1. Who this policy applies to
This Privacy Policy applies to visitors, account holders, trial users and customers of Impressa Doc ("Impressa", "we", "us" or "our"), operated from Pietermaritzburg, South Africa.
2. Information we process
- Account information: name, email address, authentication identifiers and account settings.
- User Content: documents, presentations, images, logos, text and other files you upload, plus generated previews and output needed to provide the service.
- Project information: document names, selected themes, page counts, export settings, status, saved-project metadata and entitlement information.
- Billing information: plan, transaction identifiers, subscription status and limited customer/payment metadata received from Paddle. We do not store full payment-card details.
- Technical and usage information: browser/device information, network and security data, timestamps, diagnostic logs and feature interactions needed to operate, secure and troubleshoot the service.
- Support information: messages and information you provide when contacting us.
3. Why we use information
We process information to create and secure accounts; upload, analyse, transform, save and export documents; provide previews and themes; verify paid entitlements; process billing events; prevent abuse; troubleshoot failures; respond to support requests; maintain audit records; and improve product reliability and usability.
4. Legal grounds
Depending on your location and the context, we process personal information because it is necessary to perform our contract with you, because we have legitimate interests in operating and securing the service, because you have consented to a specific optional activity, or because we must comply with a legal obligation. Where South African law applies, we aim to process personal information consistently with the Protection of Personal Information Act, 2013 (POPIA).
5. Documents and AI-assisted processing
Uploaded documents may be parsed and transformed by software components used to provide Impressa's document-generation features. We use document content to provide the requested transformation and related product functions. We do not claim ownership of User Content. You should not upload material you are not authorised to process.
6. Service providers
We use service providers to operate Impressa. These may include Supabase for authentication, database and file storage; Vercel for hosting and server functions; Paddle for checkout, billing and Merchant-of-Record services; Google where you choose Google sign-in; and other infrastructure or processing providers required to deliver specific product features. These providers process information under their own terms and privacy commitments and may operate in countries outside South Africa.
7. International transfers
Because our providers operate internationally, information may be processed in countries other than the country where you live. Where required, we take reasonable steps to use providers and transfer mechanisms intended to provide appropriate protection for personal information.
8. How long we keep information
We keep account and project information for as long as reasonably necessary to provide the service, maintain security and billing records, resolve disputes and meet legal obligations. Deleted records may remain in restricted backups for a limited period before being overwritten. Payment records may be retained for tax, accounting and fraud-prevention requirements.
9. Security
We use measures such as authenticated accounts, access controls, encrypted transport, restricted server credentials and owner-scoped data access. No system can guarantee absolute security. If you believe your account or information has been compromised, contact us promptly.
10. Cookies and local storage
Impressa may use browser storage, cookies or similar technologies for authentication sessions, security, preferences, upload hand-off and application state. We do not use this policy to authorise unrelated advertising tracking. If analytics or marketing technologies are added in future, this policy and any required consent controls will be updated.
11. Payments
Paddle processes payment details as Merchant of Record. Impressa receives transaction and entitlement information needed to activate purchases and subscriptions, but does not receive or store full card numbers. Paddle's privacy policy applies to its processing.
12. Sharing of information
We do not sell personal information. We may share information with service providers acting on our behalf, with Paddle for payment operations, where you direct us to share or export information, including with members of a Team workspace you join or create, where required by law, or where reasonably necessary to protect rights, users and service security.
13. Your rights
Depending on applicable law, you may have rights to request access to personal information, correction of inaccurate information, deletion, restriction or objection to certain processing, withdrawal of consent where processing relies on consent, or a copy of certain information. These rights can be subject to legal exceptions and identity verification.
South African users may also have rights under POPIA and may contact the Information Regulator of South Africa if they believe personal information has been handled unlawfully.
14. Children
Impressa is intended for business, professional and adult users and is not designed for children. Do not knowingly provide personal information of a child unless you have lawful authority and the service is appropriate for that use.
15. Automated decisions
Impressa uses automated processing to analyse document structure and generate layouts. These features do not make legal or similarly significant decisions about individuals. Users control whether generated documents are accepted, edited, exported or relied on.
16. Data breaches
If we become aware of a personal-data breach, we will investigate and take reasonable containment and remediation steps. Where required by applicable law, we will notify affected users and/or the relevant regulator.
17. Changes to this policy
We may update this Privacy Policy as the service, providers or legal requirements change. The effective date above will be updated when a new version is published and additional notice will be provided where required.