Privacy Policy

This policy explains what personal data the xbrl2json service collects, why we collect it, who else handles it, how long we keep it and what your rights are. It is written for the UK GDPR and the Data Protection Act 2018. We don't currently target the EU; if you use the service from outside the UK, your data is still processed in the UK as described here.

---

1. Who we are

Rapid Agentic Development Ltd ("we", "us", "our") runs xbrl2json.com and is the controller of the personal data described here.

Controller	Rapid Agentic Development Ltd, registered in England and Wales
Company number	17458231
Registered address	181 Coniscliffe Road, Darlington, DL3 8DE
ICO registration	ZC248420
Privacy and data-rights requests	[email protected]
General enquiries	[email protected]
Company website	rapidagenticdevelopment.com

---

2. What we collect

Type of data	What it includes
Account details	Your email address and whether you have confirmed it; your display name (optional); your phone number, only if you add one; your password, stored only as a one-way hash; your role (customer or administrator); two-step sign-in settings if you turn them on; your account status (active or suspended, and why); when you joined and when you were last active; and a count of failed sign-ins, used to lock the account after repeated failures.
API keys	The name you give each key, its first few characters and a one-way hash of it (we never store the key itself). We also store when each key was created, last used, expires and was revoked.
Uploaded documents	The file itself, its original file name, any group label you add, its size, file type and a SHA-256 fingerprint, and the dates and status of its upload, virus scan and deletion.
Conversion results	The JSON produced from your document, which we store as a file, and a summary and an index of the facts extracted from it, which we store in our database.
Job history	A record of each conversion: when it was requested, started and finished, its status, any error message, whether it came from the website, the API or an AI assistant connected through our MCP endpoint, and any callback (webhook) URL you gave.
Usage	Monthly counts of uploads, conversions and API requests, and the storage you use. We use these to apply your plan's limits.
Subscription	Your Stripe customer ID, subscription ID and price ID; your plan; the subscription's status; the current billing period and any trial end date; whether a cancellation is scheduled and when it takes effect; when the subscription ended; and when we last checked it with Stripe. We never see or store card numbers.
Emails we send you	A log of each email: the recipient's address, the subject, the type of email, when it was sent and whether our mail server accepted it.
File-name lookups through the API	The file name you looked up, your user ID, the time and whether the lookup succeeded.
Contact form messages	Your name, email address, subject and message. These are emailed to our support inbox and are not stored in the service's database.
Technical and log data	Your IP address; your user ID and email address while you are signed in; the pages and API endpoints you request; errors; and, in web server logs, your browser's user-agent. Logs are written so that they don't include the content of your documents.

---

3. What happens to your documents

• Uploaded files and conversion results are stored on our application server, which IONOS hosts for us in the United Kingdom.
• Each upload is virus-scanned (with ClamAV) and converted (with Arelle) on a separate server that we run ourselves, also in the UK. Our servers talk to it over an encrypted private network, and it doesn't keep copies of your documents.
• No third party processes the content of your documents. Uploads reach us through Cloudflare's network (see section 5), which passes them on to us without storing them.
• We don't send your documents, or the data extracted from them, to any third-party AI service, and we don't use them to train AI models.
• Only our database is backed up. Your uploaded files and the JSON result files are not backed up, so once they are deleted from the application server they are gone. The summary and the facts index of a result are in the database, so they are in our database backups (see section 7).
• Your data leaves the service only where you send it: when you download it, use the API, set a callback URL, or connect your own AI assistant through our MCP endpoint. Once it reaches your own system or assistant, that provider's terms apply.

---

4. Why we use your data, and our lawful basis

Purpose	Lawful basis (UK GDPR)
Run your account, convert your files and keep your results	Contract
Manage your subscription and the plan it gives you	Contract
Send service emails (email confirmation, password resets, conversion results, billing notices)	Contract
Scan uploads for malware	Legitimate interests (keeping the service and other users safe)
Protect sign-in and forms from bots and abuse (Cloudflare Turnstile, rate limits, account lockout)	Legitimate interests (security)
Keep logs to run the service, fix faults and investigate misuse	Legitimate interests (security and reliability)
Answer messages sent through the contact form	Legitimate interests (responding to you)
Keep financial records	Legal obligation (UK company and tax law)

We don't sell your personal data, and we don't use it for advertising.

---

5. Who we share it with

We use these organisations to run the service:

Organisation	What they do	Data they handle	Where
IONOS Processor	Hosts our servers: the website and uploaded files, the database, and file scanning and conversion. Stores our off-site database backups, which we encrypt before upload.	Everything we store	Servers: United Kingdom. Off-site backups: Berlin, Germany.
Cloudflare Processor	Runs our DNS and encrypted connections (TLS), caches public files and protects the site from attacks. It also provides email forwarding for the support address. Its Turnstile check tells people from bots on our sign-up, sign-in, password-reset, resend-confirmation and contact forms.	IP addresses and the content of requests to the site, including uploads as they pass through. Emails sent to our support address, including contact form messages, as they are forwarded to our support inbox. For Turnstile, your IP address and signals from your browser, used only to tell people from bots. Turnstile sets no cookies.	Worldwide, including the US
Link, LLC (Link, Stripe's Managed Payments service) and Stripe Independent controllers	Link, LLC sells you your paid plan as the seller of record: it takes payment, works out, charges and accounts for VAT or sales tax, sends receipts and invoices, and handles payment questions and disputes. We provide the service itself. Stripe processes the payment, runs Checkout and the billing portal, and prevents fraud. Link, LLC, 354 Oyster Point Boulevard, South San Francisco, California 94080, United States. GB VAT number GB432218330.	From us: your email address, name, account ID and plan. Link and Stripe collect your card, billing and location details themselves.	UK, EU, US and elsewhere. See Link's privacy policy and Stripe's privacy policy.
Fasthosts Processor	Outgoing mail server; support mailbox; log server (Seq)	Your email address and the content of each email we send you; emails you send to our support address, including contact form messages; our logs (the technical and log data in section 2)	United Kingdom

Our central log server (Seq) runs on a server we rent from Fasthosts in the UK. We don't share our logs with any other third party.

We may also share data when the law requires it, for example with HMRC or in answer to a valid court order, and with our professional advisers, who must keep it confidential.

---

6. Transfers outside the UK

• Our off-site backups are in Germany. The UK recognises the European Economic Area as giving adequate protection to personal data.
• Cloudflare handles requests across its worldwide network, including in the US. Those transfers are covered by Cloudflare's data processing agreement, which includes the Standard Contractual Clauses with the UK International Data Transfer Addendum, and, where Cloudflare is certified, by the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework).
• Link and Stripe are responsible for their own transfers as independent controllers. Their privacy policies, linked above, explain the safeguards they use.

---

7. How long we keep your data

Data	How long we keep it
Uploaded files on the Free plan	Deleted as soon as the conversion succeeds, or straight away if the file fails the virus scan. If the conversion fails or is cancelled, the file is deleted 7 days after you uploaded it.
Uploaded files on a paid plan	Kept until you delete them while you have a paid plan. If your paid plan ends, the files you saved during it are deleted 90 days after it ended, unless you subscribe again before then.
Files you have deleted	Erased from our servers 30 days after you delete them.
Conversion results (JSON, summary and extracted facts)	Deleted automatically when your plan's result retention period ends: currently 1 day on Free, 30 days on Starter and 365 days on Pro (see the Help page). If your paid plan ends, the Free period applies, so older results are deleted.
Upload and conversion history (file names, group labels, sizes, fingerprints, dates, status, error messages) and monthly usage counts	2 years. A record is deleted 2 years after the upload, once its file and results have been deleted; a file you still keep on a paid plan keeps its record. Monthly usage counts are deleted 2 years after the month ends.
Account details and API key records	While your account is open. See section 8 for what happens when you delete it.
Subscription and payment records	6 years, to meet UK company and tax record-keeping rules. Link and Stripe keep their own records under their own policies.
Log of emails we've sent you; log of file-name lookups	12 months.
Emails to our support address, including contact form messages (in our support inbox at Fasthosts, in the UK)	2 years.
Application log files	7 days. A new file starts each day and the oldest is deleted.
Web server logs	14 days. A new file starts each day and the oldest is deleted.
Server system log (the systemd journal, which also receives the application's log output)	14 days.
Central log server (Seq)	14 days.
Database backups	Taken nightly. Kept for 14 days on the database server. An encrypted off-site copy is kept in IONOS's object storage in Berlin, Germany; it can't be deleted for the first 30 days and is deleted automatically after 90 days. Only the database is backed up: uploaded files and JSON result files are not.

Backups: data you delete from the live service can stay in our database backups for up to 90 days, and is then deleted. We use backups only to restore the service after a failure, never for anything else.

---

8. Deleting your account

You can delete your account at any time from Account → Personal data. When you do:

• you are signed out and can't sign in again;
• any paid subscription is cancelled at once (our Terms explain refunds);
• your API keys are revoked;
• your uploaded files are marked as deleted and erased from our servers 30 days later;
• your conversion results are erased by our automatic cleanup, usually within a day.

Deleting your account deactivates it, but doesn't yet erase everything. To have the rest of your personal data erased, including your account record (email address, display name, phone number if given, and password hash), email [email protected]. We will delete or anonymise it within one month. We keep subscription and payment records for 6 years, as UK company and tax rules require, and copies in our backups expire within 90 days.

---

9. Cookies

We only use cookies that the site needs to work or to stay secure. We don't use analytics, advertising or tracking cookies, and we don't store anything else in your browser. Cloudflare Turnstile, the bot check on some of our forms, sets no cookies.

Cookie	Set by	What it's for	How long	Strictly necessary?
.Xbrl2Json.Identity	Us	Keeps you signed in	Until 30 minutes after your last activity	Yes
.AspNetCore.Antiforgery.*	Us	Protects forms against cross-site request forgery	Until you close your browser	Yes
.AspNetCore.Mvc.CookieTempDataProvider	Us	Carries a one-off message, such as "message sent", to the next page	Removed once the message is shown	Yes
Identity.TwoFactorUserId	Us	Remembers who is signing in between the password and two-step code steps	5 minutes	Yes (only if you use two-step sign-in)
Identity.TwoFactorRememberMe	Us	Skips the two-step code on this device, if you tick "Remember this machine"	14 days	Yes (only if you ask for it)
.Xbrl2Json.Session	Us	Asks administrators to re-enter their password before admin pages open	Until 30 minutes of inactivity, or until you close your browser	Yes (administrators only)
Link and Stripe cookies	Link and Stripe	Payment security and fraud prevention. These are set on Link's and Stripe's own pages (Checkout, the billing portal and link.com), not on xbrl2json.com.	See Stripe's cookie policy	Their responsibility

Because all of our cookies are strictly necessary, we don't ask for consent. If you block them in your browser, signing in and submitting forms won't work.

---

10. Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• erase your data;
• restrict or object to how we use it, including where we rely on legitimate interests;
• data portability: get your data in a structured, machine-readable format.

How to use them

• In your account: correct your display name or phone number on the Profile page, and change your email address on the Email page. Personal data lets you download a JSON file of your account details, upload and conversion history, API key details and subscription details, or delete your account. You can download your files and results from My Files and My Conversions.
• By email: write to [email protected]. We may need to confirm your identity first.
• Payment data: Link and Stripe hold your payment details as independent controllers, so ask them directly, for example at link.com. If you ask Link to delete your payment data, your subscription is cancelled.

We reply within one month. If a request is complex we can extend that by up to two more months, and we will tell you within the first month if we need to. There is normally no charge.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint. We'd appreciate the chance to put things right first, so please contact us before going to the ICO.

---

11. How we protect your data

• Every connection to the site is encrypted with TLS.
• Our servers talk to each other over an encrypted private network, and the database accepts only encrypted connections.
• Off-site backups are encrypted.
• Every upload is virus-scanned before it is processed. Infected files are rejected and deleted.
• Passwords and API keys are stored only as one-way hashes. Two-step sign-in is available, and accounts lock after repeated failed sign-ins.
• Each account can reach only its own files, results and API keys.
• Passwords and keys for our systems are kept in industry-standard secrets management, never in source code.
• Each part of the service runs with only the permissions it needs.

---

12. Children

The service is not meant for anyone under 16, and we don't knowingly collect their data. If you think we have, email [email protected] and we will delete it.

---

13. Changes to this policy

If we make an important change, we'll email account holders and post a notice on the site before it takes effect. The date at the top of this page shows when the policy last changed.

---

14. Contact us

For questions about this policy or your data, email [email protected]. For help with the service itself, use the Contact Us page.