Data and privacy

This page says how long mdfi keeps a document, what leaves mdfi's servers, and what the connector uploads.

What mdfi keeps

For a document read through the connector or /v1/documents:

With your account, mdfi also keeps your email address, name, password (stored as a bcrypt hash) and subscription, until you ask for the account to be deleted (contact us); there is no self-service deletion yet. Your API keys (stored as SHA-256 hashes; the dashboard shows only their first characters) and the templates you save are kept until you delete them.

Deleting a document

DELETE /v1/documents/{id} deletes a document at once, with your API key (API). The connector has no tool for it. It removes the document's pages, outline and tables, and the record that recognises the file: afterwards the id answers 404, and reading the file again converts and charges it again.

A document deleted while it is still converting is charged for the work already done, and its result is not kept.

What leaves mdfi

Tier 1 and Tier 2 run on mdfi's servers. The parser and its OCR, layout and table models are installed on them, so no page is sent to another service to be read, and nothing is downloaded while a document converts.

For /v1/documents, Tier 3 is the only step that sends a page out, to the vision provider named under Service providers.

The vision provider is Google's Gemini API, used under its paid terms: Google does not use the pages it receives to train its models, but may keep them for a limited time to detect abuse, and may process them outside the EU.

The vision provider receives only the pages escalated to it, one page at a time: a one-page PDF cut from your file, or one frame of an image (an image file with a single frame is sent as it is). A page is escalated only if:

• it is a PDF or image page, never a page of a Word, PowerPoint, Excel, HTML, email or text file;
• it still scores under 85 after Tier 1, and after Tier 2 where that is tried;
• its cost still fits within the escalation cap and the pages you have left.

Escalation gives the full rules. The connector always allows all three tiers. To keep every page on mdfi's servers, upload through the API with max_tier=2 (Upload a document).

Other things that leave mdfi:

• The older endpoints (/convert, /jobs, /batches): their schema option sends the whole converted text of the file to the vision provider, or the provider the request names, to extract the template's fields. A webhook_url you give receives the job's result. A url you give makes mdfi fetch that web page.
• Payments go through Stripe. Stripe receives your email address, your name if you gave one and your mdfi account id, plus the payment details you enter on Stripe's own checkout page.
• Account emails (confirming your address, resetting your password, notices such as a new API key) are sent through Resend, which receives your email address and the message.

Where mdfi runs

mdfi's servers and document storage are in the EU: the servers run at Hetzner in Helsinki, Finland, and documents are stored in Cloudflare R2 in its EU jurisdiction, which keeps the stored data inside the EU.

Analytics

• The landing page at mdfi.ai counts visits with PostHog's EU service. PostHog is configured with in-memory persistence (persistence: "memory"), so it sets no cookies; it creates no visitor profiles and does not record sessions. It records page views and how visitors use the page, such as clicks, never what you type into the contact form.
• These docs pages load no scripts, so they run no analytics.
• The dashboard uses PostHog's EU service with in-memory persistence too, so it sets no cookies and stores nothing in your browser; each page load starts anonymous. When you are signed in, it links what you do to your account, with your email address, name, plan and whether your email is confirmed. The dashboard's server also records account events: signing up, in and out; confirming or changing your email; resetting or changing your password; creating (with its name), revoking and deleting API keys; creating (with its name) and deleting templates; plan changes; and errors. Session recording is off. Its styles, fonts and scripts are served by the dashboard itself.
• The connector and the API send no analytics.

What the connector uploads

• It reads only the file you name in read_document, after the checks under Which files it reads.
• It first sends only that file's SHA-256. It uploads the file, its contents and its name but not the folder it is in, only if your account does not have it yet.
• read_pages and export_table send only the document id and what you ask for. They read no files.
• It writes only the CSV and notes files that export_table is asked for, inside its working directory (Where CSVs are written).
• It sends requests only to MDFI_API_URL, with your API key, and it logs no document content.

Older endpoints

The 7-day rule above applies to /v1/documents. The older endpoints keep data differently:

• POST /convert keeps nothing but the usage record. The upload is deleted when the request ends, and the result is only in the answer.
• POST /jobs and POST /batches keep each job, with its result, for an hour after it finishes. The result is also stored as a file with no expiry date, and the uploaded file is not deleted when its conversion ends. DELETE /jobs/{id} (or DELETE /batches/{id} for every job of a batch) removes the job, its upload and its stored result, but only while the job still exists. After that hour, the job id answers 404, and its upload and stored result can no longer be deleted through the API.