How we process your documents.

You are the controller of the documents and personal data you upload. Barkrow is the processor, acting only on your documented instructions as set out in the agreement and this addendum, and we tell you if we believe an instruction breaks the law. Under US state privacy laws, you are the business and we are the service provider; we do not sell or share your data, and we do not retain, use, or disclose it for any purpose other than providing the service, and not for our own commercial purposes.

We process customer documents (contracts, carrier quotes, bound policies, certificates of insurance) solely to provide Barkrow: extraction, cross-reference, the audit ledger, and support, together with the security, billing, and audit processing the service requires. Quality monitoring and de-identified product improvement are on by default and you can turn either off for your organization; both are described in the Privacy Policy. We do not process customer documents for any other purpose. Data subjects may include insureds, named parties, brokers, and contacts referenced in those documents. Processing lasts for the term of the agreement and the deletion period that follows it.

Everyone we authorize to process customer data is bound by confidentiality and has access only as their role requires.

Barkrow replaces detected sensitive identifiers with tokens and applies additional privacy checks before AI processing. Automated detection does not cover every name or identifier, so some identifying information may remain. Providers that support authentication, payment, email, and map or address features receive only the data needed for the listed service purpose.

The map and address path is narrow by design. Google Maps Platform receives map coordinates and ordinary browser request data when a map renders, and the entered address text when an authenticated user runs an address search. It never receives document bodies, prompts, citations, tenant identifiers, or model data.

Our support-access policy requires an open case, a recorded purpose, time-limited authorization, and an audit record. Contact us for the current controls and evidence applicable to your agreement. Customer content is not copied into our telemetry.

You authorize the subprocessors on the Subprocessors page. Each is bound by written data-protection terms no less protective than this addendum: cloud hosting and compute, document storage, the database, edge delivery, authentication, billing, model inference on document text after privacy checks, text embeddings, transactional email, support intake, customer relationship management, and map and address features. We give you advance notice before adding or replacing a subprocessor, so you may object on reasonable data-protection grounds, and we will work with you in good faith to address the objection. We remain responsible for our subprocessors’ performance.

HTTPS for public traffic, TLS with certificate verification on every database connection, document storage reached only through Cloudflare’s internal storage binding and never over the public internet, encryption at rest with provider-managed keys, tenant isolation enforced at the database with row-level security, least-privilege access, and actor-scoped audit events on privileged paths. Controls are designed and mapped against the SOC 2 Type II criteria, but no audit has been performed, no observation window has started, and Barkrow holds no SOC 2 report. A fuller description of technical and organizational measures is available to your security team under NDA.

We assist you in responding to data-subject requests for access, correction, export, and deletion, and in meeting breach-notification and impact-assessment obligations, within the windows GDPR and US state privacy laws require. We make available the information reasonably necessary to demonstrate compliance and, subject to confidentiality, allow for audits through up-to-date documentation or a reasonable inspection.

The database holding customer data, extracted text, and citations is hosted in the us-west-2 (Oregon) region in the United States. Uploaded documents are stored with a western North America location preference, and the service’s compute runs in western North America. Model inference runs with a United States processing preference. Text embeddings are computed on our edge provider’s network, which is not pinned to a region, and workflow job state, including short cited excerpts, is cached on our global edge network so a run survives a reload. For transfers originating in the EEA, UK, or Switzerland, Standard Contractual Clauses are available on request and incorporated by reference where applicable.

We notify you without undue delay after becoming aware of a personal-data breach affecting your data, including one that makes your data unavailable, with the information you need to meet your own notification duties, and we keep you updated as we learn more.

Customer documents are retained for the period your agreement specifies. Barkrow does not offer a configurable or automated document-retention schedule, so no such control applies. On termination we delete or return them within the period the agreement specifies, except for records we are legally required to retain.

We claim no right to train models on customer documents or the personal data within them. Ever. No setting turns it on. Offering one would take an explicit opt-in from you and a separate legal review first.

De-identified product improvement is a different thing, it carries no raw customer content, and you can turn it off for your organization. See the Privacy Policy.