This policy explains what information Second Look ("we," "us") collects when you use secondlookbills.com (the "Service"), why we collect it, and what rights you have over it. Second Look is operated by an individual based in Slovenia, so this policy is written with EU data protection principles (GDPR) in mind, regardless of where you're located.
1. What we collect
- Email address — collected when you start a free analysis or subscribe, used to identify your account and track your monthly usage.
- Subscription and billing status — your plan (Free/Starter/Family/Advocate), subscription status, and usage count. Payment details themselves (card numbers etc.) are handled entirely by Stripe — we never see or store them.
- Bill or EOB content you upload — the photo, PDF, or pasted text of your medical bill. This is sent to our AI provider to generate your analysis and is not saved to our database or any file storage — it exists only for the duration of that one request.
- Basic technical data — IP address and request metadata, used only for rate-limiting (preventing abuse) and kept only in short-lived logs, not a permanent database.
2. Why we collect it
We use this information solely to operate the Service: to let you log in and pick up your account on a new device, to enforce your plan's monthly usage limit, to generate the plain-language explanation of your bill, and to process subscription payments through Stripe.
3. Who we share it with
We use a small number of service providers to run Second Look, each of which processes a limited slice of your data on our behalf:
- Anthropic — receives the content of the bill you upload, in order to generate your analysis. Not used to identify you personally beyond that single request.
- Stripe — handles all payment processing and stores your billing/payment details directly; we only receive your subscription status back from them.
- Turso and Render — our database and hosting providers, which store your account record (email, plan, usage count) and run the application itself.
We do not sell your personal data to anyone, for any purpose.
4. International data transfers
Because our service providers operate globally (including in the United States), your data may be processed outside the European Economic Area. Where this happens, our providers rely on standard contractual safeguards recognized under GDPR (such as Standard Contractual Clauses) to protect your data during that transfer.
5. How long we keep it
Your account record (email, plan, usage count) is kept for as long as your account is active. Uploaded bill content is never stored — it's discarded immediately after your analysis is generated. If you'd like your account deleted entirely, contact us (see below) and we'll remove it.
6. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these rights, email us — see Contact below. We'll respond within a reasonable time, generally within 30 days.
7. Children's privacy
Second Look is not directed at, or intended for use by, children. We do not knowingly collect personal data from anyone under 16.
8. Changes to this policy
If this policy changes in a meaningful way, we'll update the "Last updated" date above. Continued use of the Service after a change means you accept the updated policy.
9. Contact
Questions about this policy or your data? Email secondlookbills@gmail.com.