Legal
Privacy policy
Effective 29 October 2026
What doc2json collects, why, and who it is shared with.
1. Who we are
doc2json (doc2json.manoonlabs.com) is run by Thakee Nathees, an individual based in Sri Lanka, under the name ManoonLabs ("we", "us"). We are responsible for the personal data described here.
2. What we collect
- Account: your email address, your name if you give one, and a hash of your password if you set one. The password itself is never stored.
- Workspaces: workspace names, members, roles, and the email addresses of people you invite.
- Saved schemas and API keys. API keys are stored only as a hash and a short prefix.
- Usage records for each request: time, endpoint, result, duration, pages and credits used, file size and type, the model used, token counts and cost. These records do not contain the document or the extracted data.
- Billing: your plan, subscription status, and the customer and subscription IDs from Paddle. We never see or store your full card number.
- Email records: the recipient, type, subject and delivery status of emails we send.
- Account history: changes to accounts and workspaces, such as role changes and plan changes.
- Guest use without an account: a random browser ID in a cookie, and a keyed hash of your IP address, used to count guest parses. The raw IP address is not stored. Sign-in emails are rate limited the same way.
3. Your documents
When you parse a document, it is processed in memory and sent to an AI model provider to extract the data. We do not save the document or the extracted JSON in our database. The result is returned to you, and only the usage record above is kept.
5. How we use it
We use this data to run the service: to sign you in, parse documents, apply credits and limits, bill paid plans, send sign-in links, invitations and account emails, prevent abuse, answer support requests, and meet legal duties. We rely on our contract with you, our legitimate interest in running a safe service, and legal obligations.
6. Who we share it with
We do not sell your data. We share it only with the providers that run parts of the service:
- Paddle, our Merchant of Record, for checkout, payments, tax and invoices.
- OpenRouter and the AI model providers it routes requests to, and Amazon Web Services (Amazon Bedrock), to extract data from your documents.
- Resend, to send emails.
- Hostinger, which hosts the app and its database.
We may also share data when the law requires it.
7. International transfers
These providers may process data outside Sri Lanka and outside your country, including in the United States and the European Union. We use providers that protect data in line with their own privacy commitments.
8. How long we keep it
Documents and extracted results are not kept after a request finishes. Account, workspace, schema and usage data are kept while your account is open. You can delete saved schemas and API keys in the console at any time.
To close your account and delete its data, email support@manoonlabs.com. We may keep billing records where the law requires it. Paddle keeps its own records of payments.
9. Your rights
You can ask to access, correct, delete or export your personal data, or object to how we use it. Email support@manoonlabs.com and we will reply within 30 days. You can also complain to the data protection authority where you live.
10. Security
The site uses HTTPS. Passwords, API keys and invitation tokens are stored as hashes, and access to the database is restricted. No system is perfectly secure, so please keep your sign-in details and API keys safe.
11. Children
doc2json is not meant for children under 16, and we do not knowingly collect their data. If you think a child has given us data, email us and we will delete it.
12. Changes to this policy
We may update this policy. The new version will be posted here with a new effective date. For important changes, we will tell you by email or in the app.
13. Contact
Email support@manoonlabs.com with any privacy question or request.