Privacy
What we store and where it goes.
Last updated 7 September 2026. Written to be read, not to be survived.
The short version
Linekeeper stores the supplier documents you send it, the orders you enter, and the account you sign in with. Documents are scoped to your account and are never pooled, shared, or used to train anything. The PDF goes to Anthropic's API to be read, and nowhere else. You can export everything or have it deleted whenever you like.
What's collected
| Data | Why | Kept for |
|---|---|---|
| Email address and password hash | To let you sign in. Passwords are hashed with PBKDF2 and never stored or logged in readable form. | Life of the account |
| Supplier PDFs | They're the input. Kept so an extraction can always be checked against the original. | Life of the account |
| Extracted fields and match results | The product's output. | Life of the account |
| Orders and supplier profiles | What documents get matched against. | Life of the account |
| Audit log | So you can see who did what in your workspace. | Life of the account |
| Session cookie | To keep you signed in. One cookie, no third-party trackers. | 30 days, extended on use |
There is no analytics script, no advertising pixel, and no third-party tag on this site or in the app. Fonts are served by Google Fonts, which means your browser makes a request to fonts.gstatic.com when a page loads.
Who it's shared with
Three processors, and no one else:
- Cloudflare — hosting, the database, and file storage. Data sits in Cloudflare's network.
- Anthropic — the PDF and the extraction prompt are sent to the Claude API to be read. Anthropic does not train on API inputs. If you add your own API key in settings, the call runs on your key and your agreement with them instead of ours.
- Your own webhook — if you configure one, the confirmed payload is posted to the URL you nominate. That's your endpoint and your responsibility.
Nothing is sold. Nothing is shared with advertisers. If a court order ever compelled disclosure, you'd be told unless the order forbade it.
Where it's processed
Cloudflare runs the application at the edge, so requests are served near you, and the database and object storage sit in Cloudflare's infrastructure. Anthropic processes extraction requests in the United States. If either of those is a problem for your jurisdiction, don't send documents containing regulated personal data — this tool is built for purchase orders, not personnel files.
What's in your documents
Supplier confirmations are commercial documents: part numbers, quantities, prices, delivery dates, and company contact details. That's what the product expects. It is not designed for, and should not be used to process, health records, government identifiers, payment card numbers, or anything else you'd class as sensitive personal data. If such data appears in a document you send, it's stored and processed exactly like the rest of the file, with no special handling.
Your data, your call
- Export — pull the whole account as JSON from settings, or
GET /api/account/export, at any time including while you're leaving. - Correction — every extracted field is editable in the app.
- Deletion — ask and the account and everything in it is deleted. Otherwise it's removed 90 days after an account closes.
- Access — ask what's held about you and you'll get it, in the export format above.
Security
Traffic is HTTPS only. Session cookies are HttpOnly, Secure, and SameSite=Lax, and the token is stored hashed so a database copy alone can't be replayed. Passwords are PBKDF2 with a per-user salt. Requests that change data are checked against the site's own origin. Any Anthropic key you supply is encrypted before it's written down, and is never returned to the browser once saved.
None of that makes a system unbreakable. If something goes wrong and your data is affected, you'll be told promptly and specifically — what happened, what was exposed, and what's being done.
Changes
If this page changes in a way that affects what's collected or who sees it, the date at the top moves and account holders get an email. Wording fixes won't get an email.
Contact
Questions about any of this, or a request to export or delete, go to the address on your invoice or through the app. A person reads them.