Privacy Policy
This Privacy Policy explains how SanadGah collects, processes, stores, and protects organizational information and customer-submitted documents when providing Persian document processing and digitization services (including OCR, linguistic post-processing, field extraction, and structured output).
SanadGah operates as a data processor and fulfills its obligations in accordance with data protection principles, contractual requirements, and the data residency policies of the customer organization. This policy applies to enterprise customers across all deployment models (SaaS, private cloud, and On-Premise).
Table of Contents
12 sections- 1. Roles and Responsibilities
- 2. Data We Collect
- 3. Data We Do Not Collect
- 4. Processing Purposes
- 5. No Model Training on Customer Data
- 6. Data Processing Location
- 7. Encryption and Data Protection
- 8. Data Retention Policy
- 9. Customer Rights
- 10. Security Measures
- 11. Security Incident Response
- 12. Updates to This Policy
1. Roles and Responsibilities
SanadGah customers are considered data controllers and determine how documents are submitted, processed, retained, and deleted.
SanadGah, as a data processor, acts solely in accordance with the contract, the system configuration, and the customer's instructions.
Processing activities — such as OCR, linguistic post-processing, field extraction, JSON output generation, and result retention — are performed solely to deliver the system's requested capabilities.
In On-Premise deployment, processing is performed entirely within the customer organization's infrastructure, and SanadGah has no access to the data. In the SaaS model, processing is performed on SanadGah's domestic infrastructure in accordance with this policy.
2. Data We Collect
SanadGah collects only the data required to provide document processing services. This data includes:
- Customer-submitted documents (PDF, image) and the text extracted from them
- Document metadata and extracted fields
- Organizational account information and API keys
- Processing reports (submission time, status, completion time, errors)
- Access logs and security reports related to API usage
- Contact information and support correspondence
3. Data We Do Not Collect
- Plaintext passwords
- Personal data not required for service delivery
- Advertising or marketing profiling
- Customer information for sale to third parties
- User tracking outside of SanadGah's services
4. Processing Purposes
SanadGah processes data solely for the following purposes:
- Customer authentication via API key
- Document processing (OCR, linguistic post-processing, field extraction)
- Structured output generation and delivery via API and webhook
- Processing report logging and access traceability
- Technical support and error resolution
- Performance of contractual obligations
5. No Model Training on Customer Data
Customer-submitted data (documents, extracted text, processing output) is not used for model training, parameter tuning, service quality improvement, or the development of new capabilities.
This is a contractual commitment and data policy: SanadGah's OCR and linguistic post-processing models are trained on public data and proprietary datasets that have no connection to customer data.
This commitment is also explicitly stated in the enterprise contract, and its breach constitutes a breach of contractual obligation.
6. Data Processing Location
In On-Premise deployment, document processing is performed entirely within the customer organization's infrastructure, and data does not leave the organization's network.
In SaaS and private cloud deployment, processing is performed on domestic Iranian infrastructure, and documents are not sent to foreign cloud services.
This decision has been made deliberately to ensure compliance with the data residency and information governance requirements of Iranian organizations.
7. Encryption and Data Protection
SanadGah uses encryption in transit (TLS) and at rest (when stored) with industry-standard algorithms.
Access to data is restricted through API keys, access controls, and event logging.
API keys are issued dedicated per organization, carry defined scopes, and can be rotated, restricted, and revoked through the panel or management API.
8. Data Retention Policy
Retention of input and output documents is optional and configurable in accordance with the customer organization's policy: from automatic deletion immediately after processing to limited retention.
Processing reports and access logs are retained for a defined period to maintain transparency and accountability. The exact duration is defined in the enterprise contract.
Upon contract termination, full data export or deletion is available.
9. Customer Rights
- To receive a full export of data and processing reports
- To request deletion of documents and related outputs
- To manage and limit the data retention period
- To access the service's technical and security documentation
- To receive processing reports and access traceability
10. Security Measures
SanadGah uses a set of security controls:
- Data encryption in transit and at rest
- API key management with defined scopes and rotation capability
- Logging and traceability of processing activities and API access
- Service and processing resource monitoring
- Separation of the Orchestrator service and the OCR engine
- Code review and periodic security review
- Commitment to no model training on customer data
11. Security Incident Response
SanadGah follows a security incident management process. In the event of a security incident:
- Analysis and containment of the incident is initiated
- Affected customers are notified in accordance with contractual requirements
- A technical report and remediation measures are provided
- Preventive processes are implemented to avoid recurrence
12. Updates to This Policy
This policy may be updated in line with product capability development or legal changes. Material changes are communicated to customers before taking effect.
The most recent update to this policy is displayed on the "Privacy Policy" page.