@pocketarchive.io.
This Privacy Policy was initially based on a Termly template and has been updated to describe Pocket Archive document processing.
Section 7
How do we handle your social logins?
In short: If you register or log in using a social media account, we may access certain information about you.
The Services may allow registration and login using third-party account details, such as Apple, Google, or Facebook. If you choose this option, we may receive profile information from that provider. This often includes name, email address, and other information you make available through that provider.
We use the information received only for purposes described in this Privacy Notice or otherwise made clear in the Services. We do not control other uses of personal information by third-party social media providers.