Privacy and document processing

Information used for your application

We use the account, contact, company and financial details you provide, together with uploaded documents, to prepare and manage your application and support authorised staff review. Saved documents and application details are kept in Epitomi’s application storage. Correcting a field does not change the original document.

Automatic document reading

Uploading a supported Trade Licence, Emirates ID or bank statement starts automatic reading. The selected document is sent to OpenAI through its API. The full file may include information beyond the fields requested, such as a portrait or transaction entries. Upload only the requested document and information you are authorised to provide.

For an Emirates ID, reading requests only the printed name, ID number, nationality and date of birth. It does not identify a face, verify identity or decide KYC. For other documents, reading prepares company, licence, bank and statement fields. Results can be incomplete or inaccurate: check and edit them against your source. If reading fails, you can confirm the document type and enter the details manually.

Epitomi requests that OpenAI does not store an API response as retrievable response history. This does not mean zero retention: OpenAI’s separate security and abuse-monitoring handling can still apply. See OpenAI’s API data controls for its published handling. This notice does not promise a particular processing country or a zero-retention arrangement.

Access and human decisions

Epitomi uses Clerk for account authentication and Convex for application data and document storage. Access within the application is governed by account, organisation and staff permissions. Authorised people remain responsible for KYC, credit, approval and funding decisions. Reading a document or saving an application is not approval or submission for financing.

Questions and requests

Contact Epitomi for details about the retention and processing arrangements applicable to your application, or to raise a privacy concern. Removing a file from an unsaved form does not recall a file already sent for automatic reading. Please avoid sending identity documents in an initial privacy enquiry.