Legal
Privacy Policy
Effective 12 November 2026
This policy explains what personal data Decifox handles, why, and what you can do about it.
1. Who is responsible
Savo Efremovski, an individual trading as Decifox, based in North Macedonia, is responsible for personal data handled for your Decifox account. Contact: support@decifox.com.
North Macedonia
If your spreadsheets contain personal data about other people, you decide what to upload and why. You are responsible for having a lawful reason to do so and for telling those people where the law requires it.
2. What we collect
- Account: name, email address, whether your email is verified, your password in hashed form, and, if you use Google sign-in, your Google account identifier, name, email and picture link.
- Acceptance records: when you accepted, how (at sign-up or inside the app) and which version. One version covers our Terms, Privacy Policy and Refund Policy.
- Sign-in sessions: session records, including IP address and browser details.
- Spreadsheet content: the file you submit, the sheets you choose and your question, handled as described in section 3.
- Reports: the report, and the data it needs to work, which can include individual records from your sheets.
- Branding, if you add it: company name, logo and accent colour.
- Credits and analysis records: your Credit history, analysis status and timing, the analysis level you chose, the size of the data you selected (numbers of sheets, rows and columns), and technical usage figures such as the AI model and the amount of processing used. These records do not contain your spreadsheet content.
- Billing records, once purchases open: Paddle’s identifiers for you, your orders and subscriptions, plus product, amount, currency and status. We never receive your card details.
- Messages: what you send to support@decifox.com.
You give us most of this directly. Google provides sign-in details if you choose it, and Paddle will provide order details once purchases open. We need your email address and a sign-in method to provide an account.
3. How your spreadsheet is handled
- You open your file and choose sheets in your browser.
- When you start an analysis, the whole file is sent to our server, including sheets you did not choose. It is read in memory. We do not save the original file.
- Only the sheets you chose are kept for processing. They wait in a temporary queue, and are normally deleted when the analysis finishes, or shortly after it fails.
- Part of that data is sent to our AI provider for analysis (see section 5): the file name, sheet names, column headings, summary figures about each column, formula descriptions, your question, and a sample of rows from your chosen sheets. These rows are real data from your file. The request can be repeated if a first attempt fails checks.
- Decifox builds the report and saves it to your account.
Your question is not stored separately, but it can be reflected in the report.
4. Why we use your data
| Purpose | Legal basis |
|---|---|
| Providing your account, analyses, reports and Credits | Our contract with you |
| Sign-in, security and preventing abuse | Our legitimate interest in a safe service |
| Service emails such as verification and password reset | Our contract with you |
| Keeping proof of what you accepted | Our legitimate interest in showing what was agreed |
| Keeping financial and tax records | Legal obligation |
| Replying to you | Our contract with you, or our legitimate interest in helping you |
We do not sell your data, show advertising or send marketing email. We do not use your spreadsheets to train AI models. AI analyses your data to write your report; we do not use it to make decisions about you.
5. Who receives your data
| Provider | Why | Data |
|---|---|---|
| Anthropic | AI analysis | The content in section 3, step 4 |
| OpenAI | Alternative AI provider, used only if we move analysis to it | The content in section 3, step 4 |
| Paddle | Merchant of Record once purchases open: payment, tax, invoices, refunds | The details you give at checkout. See Paddle’s privacy policy |
| Resend | Sending account emails | Your email address and the message |
| Railway | Hosting our application, database and queue | All data we store |
| Optional sign-in, only if you choose it | Sign-in details |
Anthropic says it does not use data sent through its API to train its models by default, and that it deletes API inputs and outputs within 30 days, although it may keep content flagged for breaking its usage policy for up to 2 years. If we move analysis to OpenAI, our requests will ask it not to store responses for later use; OpenAI says it does not use API data to train its models unless a customer opts in, and that it may keep logs for up to 30 days to detect abuse. We may also share data if the law requires it, or to protect our rights in a dispute.
6. Where data is processed
Decifox is run from North Macedonia. Our hosting is in US East. Our providers may process data in other countries, including the United States. Where the law requires it, we rely on our providers’ transfer safeguards, such as standard contractual clauses.
7. How long we keep data
| Data | How long |
|---|---|
| Original spreadsheet file | Not saved |
| Selected sheet data in the queue | Normally deleted when the analysis finishes, or shortly after it fails |
| Reports | Until you delete them or your account is erased. Reports do not expire automatically |
| Account data | While your account exists. If an email address is never verified, the account and its records, including the acceptance record, may be deleted after 7 days |
| Sign-in sessions | A session expires after up to 7 days unless renewed by use. Expired session records, which include IP address and browser details, may stay in our database until we clear them |
| Acceptance records | While your account exists, and afterwards as long as needed to show what was agreed. If an email address is never verified, the record may be deleted with the account after 7 days |
| Credit and billing records | As long as needed for accounting, tax and dispute purposes, even after an account is erased |
| Support email | As long as needed to deal with your request |
Deleting a report. When you delete a report, it is permanently removed from our live database straight away. That covers the report, its data, its HTML file and the branding copy saved with it. We cannot bring it back. A record remains that an analysis ran and how many Credits it used, with none of the report’s content. Backups are used only to recover from a failure and are overwritten within 7 days, so a deleted report can remain in a backup until then. If processing fails just after a report is saved, a temporary copy of the spreadsheet data used for it can stay in our processing queue for a short time, normally no longer than 15 minutes.
Closing your account. To close your account and erase your data, email support@decifox.com from your account’s address. We will delete your reports, branding and sign-in details, and remove your name and email from what remains. We keep Credit and billing records without those details, because we must be able to account for payments. Cancel any subscription first. Backups clear as described above.
Data we have deleted can remain in backups for up to 7 days. Our hosting logs may record your IP address and the addresses (URLs) you request.
Downloaded reports are your files. We cannot delete copies you have saved or shared.
9. Security
Passwords are stored as hashes, sign-in tokens from Google are encrypted, and each saved report is checked against your account before it is shown. Decifox never runs macros or formulas from your files. No system is perfectly secure, so please treat your data and downloaded reports with care. If a breach puts your data at risk, we will tell you and the authorities where the law requires it. See our Security page.
10. Your rights
Depending on where you live, you can ask to see, correct, delete, restrict or receive a copy of your data, and can object to some uses. Email support@decifox.com from your account’s address. We will reply within one month. We may need to confirm who you are, and may keep what the law requires. You can also complain to your local data protection authority. In North Macedonia this is the Personal Data Protection Agency.
11. Children
Decifox is not for anyone under 18.
12. Changes
We will post any update here with a new date, and tell you in the app if a change is significant.