What we store and where it goes.
Last updated 17 October 2026. Written to be read, not to be survived.
The short version
Linekeeper stores the supplier documents you send, the orders you enter, and your account. All of it stays in your account: never pooled with other accounts, sold, or used to train anything. The PDF goes to Anthropic's API to be read, and nowhere else. The one exception is an optional setting, off by default and covered below, that shares a supplier's layout notes anonymously, never prices or document contents. You can export or delete everything whenever you like.
What's collected
| Data | Why | Kept for |
|---|---|---|
| Email address and password hash | To let you sign in. Passwords are hashed with PBKDF2 and never stored or logged in readable form. | Life of the account |
| Supplier PDFs | They're the input. Kept so an extraction can always be checked against the original. | Life of the account |
| Extracted fields and match results | The product's output. | Life of the account |
| Orders and supplier profiles | What documents get matched against. | Life of the account |
| Connection credentials | An API token or OAuth login you supply to pull a catalogue or push a confirmed Bill. Encrypted before it's written down and never shown again. | Until you disconnect it |
| Where you first came from | The utm_ and ref tags on the link you arrived by, the linking site's domain, and the page you landed on. Kept in your browser and sent to us once, when you sign up, so we can see which of our outreach works. If you never sign up, nothing is sent. | Life of the account |
| Delivery counts | What someone counted out of the box for a confirmed document, line by line, with any note they added and who saved it. | Life of the account |
| Box labels | Which barcode on a box belongs to which of a supplier's items, linked by whoever counted the delivery. Camera scanning happens in your browser: no image or video is uploaded, stored, or sent. | Life of the account |
| Memory | Short notes about each supplier, written by Linekeeper from confirmed documents (a price above the agreed one, a short shipment, a correction) or by you. They stay in your workspace, you can edit or delete any of them, and they're never used to read a document. | Life of the account, or until you delete them |
| Webhook delivery log | When each confirmed document was sent to your webhook, the receiving host (not the full address), the result, and how long it took, so a failed delivery can be diagnosed. The document itself isn't copied. | Life of the account |
| Audit log | So you can see who did what in your workspace. | Life of the account |
| Abuse counters | Your IP address, and the email typed at sign-in, counted to slow down repeated sign-in, sign-up and password-reset attempts. | About an hour, then deleted |
| Session cookie | To keep you signed in. One cookie, no third-party trackers. | 30 days, extended on use |
Page views and load times are counted with Cloudflare Web Analytics, which sets no cookies and doesn't fingerprint visitors. There's no advertising pixel and no other third-party tag. One small script of ours keeps where you arrived from in your browser's local storage (not a cookie) until you sign up, and sends nothing on its own. Fonts are served from our own domain, so pages make no request to Google.
Who it's shared with
Three processors, plus anywhere you choose to send your own data:
- Cloudflare: hosting, the database, file storage, and the cookie-free page analytics above. Data sits in Cloudflare's network.
- Anthropic: the PDF and the reading instructions go to the Claude API. Anthropic doesn't train on API inputs. If you add your own API key in Settings, the call runs on your key and your own agreement with them.
- Stripe: billing, once you pick a plan or buy a pack. Stripe gets your email and workspace name, and you enter card details on Stripe's own pages, so they never reach Linekeeper. We keep a customer reference and a subscription status.
- Your own webhook, if you set one up: the confirmed record is posted to the URL you choose. That endpoint is yours.
- A system you connect: a purchasing or catalogue platform (Cin7 Core, Katana, Unleashed, Shopify and others), or an accounting system (Xero, QuickBooks, MYOB) that receives confirmed documents as Bills. Only the accounts you connect, and nothing is sent until you do.
Nothing is sold. Nothing is shared with advertisers. If a court order ever compelled disclosure, you'd be told unless the order forbade it.
Supplier note sharing (opt-in, off by default)
Settings lets you share one narrow thing: the layout notes you write for a supplier, like "totals are on page 2" or "unit price is in the second column." With sharing on, saving a note also writes it to a shared table keyed only by the supplier's normalized name. That row has no account identifier at all, so nobody, including us, can tell which account wrote it.
What you get: if another account has left a layout note for the same supplier, your first document from them can use it before you've written your own. What you give: your layout notes become available to other accounts the same way, for that supplier only.
Never shared, on or off: the documents themselves, extracted fields, prices, quantities, delivery dates, contact details, or the corrected examples used to improve later readings. Only layout note text, and only once you've turned sharing on.
Off is the default. Change it in Settings → Supplier note sharing. It applies to notes saved from then on, and adds or removes nothing already saved.
Where it's processed
Cloudflare runs the app at the edge, near you, and holds the database and file storage. Anthropic reads documents in the United States. If either is a problem where you are, don't send documents with regulated personal data. This tool is for purchase orders, not personnel files.
What's in your documents
Supplier documents are commercial: part numbers, quantities, prices, delivery dates and company contacts. That's what the product expects. Don't use it for health records, government IDs, card numbers, or other sensitive personal data. If any turns up in a document, it's stored and processed like the rest of the file, with no special handling.
Your data, your call
- Export: pull the whole account as JSON from settings, or
GET /api/account/export, at any time including while you're leaving. - Correction: every extracted field is editable in the app.
- Deletion: ask and the account and everything in it is deleted. Otherwise it's removed 90 days after an account closes.
- Access: ask what's held about you and you'll get it, in the export format above.
Security
Traffic is HTTPS only. Session cookies are HttpOnly, Secure and SameSite=Lax, and session tokens are stored hashed, so a copy of the database can't be used to sign in. Passwords use PBKDF2 with a per-user salt. Requests that change data must come from the site's own origin. Any Anthropic key you add is encrypted before it's stored and never sent back to the browser.
None of that makes a system unbreakable. If something goes wrong and your data is affected, you'll be told promptly and specifically: what happened, what was exposed, and what's being done.
Changes
If this page changes in a way that affects what's collected or who sees it, the date at the top moves and account holders get an email. Wording fixes won't get an email.
Contact
Questions about any of this, or a request to export or delete, go to the address on your invoice or through the app. A person reads them.