Legal / Privacy
Privacy
Version celrow-privacy-2026-10-23. Approved 2026-10-23. Production activation and actual provider connections are described separately below.
How Celrow handles your documents, account information and service records.
Updated 2026-10-23.
Who is responsible
Celrow is a trading name of Seymour Industrial (Shanghai) Co., Ltd., the controller of account and service information (operator details). For customer document processing, roles depend on the applicable agreement. Contact [email protected].
Documents, processing and access
Uploaded files and email content are held in memory while queued and processed. Original uploads are not persisted to disk, the application database or object storage. Upload buffers are cleared after processing, with a 30-minute expiry safeguard. Extracted results are stored temporarily for 24 hours.
Production application hosting has not been activated; a particular hosting provider or exclusive processing country is not represented as operational before it is verified. Text is sent to AI sub-processors when AI processing is used; their locations and retention depend on the selected provider and applicable terms. Authorized controller personnel in China may access account, billing, service metadata and verified support case notes through protected administration systems, with scoped authorization and audit records. The administration interface does not provide original uploaded documents. US hosting is not a promise of US-only processing or access.
Celrow does not train models on your files, sell personal information, or share it for marketing. We do not sell or share personal information as those terms are used in applicable US state privacy laws, including California. Provider data handling is governed by their applicable service terms.
What stays, and for how long
| Data | Retention |
|---|---|
| Original uploaded files and email content | During processing; upload buffers cleared on job completion, with a 30-minute expiry safeguard. |
| Extracted results | 24 hours. |
| Attachment ZIP | Single-use download; expires after 10 minutes. |
| Source filenames in processing history | 90 days, then removed from those records. |
| Processing and AI usage metadata | 13 months (396 days); does not include original uploads. |
| Internal support cases and handling notes | 90 days after last update; removed with account deletion. Do not send credentials or source documents to support. |
| Administrative request receipts | 7 days; contain action metadata, not support text. |
| Security and administrator audit records | 24 months (730 days); no uploaded document contents. |
| Inbound events and service notifications | 90 days. |
| Product usage events | 24 months (730 days). |
| Expired session records | Removed 30 days after expiry. |
| Account and billing records | For account operation and applicable accounting, dispute and legal obligations. Payment records held by Paddle follow its policy. |
Deletion of results does not delete separate accounting or service metadata. Provider-held records follow their own terms and applicable obligations.
To prevent repeat trial registrations, an HMAC-derived email eligibility marker is retained for up to 730 days, including after account deletion. The marker does not contain a plaintext email address. Most processing-cost and failure counters are retained for up to 45 days. A minimal cumulative failed-spend counter for non-expiring credit packs is retained while the account exists and for up to 45 days after deletion; trial-funding counters for up to 90 days.
The approved production backup policy retains encrypted six-hour snapshots for 7 days and daily and monthly snapshots for 30 days. These periods run from snapshot creation and are not measured from the account deletion date. Expiry is enforced by scheduled cleanup and requires successful cleanup checks. Backups are restricted to recovery; a restored system must reapply subsequent account deletions before reopening. For recovery safety, a restricted independent deletion journal and access records retain stable account references, original deletion times, hashed login identity references, access restrictions, and whether live commerce has ever been enabled or used. They contain no email addresses or document contents. These records prevent an older backup from restoring deleted accounts or revoked access. After recovery, previous sessions, API keys, extension tokens and inbound email permissions must be re-established. Deletion-history entries are retired only after all affected older snapshots are verified to have expired; a fixed backup age alone is not proof. Hashed identity-denial references remain while needed to prevent a revoked provider identity from regaining access. Access remains closed during recovery until the required checks pass. Financial records follow their separate applicable retention obligations.
Financial records
Only necessary records actually classified as the operator's accounting vouchers or books are subject to the applicable 30 years minimum; auxiliary bank reconciliation or tax-filing records use their applicable 10 years category. These periods begin on the day after the relevant accounting year ends. Retention is based on accounting classification, not all database rows. Customer-uploaded invoices are not our accounting records merely because you use Celrow to parse them. Original emails, filenames, extracted documents and support text are not copied into the long-term financial archive. Necessary transaction, settlement and refund identifiers may be kept with a non-login financial reference after account erasure.
At the end of the applicable period, records undergo appraisal before destruction. Unresolved claims or legal holds preserve only relevant records, with a recorded reason and review. Permanent statutory corporate archives are handled in the operator's accounting system, not by keeping the whole customer database forever. Provider-held financial records follow that provider's obligations. The backup policy remains 7/30/30 days, separate from financial archive retention. We do not promise that account deletion immediately removes legally required financial records.
Sub-processors and service providers
- Cloudflare: network protection, delivery, email routing and configured backup services.
- Vultr: United States application hosting.
- Google Firebase: authentication.
- OpenAI and Google: AI processing providers for extraction, translation, reply drafts and timelines. Google provides independent fallback processing.
- Paddle: payment reseller and merchant of record, handling payment information under its own policy.
- Resend: service email delivery.
Your choices and deletion
Use Account to manage sessions and access credentials. Account deletion requires confirmation and recent authentication; an active subscription must be resolved first. Deletion disables account access and starts cleanup. It does not promise immediate erasure of all provider-held, billing or legally retained records.
Request access, correction, export, deletion or objection at [email protected]. We may verify your identity before acting. You will not be discriminated against for exercising applicable privacy rights.
EU and UK visitors are not blocked. Where applicable, the legal basis for processing is contract performance and legitimate interests; rights and complaint options depend on applicable law. Where applicable, you may complain to your competent data-protection authority. Any required regional representation and international-transfer safeguards must be completed for the actual processing; approval of this notice does not itself complete those arrangements. The service is for users aged 16 and older.
Browser extension
The Celrow Chrome/Edge extension sends files you drop on it to your Celrow account using a token you mint on the Account page. The token stays in chrome.storage on your device. The extension does not read other tabs, capture passwords, or persist file bytes after the parse request. For token revocation assistance, contact [email protected]. Store listing: celrow.com/privacy#extension.