Privacy Policy

Overview

This Privacy Policy explains how OverDeduct (“we,” “us”) collects, uses, and protects information when you use our website and Services. We aim to collect as little as possible, to be explicit about how your most sensitive data — your remittance files and supporting documents — is handled, and to delete it when it's no longer needed.

How the free analyzer handles your file

When you use the free deduction analyzer, the remittance file you upload is transmitted over an encrypted (HTTPS) connection to our servers, where it is parsed and run through our classification engine to produce your estimate. To power the analyzer's features — showing your results again, re-mapping columns, and verifying individual lines — we store the results of that analysis (such as the file name, detected distributor, deduction totals, and the individual flagged line items) against an anonymous session identifier. We also keep the remittance file itself, on the same retention schedule as the analysis, so we can re-read the original if your results look wrong and so our team can diagnose formats our parser reads incorrectly. You do not need an account to do this.

We do not require you to hand over your data permanently to try the tool. Anonymous analyses, the remittance files they came from, and any documents attached to them are automatically deleted after 30 days. If you create an account, your analyses are kept so you can return to them, and are deleted when you ask us to delete them or close your account.

Automatic column matching

Distributor exports vary widely. If our own logic can't work out which column holds the deducted amount, we ask a third-party AI provider (the same one described below) to identify it. To do that we send a statistical description of each column — how often it contains a number, how often that number is negative, its rough order of magnitude, and a few text samples with every digit replaced by “#”. We do not send your deduction amounts, invoice numbers, PO numbers, or any other line-item content for this step, and it only runs when the automatic detection has failed.

Line-item verification and AI processing

If you choose to verify a specific flagged line, you can upload the supporting document (for example, an invoice or backup PDF or image). That document is stored on our servers and attached to your analysis. To read it and judge the charge, we extract its text and send that content to a third-party AI provider (OpenRouter, which routes to models such as DeepSeek and Google Gemini) solely to generate the verdict for you. We do not use your documents to train models, and — like your analysis — anonymous documents are deleted after 30 days. This step is optional and only happens when you upload a document to verify a line.

Payments and billing (Stripe)

When you subscribe to a paid self-serve plan, payments are processed by Stripe, our payment processor. Your full card number and security code are entered on Stripe's secure checkout and are handled by Stripe — we never receive or store your full card details. To manage your subscription we store and process limited billing information: your account email, a Stripe customer and subscription identifier, your plan, and your subscription status and renewal date. Stripe may also collect your name, billing address, and payment details and processes them as an independent controller under its own privacy policy. We use this information to provide the subscription you purchased, send billing-related emails, prevent fraud, and meet our legal and accounting obligations. For customers in the EU/UK, our legal basis for this processing is performance of the contract with you (and our legitimate interest in fraud prevention and record-keeping); Stripe may transfer data internationally under appropriate safeguards.

Information we collect

• Information you give us. If you create an account, request done-for-you recovery, or contact us, we collect details such as your name, work email, company, and the substance of your message.
• Usage and device data. Like most websites, we may collect standard analytics — pages viewed, referring source, approximate location, browser and device type — to understand what's useful and improve the site.
• Data you submit to paid Services. If you use paid software or engage our recovery services, you may provide deduction data and supporting documents so we can perform the Services. This is used to deliver the Services you asked for.
• Billing information. If you subscribe, we and our payment processor (Stripe) collect the information needed to bill you — see “Payments and billing” above. We do not store full card numbers.

How we use information

• To provide, maintain, and improve the Services.
• To respond to your inquiries and provide support.
• To send account, transactional, and (where you've agreed) product or deadline-reminder emails.
• To detect, prevent, and address security or technical issues.
• To comply with legal obligations.

Service providers

We use trusted third parties to run the business — for example, website hosting, email delivery, payment processing (Stripe), and the AI provider used for optional document verification described above. These providers process data only to perform services for us and are bound by confidentiality obligations. We do not sell your personal information, and we do not share your remittance data or documents with anyone except as needed to deliver the Services you ask for.

Cookies

We may use cookies or similar technologies for essential site function and analytics. You can control cookies through your browser settings; disabling some may affect site functionality.

Data retention

Analyses, uploaded remittance files, and documents you create without an account are automatically deleted after 30 days. If you create an account, we keep your analyses and account data for the life of your relationship with us and a reasonable period afterward, then delete or anonymize it. You can ask us to delete your data at any time (see below).

Your choices and rights

You may request access to, correction of, or deletion of your personal information, and you can unsubscribe from marketing emails at any time using the link in those emails. To make a request, contact us. Depending on where you live, you may have additional rights under applicable privacy laws.

Security

We use reasonable technical and organizational measures to protect information: your uploads are transmitted over an encrypted (HTTPS) connection, the free analyzer requires no account, and anonymous data is deleted on a 30-day schedule to limit how long it exists. No method of transmission or storage is completely secure, but we collect and keep as little as we can for as short a time as we can. See our security page for more.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date above.

Contact

Questions about your privacy or this policy? Contact us. See also our terms of service.