Privacy Policy

Last updated: October 15, 2026

This Privacy Policy explains how FreeOCR.AI ("we", "us", or "our") collects, uses, stores, and shares information when you use our website, OCR services, API platform, developer dashboard, FreeOCR Desktop, and related services (the "Service"). It also explains your choices and rights regarding your information.

By accessing or using the Service, you acknowledge the practices described in this Privacy Policy.

1. Who We Are, Scope, and Roles

A. Who We Are

The Service is operated by Hantian Pang, an individual trading as FreeOCR.AI, in Songjiang District, Shanghai 201602, People's Republic of China. Privacy questions and requests may be sent toadmin@freeocr.ai.

B. Scope

This Privacy Policy applies to information processed through FreeOCR.AI, including:

For this policy, "Personal Data" means information that identifies, relates to, describes, or can reasonably be linked to an individual person.

C. Our Roles

FreeOCR.AI acts as a controller for website, account, billing, analytics, support, and service-security data. For content submitted by a business customer through the direct API, FreeOCR.AI generally acts as that customer's processor or sub-processor. That API processing is also governed by our Data Processing Addendum.

2. Information We Collect by Service

The general practices described later in this policy apply across the Service. The sections below explain the differences between the free service, registered account and workspace features, and the direct API.

We receive information directly from you, automatically from your browser or device, from authentication and payment providers, and from customers that submit documents or API content containing information about other individuals.

A. Free Service (No Account Required)

You can use certain free features without creating an account. We do not require registration details (such as your email) for free usage. We also do not permanently store uploaded files or OCR outputs from free usage once processing is completed, except for temporary and limited technical handling needed to provide the Service.

However, even in free usage, we and our service providers may collect technical and usage information (for example, IP address, browser type, device identifiers, page interactions, cookie identifiers, and event data) for analytics, security, and advertising purposes.

Free-service content is sent through our hosting infrastructure to BytePlus ModelArk for OCR or extraction. Although FreeOCR.AI does not intentionally retain that content after processing, BytePlus states that input or output triggering its content-safety filter may be retained in Malaysia for up to 180 days.

B. Account, Workspace and Subscription Data

If you create an account or subscribe to Pro, we may collect:

C. API Platform and Developer Data

If you use the API Platform, we may collect and process information needed to operate, secure, meter, and bill API usage, including:

FreeOCR.AI does not intentionally retain API document payloads or OCR outputs after processing is completed. These materials are temporarily processed by infrastructure and AI inference providers to deliver the requested result. Limited retention may occur for security, abuse prevention, troubleshooting, or legal compliance. In particular, BytePlus states that input or output triggering its content-safety filter may be retained in Malaysia for up to 180 days. More detail is provided in our Data Processing Addendum.

We do not use direct API document payloads or outputs for advertising, analytics, or training or improving AI models. Infrastructure and AI inference providers may process them only as necessary to provide, secure, diagnose, maintain, or improve the reliability of their services under their applicable terms. We do not authorize those providers to use direct API content to train AI models. We do not routinely review that content for customer support; customers should provide only redacted, anonymized, or synthetic examples when requesting troubleshooting assistance.

D. Payment Data for Paid Services

Paddle acts as the Merchant of Record and authorized reseller for purchases made through our website, and handles checkout, payments, subscription management, invoicing, taxes, refunds, and related buyer support. We do not store full payment card numbers in our systems.

We may receive limited transaction-related data such as customer ID, subscription ID, invoice ID, payment status, country, and timestamps to manage subscriptions, provide support, prevent fraud, and comply with legal obligations.

E. Support Communications Across Services

If you contact us, we collect the information you provide (such as your email address and message content) to respond to your requests.

F. Required and Optional Information

Account, authentication, payment, and API request information is required where necessary to provide the feature you request. If you do not provide required information, we may be unable to create an account, process a payment, or complete an API request. Other information, such as optional support details, is voluntary.

G. Free Tool Ratings and Feedback

After a free OCR, table, or data-extraction result, you may voluntarily submit a rating. We store the tool type, a score from one to five, the submission timestamp, and, for ratings below five, the short problem description you provide. The rating record does not include your uploaded file or generated result. Please do not include personal or sensitive information in the problem description.

H. FreeOCR Desktop

Desktop OCR requires an internet connection. Images are prepared and compressed locally before being sent over HTTPS to our cloud service for recognition or extraction. For PDFs, the original PDF stays on your computer; Desktop renders its pages locally and sends the page images for recognition. Requested extraction fields are also sent when needed to perform the task.

Results are saved on your computer and are not added to workspace cloud processing history. This does not mean processing is offline or that no service data is retained. Account, credit usage, PDF task identifiers and page counts, and necessary operational records may be processed or retained for billing, security, and service operation.

Images and results are temporarily handled by our hosting and AI inference providers, including BytePlus ModelArk. The third-party processing and retention exceptions described in this policy also apply to Desktop content, including BytePlus content-safety-triggered retention of input or output in Malaysia for up to 180 days. Local result storage does not imply end-to-end encryption or zero retention throughout the cloud processing chain.

3. Cookies and Tracking Technologies

We use cookies and similar technologies (such as tags, pixels, and local storage) to operate the Service, analyze usage, improve performance, and deliver/measure advertising.

Types of cookies may include:

FreeOCR.AI provides an in-site Cookie Settings control. PostHog, including any enabled session replay, loads only after you consent to analytics. Necessary storage used for sign-in, security, core functionality, and recording your privacy choices remains available. Google separately manages advertising consent on the three free OCR tools through its certified consent message. You may change or withdraw your optional choices at any time through the Cookie Settings link. Withdrawal does not affect processing already carried out before it takes effect.

Where PostHog session replay is enabled, input fields are masked.

4. How We Use Information

We use collected information to:

OCR and extraction results are generated automatically. FreeOCR.AI does not use those results to make decisions about individuals that produce legal or similarly significant effects. Product-improvement and analytics uses described in this policy do not include direct API document payloads or outputs.

5. Third-Party Services We Use

We work with trusted third parties to provide parts of the Service. The provider involved depends on the feature you use; not every provider receives every category of data. These providers may process data under applicable service and privacy terms:

Analytics, advertising, and payment providers do not receive direct API document payloads or OCR outputs for their own service functions. Core direct API providers and processing locations are described in the Data Processing Addendum.

Service providers acting on our behalf are required to process data under applicable contractual and data-protection obligations. Certain providers, such as payment providers, may also act as independent controllers for parts of their processing and publish their own privacy notices.

6. Legal Bases for Processing (Where Applicable)

Depending on your location, we process Personal Data based on one or more of the following legal bases:

Our legitimate interests include protecting the Service, preventing fraud and abuse, maintaining reliability, understanding product performance, and improving features, provided those interests are not overridden by your rights. Where we have obtained valid consent, consent is the legal basis for the processing covered by that consent. The legal bases in this section describe processing for which FreeOCR.AI acts as a controller. For Customer Personal Data submitted under the direct API Data Processing Addendum, the API customer determines the applicable legal basis and FreeOCR.AI processes the data on the customer's documented instructions.

7. Data Retention

We retain Personal Data only as long as necessary for the purposes described in this policy, including to provide services, resolve disputes, enforce agreements, and comply with legal obligations.

A. Free Service Content

Uploaded files and OCR outputs from the free service are not intentionally retained after processing, apart from temporary provider handling and limited security, troubleshooting, or legal retention described in this policy.

B. Account and Workspace Data

Account, profile, subscription, and saved account-history data are generally kept while the account is active. They may remain for a reasonable period after account closure where needed for security, support, disputes, deletion workflows, or legal obligations. Workspace processing history includes uploaded images stored in Cloudflare R2 and corresponding job records and results stored in Supabase. A user may delete individual history items through the Service, which removes the corresponding active records and stored objects through the normal deletion workflow.

C. Direct API Content and Usage

API document payloads and OCR outputs are not intentionally retained by FreeOCR.AI after request processing. Temporary provider processing and limited security or legal retention may still apply. BytePlus may retain content-safety-triggered input or output in Malaysia for up to 180 days. API key, usage, balance, and transaction records may be retained as needed for metering, security, fraud prevention, support, and disputes.

D. Shared Operational and Legal Records

Billing, tax, fraud-prevention, support, and security records are retained for the period reasonably necessary for those purposes and any applicable statutory limitation or record-keeping period. Analytics and cookie-related data follow the configured retention periods of the relevant service and are reviewed against the purpose for which they were collected. The local consent record stores the selected categories, policy version, and update time until you change your choices or clear browser storage.

E. Free Tool Ratings and Feedback

Free-tool ratings and short problem descriptions are retained for as long as reasonably needed to understand result quality, improve the Service, calculate aggregate ratings, and address abuse or disputes. We may delete or de-identify this data when it is no longer needed for those purposes.

8. Content Responsibilities

A. All Uploaded Content

You are responsible for the images, documents, fields, and other content you upload or submit to the Service, including through the API Platform. You must ensure you have all rights, permissions, notices, and legal bases required to process that content through FreeOCR.AI.

B. Direct API and Regulated Data

FreeOCR.AI is not designed or approved to process Special Category Data, protected health information, payment card data, or other regulated or highly sensitive data.

You must not submit Special Category Data, protected health information, payment card data, or other regulated or highly sensitive data through the direct API. If you submit such data despite this prohibition, you do so in breach of these terms and remain responsible, to the maximum extent permitted by law, for the lawfulness of that data and the consequences arising from your submission. This does not exclude liability that applicable law does not permit us to exclude.

9. Data Sharing and Disclosure

We may share information:

10. International Data Transfers

Service Data and other information may be processed in countries outside your own, including China, the United States, Malaysia, Indonesia, and EU/EEA locations, where data protection laws may differ. Although FreeOCR.AI is operated from China, direct API document payloads and outputs are not intentionally routed to or stored in China. Where required, transfers rely on applicable safeguards made available by our providers. Direct API customers subject to restricted-transfer requirements must complete any required customer-level transfer mechanism before submitting affected Personal Data, as described in the Data Processing Addendum. You may request information about applicable safeguards by emailingadmin@freeocr.ai.

11. Security

We implement reasonable technical and organizational measures to protect Personal Data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Your Rights and Choices

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or object to certain processing of your Personal Data, and to request portability where applicable.

To make a privacy request, contact us at admin@freeocr.ai. We may need to verify your identity before completing your request.

You may also withdraw consent where processing relies on consent and may lodge a complaint with the data-protection authority in your country or region. You have the right to object to processing based on legitimate interests and to direct marketing.

Use the Cookie Settings control in the site footer or Profile page to change analytics and affiliate-attribution choices. The three free OCR tools also display Google's separate privacy control for advertising choices.

If FreeOCR.AI processes your information only on behalf of an API customer, please direct your request to that customer. We will reasonably assist the customer in responding as required by law.

13. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect Personal Data from children under 13. If you believe a child has provided us Personal Data, please contact us and we will take appropriate steps.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date and provide additional notice when required.

If a change materially affects how we use Personal Data, we will provide additional notice where required. If a new use requires consent, we will request consent before relying on it.

15. Contact Us

If you have questions or requests related to this Privacy Policy, you can contact us: