Effective date: [YYYY-MM-DD] · Version: [YYYY-MM-DD]
1. Who we are
SplitSpoon is operated by [SplitSpoon LLC], a [State] limited liability company ("SplitSpoon", "we", "us"). This policy explains what personal information we collect when you use the SplitSpoon website and web application (the "Service"; our servers' programming interface exists only to serve the web app and is not offered to customers), why, who we share it with, how long we keep it and what you can do about it. The Service is for professional and business use by people aged 18 or over.
Personal data inside your documents. Your boring logs and projects describe your clients' sites, and they may name people, such as a property owner, a driller or a client contact. For personal data inside documents you upload, you (our customer) are the controller: you decide why and how it is processed. We process it only on your behalf, as your processor or service provider, and our Data Processing Addendum (the "DPA") governs that processing. This policy covers the personal data we collect about you, our customers and visitors, for our own purposes.
How we protect your content is set out in detail on our security page (splitspoon.ai/security.html). Our agreement with you is the Terms of Service (the "Terms") and the documents they list, including the DPA. The Privacy Policy and the security page describe how we work. They are not part of this agreement. The security measures we are bound to are in DPA Annex B. [lawyer: see question 7]
2. What we collect, by where it comes from
2.1 The early-access form on our website. When you ask for an invite we collect the email address you enter and, if you give them, a name and a short note (for example, that you are a drilling contractor). [verify: the form is a design preview and not yet connected; the "drilling contractor" checkbox must be sent as the note, since the API accepts only email, name and note.] We also store a keyed hash of where your request came from: your full IPv4 address, or the /64 network of an IPv6 address, hashed with a secret key. We use it only to limit how often one source can submit the form, and we do not store the IP address itself with the request. Anyone holding the key could recover an IPv4 address from the hash by trying every possible address, so we treat the hash as personal information and delete it with the request (§7).
2.2 Your account.
- Sign-in. Email and password, or Google or Microsoft sign-in, handled by our authentication provider (Supabase), which holds your email, your password hash or sign-in identity, and any two-factor authenticator you enrol.
- Account record. On our side: your email, account status and role, two-factor settings, your retention settings (§7), whether you opted in to correction statistics, your spending limits, your last sign-in time, and your Stripe customer reference.
- Audit trail. An audit trail records top-ups, refunds, credit adjustments, admin actions (including an administrator viewing an account), vault changes and acceptance of a new version of the Terms, and some run events (a result collected, a run that failed, or a run whose hold our cleanup released or settled). Each entry has the time; vault changes also record the IP address and browser user-agent string of the request. Accepting a new version of the Terms records the version, the time, the IP address and the browser user-agent. Acceptance at sign-up records the version and time in the audit history too. Sign-ins (once per session), deletion requests and cancellations, and two-factor enrolment and removal are recorded too, with the IP address and browser user-agent. [verify: built on
prep/int, not yet deployed.] The app does not show the audit trail; write to us for a copy. [lawyer: see question 9.] [owner: build an audit-trail view, or keep "write to us"]
2.3 Your projects (the vault). Your projects, their version history, their names and any company logo you add are encrypted in your browser with your vault key before they reach us. Your vault key is protected by your passphrase (and a recovery key shown to you once). We store only the encrypted data and the wrapped key. We cannot read your projects, and we cannot reset your passphrase or recover your projects if you lose both the passphrase and the recovery key.
2.4 Job files (the documents you submit for AI reading). To extract data we must see the pages. A file you upload first lands in a short-lived upload area. It is not yet encrypted under your account's key there; it relies on our storage provider's own encryption at rest [verify: Cloudflare R2's default encryption at rest]. When the run starts, we encrypt it with AES-256-GCM under a key unique to your account, which we hold (wrapped by a managed key service), and remove it from the upload area. An upload that never becomes a run is deleted, usually within an hour and normally within 2 days. Rendered page images, extraction checkpoints and the extracted result are stored under the same per-account key. A worker decrypts one page at a time in memory to render it and send it to the AI provider (§5). These files exist only while a job runs and for the retention window after it (§7).
2.5 Site addresses and coordinates. If you look up a site address, our server sends that address to the U.S. Census Bureau geocoder and returns the result to you. If you use the map or the ground-elevation lookup, your browser requests map tiles and elevations directly from the U.S. Geological Survey (The National Map), which receives the map area or point coordinates. If you search public boring records, our server sends the map area and the record ids you search to the Florida or Washington State Department of Transportation catalog. [verify: inert until permitted_use is confirmed, catalog.py:37-41] [verify: which actions trigger each lookup, and whether the elevation lookup is automatic or on request.]
2.6 Billing. Payments are processed by Stripe. Card numbers never touch our servers. We store Stripe's customer reference, the amounts and records of your purchases and credit use, and a card fingerprint Stripe gives us (a token that lets us recognise the same card again, used against card testing and abuse; it is not the card number). Stripe applies its own fraud screening (Radar) and 3-D Secure on a first purchase.
2.7 Email. We send transactional email only: for example a welcome message, low-balance and credits-added notices, deletion notices, and account suspension or restoration notices. Sent messages, including the recipient and the message body, are kept in our mail queue for a limited time (§7). We do not send a newsletter or marketing email. [owner: confirm no marketing email at launch]
2.8 Logs and error reports. Our web server keeps access logs with the query string, cookies and authorization headers removed and the client IP masked to its /24 (IPv4) or /64 (IPv6). Our application server also keeps its own access log, with the full client IP address and the request line, until it is rotated out by size (about 30 MB of log, which can take weeks at low traffic), and in the server disk images for about 4 weeks after that [owner: code gap CG-ACCESSLOG removes this]. Application logs and error reports never contain file names, page content or extracted values. Error reports are configured never to capture program variables. [verify: the only source is our security page; confirm with a log-content audit of the api and worker before publishing, and again once error reporting is switched on.]
2.9 Correction statistics (opt-in). If you opt in, we record which kind of field you corrected and how, with the values themselves removed. Nothing is recorded unless you opt in, and you can withdraw the opt-in in Settings at any time.
2.10 What we do not collect. We use no analytics, advertising or tracking cookies or scripts on the website or in the app at launch. What your browser does store is listed in §10. Our published web pages and the app load no fonts or scripts from third parties such as Google. [verify: checked 2026-10-14 on prep/int: no published page and no content security policy names a Google font host; re-check before each publish.] [verify before each publish: analytics is a future, unbuilt item (X10); if it ships, this section and §4 must change first.]
3. Why we use it
- To run the Service: sign you in, process the documents you submit, store your encrypted projects, show your balance, and send the email the Service needs.
- To bill you: take payment through Stripe, keep credit and purchase records, and handle disputes.
- To keep the Service secure: rate limits, abuse and card-testing prevention, the audit trail, and investigating incidents.
- To fix problems: logs and content-free error reports.
- To answer an early-access request: one email when your invite is ready, sent from our own mailbox. [owner: mail host]
- To meet legal duties, such as tax and accounting records.
You must give an email address and sign-in to open an account; without them we cannot provide the Service. Some decisions are automatic: when a bank tells us a payment is disputed, the account is suspended at once (Terms §7.7); when a refund covers credits already spent, runs and deletion are paused automatically (Terms §7.6); our payment processor screens payments for fraud; and new accounts have spending limits. You can ask us to review any of these by writing to [email protected], and a person will review it and can change the decision, except that an account stays suspended while a payment dispute is open (Terms §7.7). [lawyer: Art. 22 applicability]
[lawyer: whether to state legal bases (GDPR Art. 6) here; see question 2.]
We do not sell your personal information or your content, and we do not use your documents to train AI models. [verify with the provider terms and our own practice before publishing; the Terms draft §6 carries the same flag.] We do not look at your documents or pages for support. If you want us to look at one, send it to us yourself.
4. Who we share it with (service providers)
We share information only with the providers below, only as needed to run the Service, and under their own terms.
| Provider | What it does for us | What it receives | Where |
|---|---|---|---|
| Hetzner | Hosts our servers and database, and keeps disk backups | Everything stored on our servers (your projects only in encrypted form) | Ashburn, Virginia, USA |
| Cloudflare | DNS, TLS and web firewall in front of the app and API; hosts the marketing website (Pages); stores job files and encrypted projects (R2), and our encrypted database backups | All web traffic passes through it; stored files are encrypted | R2: Eastern North America; network: global [verify: whether traffic and WAF processing can occur outside the USA] |
| Cloudflare Turnstile | Bot check on sign-up, sign-in and password reset | Browser and device signals for the challenge | [verify: built into the sign-in pages (portal/captcha.js:38); active only once the owner sets the site key and switches CAPTCHA on (U14)] |
| Supabase | Sign-in and accounts (including Google and Microsoft sign-in), password-reset email | Email, password hash or sign-in identity, two-factor enrolment | [owner: project region] |
| Amazon Web Services (KMS) | Protects (wraps) the per-account key that encrypts job files | Encrypted key material and your account id; never document content | [owner: region] [verify before publish: production uses the KMS key-wrap scheme with a KMS key ID set] |
| Anthropic | AI reading of the pages you submit; field re-reads; AI Layer Correlation | Rendered page images and instructions; correlation summaries (§5) | USA [verify: processing region in Anthropic's API terms] |
| OpenAI | AI cross-read, field re-reads, and AI Layer Correlation when you choose it | As for Anthropic, when used | USA [verify: processing region in OpenAI's API terms] |
| Stripe | Payments, tax, fraud screening | Your card and billing details (entered with Stripe directly), email, purchase amounts | [verify: Stripe's processing region and contracting entity for our account] |
| Resend | Sends our transactional email | Recipient address and message | [verify: Resend sending region; not set anywhere in our config] |
| Sentry | Error reports | Content-free error details; IP scrubbing on | [verify: the SDK is a dependency but not yet initialised in the code] |
| Better Stack | Uptime monitoring | Checks our public endpoints; no customer data | [verify: monitor URLs carry no customer data; Better Stack's region] |
| U.S. Census Bureau | Address geocoding (§2.5) | The address you look up | USA |
| U.S. Geological Survey | Map tiles and ground elevation (§2.5) | Map area or coordinates, from your browser | USA |
| Florida and Washington State DOTs | Public boring catalogs you search (§2.5) | The map area and record ids you search, from our server | USA [verify: inert until permitted_use is confirmed, catalog.py:37-41] |
| Our email host [owner: name the mail host for hello@ and security@ and the invite email] | Our mailbox: messages you send to hello@ or security@, our replies, and invite emails | Your email address and the messages | [owner: region] |
We may also disclose information if the law requires it. Because your projects are encrypted with a key we never hold, we cannot disclose their contents to anyone. If SplitSpoon is sold or merged, your information passes to the successor, which must honour this policy; we will email you first. [lawyer: wording for legal requests and for a merger or sale of the business; see question 10.]
We will update this list before we add a provider. For personal data inside your content, the subprocessor list and the notice we give before a change are set out in the DPA. [lawyer: notice period and method for subprocessor changes; see question 3.]
5. AI processing and provider retention
- What is sent. Only rendered images of the pages you submit and the extraction instructions. Never your project name, client name, account details or previous extractions, except as described for re-reading a field and AI Layer Correlation. On a single PDF, pages left out of the quote as non-logs are never rendered or sent.
- Plaintext. A vision model cannot read an image it cannot see, so the AI provider receives the page as plaintext. This is the one unavoidable exception to our encryption.
- AI Layer Correlation. When you run it, the decrypted boring summaries for that request (boring numbers, elevations, depths and soil-type changes) and the name you gave the cross-section go to the AI provider you choose, for that request only. The project file itself is never sent and stays encrypted with your vault key.
- Re-reading a field. When you ask the AI to re-read one field, we send that page image, the field's current value, any suggested alternatives and the reason it was flagged, for that request only.
- No training. Both providers exclude API traffic from model training under their commercial terms. [verify against Anthropic's and OpenAI's commercial terms on the publish date.]
- Provider retention. Anthropic keeps API inputs and outputs for up to 30 days for abuse monitoring under its June 2026 policy. OpenAI offers zero-data-retention to eligible API customers; we do not yet have zero-data-retention with either provider. [verify the provider terms on the publish date]
- Max+. The Max+ quality tier runs on Claude Fable 5.1. Anthropic keeps inputs and outputs of Fable-class models for 30 days regardless of any zero-retention arrangement. The app shows this notice and asks you to acknowledge it before a Max+ run.
6. Where your data is stored
Our servers are in Ashburn, Virginia, USA, and our file storage is in Cloudflare R2's Eastern North America region. Our providers may process data in other countries under their own terms. [lawyer: transfer wording if customers outside the USA sign up; see question 2.]
7. How long we keep it
| What | How long | Your control |
|---|---|---|
| Uploaded scans and rendered page images | 7 days after the run ends (finished, failed or cancelled), by default; you can set 0 to 30 days in Settings. Files of a paused run are kept for the same period from when it paused, and for at least 1 day. | Settings, or delete now |
| Extraction checkpoints | Same as the scans they belong to | Delete the session |
| Extracted result held for your browser to collect | Until your browser confirms it is saved to your vault, then with the job files; never longer than the job files | "Delete on completion" |
| Unfinished uploads that never became a job | Usually within an hour; normally within 2 days | — |
| Projects and their version history (encrypted) | While your account is active; we keep the last 20 versions and one per day for the last 30 days, and prune the rest. A pruned or deleted version is destroyed about 7 days later | Restore a version, delete |
| Early-access request (§2.1) | 90 days if it does not lead to an account; if it does, until the account is deleted | Write to us |
| Sent email in our mail queue | 90 days; the "account deleted" confirmation 7 days [verify before publish: SPLITSPOON_MAIL_RETENTION_DAYS unset or 90 in production] | — |
| Rate-limit records | 1 day | — |
| Web server access logs (masked IP) | Up to 30 days | — |
| Application server logs (full IP address and request line) | Until it is rotated out by size (about 30 MB of log, which can take weeks at low traffic), and in the server disk images for about 4 weeks after that [owner: code gap CG-ACCESSLOG removes this] | — |
| Pages and reports you send us (support, bug or wrong-reading reports) | Deleted within 90 days [owner: 90 days] | — |
| Balance ledger, receipts, audit trail | While your account exists; deleted with the account when its deletion takes effect, then held in backups until they age out (below) [owner: the code deletes these rows at purge; keeping them for tax or dispute purposes needs a code change first] | View your balance history and receipts in the app; write to us for the audit trail |
| Inactive account (no sign-in, no credits left) | We may warn you at 12 months and may delete the account at 15 [owner: no job does this today] | Sign in to keep it |
| Account deletion request | When the 30-day (720-hour) grace period ends, we delete your account records, your sign-in and the key that protects your job files. Stored files are purged within 30 days after that. | Self-service in Settings; sign in or Cancel to stop it; write to us where §9 says you cannot schedule it |
| Encrypted database backups | 30 daily and 12 monthly copies, so normally up to 12 months | — |
| Server disk images | About 4 weeks (below) | — |
Our encrypted database backups keep 30 daily and 12 monthly copies. Our hosting provider also keeps 7 daily images of the server disk, and we keep 4 weekly snapshots, so a copy can last about 4 weeks. These images are protected by the provider's access controls, not by our offline backup key. [owner: code gap CG-SNAP — the 4 weekly snapshots are pruned by hand, and monthly dumps are pruned by count, not age]
Backups are not rewritten when an account is deleted. A deleted account's records stay in them until they age out, normally up to 12 months (§9).
8. Security
Your projects are encrypted in your browser, and job files are encrypted at rest under a per-account key. Database backups are encrypted with a key whose private half is kept offline; the server disk images our hosting provider keeps are not (§7). Two-factor sign-in is available to everyone and required for administrators. Your data is separated from other accounts at the database level. The details, and how to report a problem, are on our security page (splitspoon.ai/security.html). No system is perfectly secure; if we learn of a breach that affects your information we will tell you [lawyer: timing and method; see question 5].
9. Your choices and rights
- Access. Your account page shows your account details, balance, history and receipts. Your projects are yours to open and export in the app. For anything else, including your audit trail, write to us.
- Correction. Write to us to correct your account details. [verify: whether the email address can be changed in the app]
- Retention settings. Set how long job files are kept (0–30 days), or have them deleted as soon as the run ends.
- Deletion. Request deletion of your account in Settings.
- Deletion happens after a 30-day grace period. Signing in during that period cancels it, and so does the Cancel button in Settings.
- When the 30-day (720-hour) grace period ends, we delete your account records, your sign-in and the key that protects your job files. Stored files are purged within 30 days after that. We also delete your mail and your Stripe customer record. [verify before publish: the production Stripe customer-delete key (rk_live) is set; run one test purge] Stripe keeps its own records of past payments under its own legal duties. Your encrypted projects are deleted too. We never held the vault key that encrypts them.
- We may keep the records we need for an open payment dispute, an amount you owe, or a legal claim, use them only for that purpose, and delete them once it is settled. [lawyer: legal-hold wording, e.g. "to establish, exercise or defend legal claims"] [owner: code gap CG-RECORDS — today the purge keeps nothing]
- Our encrypted database backups are not rewritten. Until they age out (normally up to 12 months, §7) they still hold your account record, email, mail queue, audit trail (including IP addresses) and billing records, readable with our offline backup key, and an older copy of your wrapped job-file key. The server disk images in §7 hold the same records for about 4 weeks. Restoring a backup does not by itself repeat deletions that took effect after that backup was made. [owner: add a step to the restore procedure that re-applies those deletions; see question 6]
- You cannot schedule a deletion yourself while a run is in progress or paused with credits still held, while a payment dispute is open, while a refunded amount is still owed (Terms §7.6), or while your account is suspended. In those cases, write to us. We delete the account once the run ends, the amount is settled or written off, or the dispute, breach or other reason for the suspension is resolved. If only a run is in the way, we delete it no later than 90 days after your request. [verify: CG-OPDEL built 10-13 on
prep/int, not yet deployed. The sweep still waits while credits are held, so the 90-day bound needs the run to end first] - We may also delete an account where the Terms (§6, §9 and §9A) allow it.
- Opt-in statistics. Turn correction statistics on or off in Settings.
We do not knowingly "sell" or "share" personal information as those terms are used in U.S. state privacy laws. [lawyer: whether any state law, or the GDPR, applies to us, and which rights must be listed; see questions 1 and 2.]
10. Cookies and local storage
We set no cookies of our own, on the website or in the app, and we use no analytics, advertising or tracking cookies. The marketing website stores nothing in your browser. The app stores the following in your browser, on your device. It is needed for the app to work, and none of it is used to track you.
| What | Where in your browser | Why | How long |
|---|---|---|---|
| Your sign-in session (access and refresh tokens), from our authentication provider, Supabase | Local storage | Keeps you signed in | Until you sign out; signing out removes it |
| Short sign-in and vault flags | Session storage | Finishes a sign-in; keeps a locked vault locked after a reload | Until you close the tab |
| An encrypted copy of your projects | IndexedDB | Lets the app open your projects quickly and save changes | Until you sign out of the account or clear site data; it is encrypted under a key derived from your vault key |
| Your vault key, wrapped under a key your browser cannot export, if you choose "Remember this device" | IndexedDB | Unlocks the vault without your passphrase on this device | 30 days from the unlock that saved it |
| The id of the last account used in this browser | Local storage | Opens the right encrypted cache at start-up | Until you sign out of it or clear site data |
| Your company logo, if you add one | Local storage | Shows it on logs and exports | Until you clear site data |
| Settings and preferences, such as theme, layout, column choices and project templates | Local storage | Remembers how you like to work | Until you clear site data |
| A working copy of a run's result while it is open | Local storage | Lets an interrupted run be recovered | Until the result is saved or the run is cleared [verify: whether this copy is written in cloud mode] |
In local mode (the app used offline, without signing in) the app also keeps a queue of correction statistics in local storage. It is never written while you are signed in.
You can clear any of this in your browser's settings. If you do, you will be signed out and "Remember this device" will stop working; your projects stay safe on our servers.
Cloudflare. Our website and app sit behind Cloudflare. Cloudflare may set its own strictly necessary security cookies, such as __cf_bm or cf_clearance, when it checks for bots or shows a challenge. We do not read them. [verify: which Cloudflare cookies the zone sets with Bot Fight Mode off and Security Level Medium]
Cloudflare Turnstile. When the bot check is switched on, the sign-up, sign-in and password-reset pages load a Turnstile challenge from Cloudflare. Cloudflare receives browser and device signals to run the check, under its own privacy policy. [verify: Turnstile is built in but switched off until the owner sets its site key; confirm with Cloudflare that it sets no cookies]
[lawyer: is a notice enough for strictly necessary storage, or is a consent banner needed for any visitor?]
11. Children
The Service is for business use by adults. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, write to us and we will remove it. [owner: there is no operator deletion path; removal would be a manual database step]
12. Changes to this policy
We may update this policy. We announce material changes to account holders by email and in the app, before they take effect, and we show the effective date at the top. [lawyer: whether a material change needs fresh acceptance, as the Terms do (Terms draft §15); see question 11.]
13. Contact
Questions about this policy or your information: [email protected]. Security reports, or if you think someone else has used your account: [email protected]. Postal address: [SplitSpoon LLC, address] [owner].