Privacy Policy

Overview

This Privacy Policy explains how OverDeduct (“we,” “us”) collects, uses, and protects information when you use our website and Services. We aim to collect as little as possible, to be explicit about how your most sensitive data — your remittance files and supporting documents — is handled, and to give you control over it, including deletion on request.

How the free analyzer handles your file

When you use the free deduction analyzer, the remittance file you upload is transmitted over an encrypted (HTTPS) connection to our servers, where it is parsed and run through our classification engine to produce your estimate. To power the analyzer's features — showing your results again, re-mapping columns, and verifying individual lines — we store the results of that analysis (such as the file name, detected distributor, deduction totals, and the individual flagged line items) against an anonymous session identifier. We also keep the remittance file itself, on the same retention schedule as the analysis, so we can re-read the original if your results look wrong and so our team can diagnose formats our parser reads incorrectly. You do not need an account to do this.

We keep your analysis, the remittance file it came from, and any documents you attach so you can return to your results, re-run or re-map them, and so we can keep improving how our parser reads each distributor's format. If you create an account, that history stays with your account. Either way, we never sell your data, we don't share your files or documents with anyone except the service providers needed to deliver the Services, and you can ask us to delete your data at any time — with or without an account — as described under “Your choices and rights” below.

Your workspace, the cookie, and the email link

The analyzer reads KeHE and UNFI files. Each file you upload goes into a workspace: the place your deductions, deadlines, verdicts and letters live. Without an account, it is a guest workspace tied to an anonymous session cookie in your browser. Each visit renews that cookie for the longest period browsers allow (about 400 days), so you can come back to your workspace.

You can also ask for an email link to your workspace. We then store the email address you give with the workspace, and send a link that opens it in another browser once, within 30 days. We keep only a hashed form of the link's secret. If you lose the cookie and have neither a link nor an account, we cannot tell which workspace is yours, so we cannot open it for you.

If you create an account, your guest workspace becomes your account's workspace. Nothing in it moves or is lost. A sample workspace with fictional data is available to explore. Opening it sets a cookie for one day that only chooses which workspace to show.

Automatic column matching

Distributor exports vary widely. If our own logic can't work out which column holds the deducted amount, we ask a third-party AI provider (the same one described below) to identify it. To do that we send a statistical description of each column — how often it contains a number, how often that number is negative, its rough order of magnitude, and a few text samples with every digit replaced by “#”. We do not send your deduction amounts, invoice numbers, PO numbers, or any other line-item content for this step, and it only runs when the automatic detection has failed.

Line-item verification and AI processing

Some steps send content to a third-party AI provider (OpenRouter, which routes to models such as DeepSeek and Google Gemini) solely to produce the result for you:

• Reading what a document is. We send the document's text with every digit replaced by “#”, so no amounts or numbers are sent for this step.
• Reading a PDF our own parser can't read cleanly. We send the document's text, including its amounts, so the model can list the deduction lines. We check what comes back against the document's own totals.
• Verifying a deduction. When you upload a supporting document (an invoice, proof of delivery, or backup, as a PDF or image) to verify a line, we send its text, or the image itself when there is no text to read, with the details of that charge.
• Reading a KeHE UDR in the free UDR tool, including a photo of one, read by a vision model. The UDR tool does not store the file.
• Drafting a dispute letter from the charge, your evidence, and your company details.

We do not use your files or documents to train models. Model use is limited each day per workspace, per visitor and overall. When a limit is reached, files are read by our own rules instead, and checks wait until the next day. We record each AI request, and what came back, in the activity log you can see in your workspace. For reading a PDF's lines, the log keeps the request's size and a fingerprint (a hash) instead of its content.

Automated processing and AI

Some features use automated systems and a third-party AI provider to produce analyses, assess documents, and draft dispute letters. These features assist you — they do not make legal, financial, or final decisions for you, and you remain responsible for reviewing and acting on the output. See our terms of service for more on AI-generated output.

Improving our Services and aggregated data

We may use the data and documents you provide to operate, maintain, protect, improve, and develop our Services — including improving how our systems read, categorize, and estimate recoveries from distributor and retailer remittances. We may also create aggregated or de-identified information that does not identify you, and use it for any purpose, including benchmarking, research, and promoting the Services. This is separate from the third-party AI provider described above, which does not train its models on your documents. We never sell your personal information.

Payments and billing (Stripe)

When you subscribe to a paid self-serve plan, payments are processed by Stripe, our payment processor. Your full card number and security code are entered on Stripe's secure checkout and are handled by Stripe — we never receive or store your full card details. To manage your subscription we store and process limited billing information: your account email, a Stripe customer and subscription identifier, your plan, and your subscription status and renewal date. Stripe may also collect your name, billing address, and payment details and processes them as an independent controller under its own privacy policy. We use this information to provide the subscription you purchased, send billing-related emails, prevent fraud, and meet our legal and accounting obligations. For customers in the EU/UK, our legal basis for this processing is performance of the contract with you (and our legitimate interest in fraud prevention and record-keeping); Stripe may transfer data internationally under appropriate safeguards.

Information we collect

• Information you give us. If you create an account, request done-for-you recovery, or contact us, we collect details such as your name, work email, company, and the substance of your message.
• Usage and device data. Like most websites, we may collect standard analytics — pages viewed, referring source, approximate location, browser and device type — to understand what's useful and improve the site.
• Data you submit to paid Services. If you use paid software or engage our recovery services, you may provide deduction data and supporting documents so we can perform the Services. This is used to deliver the Services you asked for.
• Billing information. If you subscribe, we and our payment processor (Stripe) collect the information needed to bill you — see “Payments and billing” above. We do not store full card numbers.

How we use information

• To provide, maintain, and improve the Services.
• To respond to your inquiries and provide support.
• To send account, transactional, and (where you've agreed) product or deadline-reminder emails.
• To detect, prevent, and address security or technical issues.
• To reference the organizations we work with, and their brands, in materials describing our Services.
• To comply with legal obligations.

Service providers and sub-processors

We use a small set of trusted providers to run the business. They process data only to perform services for us and are bound by confidentiality obligations. We do not sell your personal information, and we do not share your remittance data or documents with anyone except as needed to deliver the Services you ask for.

• Stripe — payment processing for paid subscriptions.
• OpenRouter — the third-party AI provider used for optional column matching, document verification, and dispute-letter drafting.
• Resend — delivery of account, billing and reminder emails, workspace links, and UDR response drafts you choose to email to yourself.
• Hosting and infrastructure — the servers that run the Services and store your data.

Some of these providers operate outside Canada, so your information may be processed in other countries, including the United States, under contractual and other appropriate safeguards.

Cookies

We use a first-party session cookie that keeps you signed in or holds your guest workspace, renewed on each visit (see “Your workspace” above), and a one-day cookie when you open the sample workspace. We may also use cookies or similar technologies for analytics. You can control cookies through your browser settings. If you block them, the analyzer still shows your results, but it can't keep a workspace for you.

Data retention

We keep a guest workspace, with its uploaded files, documents, analyses and letters, until you delete it or ask us to. You can delete it yourself with “Delete this workspace” in the workspace. If you have an account, we keep your workspace and account data for the life of your relationship with us and a reasonable period afterward, and you can delete your account from Settings. You can ask us to delete your data at any time, with or without an account (see below). We will delete it except where we must keep it to meet a legal obligation. A record that a deletion happened (counts, not content) is kept for our audit trail. Contact details you gave us as a lead (for example, asking to be notified about a feature) are business records and are kept separately.

Your choices and rights

You may request access to, correction of, or deletion of your personal information, and you can unsubscribe from marketing emails at any time using the link in those emails. To make a request, contact us. Depending on where you live, you may have additional rights under applicable privacy laws.

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If you have a privacy concern we cannot resolve, you have the right to contact the Office of the Privacy Commissioner of Canada.

Security

We use reasonable technical and organizational measures to protect information: your uploads are transmitted over an encrypted (HTTPS) connection, the free analyzer requires no account, and we never sell your data. No method of transmission or storage is completely secure, but we collect as little as we can and give you control over what we keep, including deletion on request. See our security page for more.

Children's privacy

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date above.

Contact

Questions about your privacy or this policy? Contact us. See also our terms of service.