Pochyaa Logo
Pochyaa Beta
Pre-Payment Invoice Assurance
Legal Document

Privacy Policy

Effective Date: September 14, 2026 • Version 1.0 (Production Master)

Legal Review Advisory: This privacy policy reflects the specific technical architecture and data processing practices of the Pochyaa platform. Prior to public production launch, have this document reviewed by qualified legal counsel in your operating jurisdiction.

1. Introduction & Operating Entity

This Privacy Policy explains how Pochyaa (“Pochyaa,” “we,” “us,” or “our”) collects, stores, processes, and protects personal and commercial financial data when you use the Pochyaa pre-payment audit platform, website, and related services (collectively, the “Service”).

Pochyaa is a business-to-business (B2B) software platform designed for commercial operators, healthcare systems, property managers, and corporate Accounts Payable departments. We do not provide consumer financial services, and our Service is not intended for individuals under the age of 18.

Contact for privacy matters: contact@pochya.com.

2. Information We Collect (Actual Codebase Data Footprint)

We collect only information necessary to deliver deterministic pre-payment audit assurance:

  • User Account & Authentication Data: Name, work email address, hashed passwords (one-way bcrypt with cost 12), designated role (Admin, Auditor, Viewer), and organization memberships.
  • Commercial Tenant & Facility Data: Organization name, operating currency, multi-facility site names, site addresses, and billing tolerance parameters.
  • Vendor & Contract Truth Data: Vendor corporate names, remittance addresses, tax identification numbers (EIN / Tax ID), contact names, phone numbers, email addresses, vendor aliases, master services agreements (MSAs), Schedule B rate cards, hourly unit rates, and contractual escalation caps.
  • Purchase Orders & Invoices: PO numbers, line item scope bounds, invoiced quantities, billed unit rates, tax amounts, line totals, OCR-extracted text, and uploaded PDF/image document files.
  • Dispute & Recovery Communications: Vendor dispute correspondence, email reply headers, and dispute recovery outcome records.
  • System Logs & Technical Telemetry: IP addresses, browser user-agent strings, session identifiers, timestamps, and an append-only audit trail (audit_logs) recording every user override, role transition, rate card edit, and audit run.

3. How We Process & Use Data

We process information strictly to execute contract verification rules:

  • Executing deterministic L1, L2, and L3 audit algorithms to identify overcharges, duplicate billings, and rate card breaches.
  • Generating exportable AP-ready files (CSV, JSON) and executive summaries (PDF).
  • Dispatching transactional notifications (invitations, password resets, and vendor dispute memorandums).
  • Enforcing multi-tenant boundary isolation and investigating security incidents.

We never sell customer data, vendor records, or financial information to third parties or data brokers.

4. AI & Subprocessors (Document Extraction Only)

Pochyaa uses machine learning models (specifically Google Cloud Vertex AI / Google Gemini API) strictly for text OCR extraction and document structuring.

  • No Financial Decision-Making by AI: Machine learning models are never permitted to approve invoices, calculate overcharge amounts, or evaluate payment release. All mathematical verification is calculated deterministically by application code.
  • No Model Training: Invoices, contract rate cards, and vendor documents are processed under enterprise zero-data-retention terms and are never used to train public or foundational artificial intelligence models.

Other infrastructure subprocessors:

  • Cloud Hosting & Compute: [AWS / Hetzner Cloud / DigitalOcean] for secure VPS compute and managed MySQL 8.0 storage.
  • Transactional Email: [Postmark by ActiveCampaign / Resend / AWS SES] for transactional system messages.
  • Edge Security & CDN: [Cloudflare Inc.] for DDoS mitigation, DNS, and TLS termination.

5. Cookies & Local Storage

Pochyaa uses strictly necessary session and security cookies only:

  • laravel_session: Encrypted session identifier used to authenticate your browser session. Expires upon browser close or 120 minutes of inactivity.
  • XSRF-TOKEN: Cross-Site Request Forgery mitigation token used to protect state mutations against unauthorized submission.

We do not deploy third-party advertising cookies, cross-site trackers, or marketing pixels.

6. Data Retention & Tenant Deletion

We retain tenant operational data for the duration of the active subscription agreement plus any statutory commercial tax/audit record retention period (typically 7 years for commercial invoice records, or as configured by the customer).

Upon written request or organization contract termination, tenant administrators may request a full cryptographic export of all audit ledgers and document archives, followed by irreversible database purging within thirty (30) days.

7. Security Controls

We employ defense-in-depth administrative, physical, and technical safeguards:

  • Strict logical tenant partitioning enforced via global database scopes (BelongsToOrganization).
  • SHA-256 cryptographic hashing of all uploaded document payloads.
  • Encrypted data in transit via TLS 1.3 with mandatory HTTP Strict Transport Security (HSTS).
  • Append-only immutable audit logs for sensitive operations.

8. User Rights (GDPR / CCPA / International)

Authorized users and data subjects have the right to request access to their personal data, correct inaccurate records, request data portability (supported via CSV/JSON exports), and request deletion of account credentials. Submit requests to contact@pochya.com.