Data processing terms

Subject matter

Conversion of bank statement PDFs into structured data and export files, with reconciliation checks, review and download.

Duration

For as long as you hold an account, plus the retention periods below.

Nature and purpose

Automated extraction, validation and export; storage for the retention period; support on your request.

Data categories

Names, addresses, account identifiers (stored masked), transaction descriptions, amounts, dates and balances of account holders and counterparties contained in the statements you upload.

Data subjects

Your clients, their employees and counterparties, and your own staff.

We process personal data only on your documented instructions, which are: the actions you take in the service (upload, convert, edit, export, delete), these terms, and any further written instruction you send to [email protected]. We will tell you if an instruction appears to breach data protection law.

The technical and organisational measures are described on the security page: TLS in transit, private storage with signed URLs, masked account numbers, encrypted handling of PDF passwords, redacted logs, per-organisation authorisation, rate limiting, audit logging, and scheduled verified deletion. Personnel with access to production are bound by confidentiality obligations.

The current list, with each provider's role and location, is on the subprocessors page. We will announce additions on that page and on the changelog at least 14 days before they take effect; you may object by email, and if we cannot accommodate the objection you may terminate the affected service.

Originals

Deleted 24 hours after processing.

Exports and extracted data

Deleted 7 days after conversion, or 10 minutes after the first download when Purge on download is enabled.

Conversion metadata

Until you delete the conversion or the account. Delete now purges everything immediately with verification.

On termination

All remaining personal data is deleted when the account is closed, except records we must keep by law (invoices).

We assist with data-subject requests by providing export and deletion controls in the product and by responding to requests sent to [email protected]. We notify you without undue delay of any personal data breach affecting your data, with the information you need for your own notifications. We make available the information necessary to demonstrate compliance and, subject to confidentiality and reasonable notice, allow audits you or your regulator require.

Data is processed where our hosting provider (named on the subprocessors page) operates. Where a transfer outside your jurisdiction requires safeguards, we rely on the provider's standard contractual clauses or equivalent mechanism and will provide details on request.

These terms apply automatically. If your organisation requires a countersigned DPA or a specific template, email [email protected].