Automated document processing

Facet recognises the contents of documents in order to build search, determine a document's type and warn before it expires. Without recognition those features do not exist: search has nothing to search, and an expiry date has nowhere to come from.

Recognition is performed by Google's Gemini model, which the service calls as an external processor. What is submitted to it, on what terms, and within which limits is set out below.

When a document is uploaded, the file — an image or a PDF — is submitted with a request to recognise its text, determine its type and extract structured fields such as a number or an expiry date.

When the assistant is used, the text of the request is submitted along with the fragments of your documents that are relevant to it. The volume of those fragments is limited to what answering requires.

Transmission is over a secured channel (TLS) directly to the provider's API.

• identifiers of your account: email address, name, user identifier;
• documents belonging to other owners;
• documents unrelated to the current request;
• the contents of your vault as a whole — the processor has no access to it.

The processor receives a single file or a single fragment within one request and has no means of reaching the store on its own.

The service uses the paid tier of the Gemini API. Its terms expressly prohibit the provider from using submitted data to train or improve models.

This is the decisive reason for choosing the paid tier: the free tier's terms are the opposite — data submitted there is used to develop the provider's products and may be reviewed by people.

The provider retains requests and responses for a limited period in order to detect abuse. That is a time-bounded security log, not a training set.

Processing runs on the provider's global infrastructure and may take place outside the EU. The transfer rests on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

Different tasks use different models, each within its own scope:

• document recognition and classification — gemini-3.6-flash;
• a second attempt where the first produced no result — gemini-3.1-pro-preview;
• refinement of a search query — gemini-3.1-flash-lite;
• vectors for search by meaning — gemini-embedding-001.

Separating the tasks means a complete document is submitted only at the recognition stage; search and query refinement operate on the request text and on derived data.

• the result of recognition is a draft: the document type and extracted fields can be corrected by hand, and a correction takes precedence;
• no automated decision produces legal effects for you — the processing affects only how a document is named and found (Article 22 GDPR does not apply);
• your documents are not reviewed by people on our side;
• where processing fails, no derived data is stored and the document remains available for another attempt;
• every request is bounded by a daily quota per person — see below.

Health data is a special category (Article 9 GDPR) and requires separate explicit consent. It is asked for on the sign-up screen and under “Privacy and security”; by default it is not given.

During recognition the model answers a separate question: does the document reveal anything about a person's health, whatever category it was filed under. The two are deliberately kept apart — a sick note is a work document and a clinic invoice a financial one, and both reveal health.

If the answer is yes and no consent stands, the results of recognition are not stored: neither the text, nor the extracted fields, nor the vector, nor the title. The document is marked, and you are given the choice to grant consent and retry, or to delete it. Doubtful cases are resolved towards caution, so a document you would not call medical may occasionally be held back too.

This check runs after recognition, because a document being medical is a conclusion of recognition rather than a precondition for it.

Each account holder has daily quotas: 20 documents, 30 assistant requests and 1000 search operations. The quotas bound how much of your data is processed and rule out excessive load from a single account.

Exhausting a quota does not cause a failure: the document stays queued for another attempt, search falls back to keywords, and the assistant reports the limit while still showing the documents it found.

No. Recognition is part of uploading a document and cannot be switched off separately — without it even search by name or text does not work.

We do not offer a control that leaves the actual processing unchanged. If processing by an external model is unacceptable to you, this service is not suitable, and it is better to know that before the first document is uploaded.