Privacy Policy
Last updated: 27 August 2026
AeroSpark.ai, Inc., a Washington corporation, operates HiddenContent, an API service that analyses documents for hidden or concealed content. This policy explains what we collect, why, how long we keep it, and how to get it back or get rid of it.
HiddenContent is a service for businesses. It is not intended for personal or household use, and it is not directed to anyone under 18.
The short version
- We don't keep your documents. No whole-document content is stored at rest, and raw uploads are swept within 24 hours.
- We do keep short excerpts of what we find: a finding isn't useful without showing you the concealed text it found. Excerpts are capped (currently 500 characters each) and live in your analysis reports, which you can delete.
- Certificates contain no document content at all: only hashes, verdicts and metadata. A certificate can never reveal what a document said.
- No large language model runs anywhere in this service. Your documents are not sent to any third-party AI provider, and nothing here trains on them.
- You can export everything we hold on your account, or delete the account, from the API at any time.
The rest of this policy is the detail behind those five sentences.
What we collect
Account information. Your account identifier, and, if you sign up with GitHub, your GitHub user ID, the display name or company GitHub shares, and the email address on your GitHub account if one is shared. Our administrative audit log additionally records, at sign-up, your GitHub username, the age of the GitHub account, and its public repository count: the signals we use against sign-up abuse. If you sign up by email, we store the email address and name you give us. API keys are stored only as hashes; we cannot recover a key for you, only issue a new one.
Documents you submit for analysis. Submitted documents are processed to produce an analysis result.
What we do not keep at rest: whole document text, cleaned versions of your file, and page images. None of these are stored. Raw uploaded bytes are held briefly in a processing spool for asynchronous jobs and swept within 24 hours.
What we do keep: the analysis record. Alongside the findings themselves (what type of concealment, where, and how confident we are), each finding includes a short excerpt of the concealed content we found, capped (currently at 500 characters per excerpt). We keep it because a finding you cannot see is not much of a finding: the excerpt is what lets you judge whether what we found matters.
An excerpt is document content, a bounded amount of it. We would rather say that plainly than let "we don't store your documents" do work it cannot honestly do.
Analysis records also carry any reference you send with the request (externalRef), so you can match our results to your own records.
Messages you send us. If you use the contact form on our website, we keep the email address and message you submit so a person can reply. These are not linked to an account; to have one removed, email [email protected].
Usage and billing records. Pages analysed, timestamps, and the credit ledger entries behind them (including, for purchases made in a non-USD currency, the amount and currency you actually paid, which we need to compute refunds correctly). We need these records to bill accurately, to show you your own usage, and as evidence if a charge is ever disputed.
Payment information. Payments are processed by Stripe on their hosted page. We do not receive or store your card details. We hold the transaction records Stripe returns to us.
How you found us. When you arrive at our site through a tagged link or from another website, the site remembers that one channel tag for the duration of your visit (in your browser's session storage: no cookie, no identifier) and attaches it to your signup or contact request as its source. That is the whole mechanism: we do not track you, and there is nothing to opt out of beyond not signing up.
Website analytics. This marketing site uses Google Analytics 4, loaded through Google Tag Manager, and only after you accept. Until you choose Accept on the consent notice, nothing from Google loads: no script runs, no cookie is set, and no request leaves your browser for Google. Declining leaves the site fully functional. If your browser sends a Global Privacy Control signal we treat it as a refusal: you will not see the notice, and nothing loads. Accepting sets two cookies, _ga and _ga_XTBGD5YFJ8, used to count visits and see which pages people read; they are not used to identify you and nothing goes to advertisers. This applies to the marketing site only; api.hiddencontent.ai does not pass through Google.
Technical and error data. We record request identifiers, timing, and error events to operate the service.
Why we collect it
- To provide the service: analysing what you submit and returning a result.
- To bill you: metering pages against your prepaid balance.
- To keep certificates verifiable: a certificate is only worth something if it still verifies later, which requires us to retain what proves it.
- To keep the service working and secure: rate limits, abuse prevention, error diagnosis.
- To improve the product: from aggregate usage patterns, not from your document content.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
Who else touches your data
Our sub-processors:
| Provider | What they do | What they see |
|---|---|---|
| Railway | Application and database hosting, and managed database backups | Data at rest, in our database and its backups |
| Stripe | Payment processing | Your payment and billing details |
| GitHub | Authentication (device flow) | Your GitHub identity at sign-in |
| Cloudflare | DNS | Domain-name lookups only; API traffic does not pass through Cloudflare |
| Website analytics (Analytics 4 and Tag Manager) | Pages visited on the marketing site and a randomly generated cookie identifier, only for visitors who accept |
We publish this list and will update it when it changes.
How long we keep it
| What | Kept for |
|---|---|
| Whole document text, cleaned files, page images | Never stored at rest |
| Raw uploaded bytes (async job spool) | Swept within 24 hours |
| Analysis records, including the bounded excerpts inside them | Until you delete the records or close your account |
| Contact-form messages | Until handled; removed on request |
| Usage and billing records | Retained after account deletion, minimised to units and timestamps with document hashes removed, for up to seven years in line with US tax record-keeping requirements |
| API key hashes | Retained after revocation, so past activity remains attributable |
| Certificates | Retained indefinitely so they keep verifying; they contain hashes and metadata only, never document content |
| Backups | Deletions age out of backups within three months, the longest-retained layer (monthly snapshots, kept 3 months; daily and weekly layers and the point-in-time archive all age out sooner) |
Your rights and how to use them
You do not need to email us or fill in a form. Both of these are in the API:
- Export everything we hold on your account:
GET /v1/account/export - Delete your account:
DELETE /v1/account
Deletion removes your analysis records in full, including every excerpt inside them, along with your jobs. It revokes every API key, minimises your usage records to the units and timestamps we need as billing evidence with document hashes removed, and anonymises your account row.
Two things survive deletion, deliberately. Certificates issued before you deleted your account keep verifying; otherwise deleting an account would silently invalidate work you or your customers already relied on. Because certificates hold only hashes and metadata, they cannot reveal anything about what your documents contained. And minimised billing records remain for the retention period above, because we are required to keep them.
Contact-form messages are separate from accounts and are not part of the export; email [email protected] to have yours removed.
Depending on where you live you may have additional rights: to know what we hold, to correct it, to delete it, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising them. The export and delete endpoints above satisfy most of these directly. For anything else, contact us at [email protected] and we will respond within 45 days.
Security
API keys are stored as hashes and never in plaintext. Traffic is encrypted in transit with HTTPS and HSTS. Database backups are managed by our hosting provider and can briefly include uploads still in the 24-hour processing spool; they age out on the backup schedule above. Access to production is limited to the people who need it.
No service is perfectly secure, and we will not pretend otherwise.
International users
We are a US company and our infrastructure (application, database, and backups) runs in the United States. If you use the service from elsewhere, your data is processed in the US.
Changes
We will post changes here and update the date at the top. For material changes we will provide notice on the website before the change takes effect.