NORTHKIT VENTURES / PRIVACY BY DEFAULT

Your invoices stay
on your device.

Autum8 and Autum8 Ready are owned and operated by Northkit Ventures (Poole, Dorset, BH15, United Kingdom · legal@autum8.co). Default browser workflows process invoice and source contents locally. Cloud sync is off and is not offered in this release.

Updated 21 October 2026. This notice describes the data handling across our local browser tools and minimal account/billing endpoints.

The document path

Selected file → browser memory → local parsing / worker checks
                              → readable result → local download

What leaves your browser?

The site downloads HTML, fonts, scripts, styles, known static standards packages and public recipient freshness metadata. Some packages load only when you start a tool. These requests contain no invoice contents, filenames, parties, amounts, VAT IDs, PO values or bank details. Application routes contain no third-party analytics, advertising pixels, session replay, heatmaps or remarketing scripts. No telemetry sender is installed; the metadata-only event schema rejects unexpected properties.

The validation worker disables fetch and XMLHttpRequest after startup. XSD imports resolve only against bundled, allowlisted resources; document-provided URLs are not fetched. Same-origin account and checkout requests are explicit, separate actions and contain no invoice/source data.

Storage and clearing

Invoices, source rows and repair snapshots remain in browser memory until cleared or the tab closes. Explicitly saved mappings, recipient/order profiles, client labels and report preferences use IndexedDB on your device. Recipient profiles can contain business identifiers and customer/order values you choose to save. They are not encrypted by Autum8; use a trusted device and operating-system disk protection. Local workflow export files contain saved profile values; protect them like other business records.

Daily local activity counts retain only tool ID, UTC date and count for up to 31 days. No document-derived values accompany those counts and no local activity is sent to analytics. Paid access tokens and your private purchase credential can be saved in localStorage. These are access credentials, not invoices.

Delete saved profiles through the tools. Use “Clear files” or close the tab to release document state, and clear site data to remove local settings and credentials. Downloaded files remain on your device. Local storage is not cloud sync.

Untrusted input and cancellation

DTD and entity declarations are rejected. XML is limited to 5 MB, 50,000 elements and 64 nesting levels. PDFs are limited to 20 MB, with a 15-second extraction timeout. Validation workers time out after 30 seconds. ZIPs have bounded entries and expansion; loose batch files load one at a time. Cancel stops the current work and prevents late results from replacing a newer run. Invoice strings render as text.

Inspect it yourself

Open the Network panel, then select a synthetic file. You may see same-origin GET requests for static packages, but no invoice-derived URL or request body. For offline processing, the packages needed by your selected tool must already be loaded. Durable offline installation is not provided.

Optional self-hosted API

The developer API is a separate, explicit local/server workflow. A client sends a document to the server they choose, with bearer authentication. The bundled server binds to localhost, processes requests in isolated bounded workers and does not log request bodies or document-derived errors. It is not a public Autum8 service.

Account, website and payment data

Cloudflare receives ordinary hosting request metadata such as IP addresses. Cloudflare Workers and D1 are the selected account/billing stack; the prepared staging database is in eastern North America. This is not an EU-residency or compliance claim. When you explicitly open checkout on the separate payment page, Paddle.js and Paddle's payment frame receive the information needed for billing, including payment and contact details. Invoice-processing routes never load Paddle or third-party analytics scripts.

The Autum8 account store holds a pseudonymous purchase ID, a hash of your private credential, selected plan, signed access period, Paddle transaction/customer/subscription IDs, payment status and minimal event metadata. It excludes invoice contents and saved recipient values. Temporary authenticated Paddle portal links are created on demand, returned with no-store and never saved by Autum8.

Providing paid access uses account/contract data; legally required payment bookkeeping uses the applicable legal obligation. Cloudflare provides edge hosting and D1 storage, and Paddle acts as Merchant of Record for payment processing. The separate analytics product's scripts are not included in this invoice application.

Export, deletion and retention

Account controls provide access-data export and a deletion request authenticated by your private purchase credential. Deletion disables server-side access immediately and removes Autum8 account/grant/provider-binding data within 30 days through the maintenance job. Billing-event IDs retain for 90 days for replay/reconciliation protection. Paddle records have separate legal retention. Deleting Autum8 account data does not cancel a Paddle subscription; use “Manage billing in Paddle” to cancel first. Your locally saved credential can still open billing management during the deletion window. Downloaded/offline tokens expire according to their signed period; already downloaded access cannot be revoked instantly. Local invoices, profiles and credentials are cleared separately on your device.

For privacy inquiries, data access, rectification, erasure, restriction, objection or portability requests, contact Northkit Ventures at legal@autum8.co (Correspondence: Poole, Dorset, BH15, United Kingdom), or use the self-service export and deletion tools on /account/.