Version: 22 August 2026
This Data Processing Agreement ("DPA") forms part of, and is subject to, the Terms & Conditions (the "Agreement") between:
each a "party" and together the "parties".
It governs the processing of personal data by Extracto on the Customer's behalf in connection with the Extracto document-extraction service (the "Service"). If there is any conflict between this DPA and the Agreement on the subject of data protection, this DPA prevails.
Capitalised terms not defined here have the meaning given in the Agreement.
For Customer Personal Data, the Customer is the Controller and Extracto is the Processor / data intermediary. The Customer is responsible for the lawfulness of its collection and use of Customer Personal Data and for having all necessary consents, legal bases, and notices in place for Extracto to process it as described in this DPA.
For the Customer's own account, sign-in, and usage records, Extracto acts as a Controller and processes that data in accordance with its Privacy Policy. This DPA does not apply to that processing.
3.1 Extracto will process Customer Personal Data only: (a) to provide, maintain, secure, and support the Service in accordance with the Agreement; and (b) on the Customer's documented instructions, including those given through the Service's features and configuration.
3.2 The Customer's use of the Service constitutes its complete and final documented instructions. Additional or alternative instructions must be agreed in writing.
3.3 Extracto will inform the Customer if, in its opinion, an instruction infringes the Data Protection Laws, unless legally prohibited from doing so.
3.4 Extracto does not use Customer Personal Data to train any artificial-intelligence model, and its AI sub-processors do not use it to train or improve their foundation models.
The subject matter, duration, nature and purpose of the processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex A.
Extracto will:
6.1 The Customer provides general authorisation for Extracto to engage Sub-processors. The current Sub-processors are listed in Annex C.
6.2 Extracto will impose data-protection obligations on each Sub-processor no less protective than those in this DPA, and remains fully responsible for each Sub-processor's performance.
6.3 Extracto will give the Customer at least 30 days' prior notice of the addition or replacement of a Sub-processor. The Customer may object on reasonable data-protection grounds within 14 days of that notice; the parties will work in good faith to resolve the objection, failing which the Customer may terminate the affected part of the Service without penalty and receive a pro-rata refund of prepaid fees for the unused term.
7.1 The Service is deployed so that AI inference, optical character recognition, application hosting, and record storage all take place in Singapore (asia-southeast1). The AI models used in production are pinned to the Singapore regional endpoint.
7.2 Extracto will not transfer Customer Personal Data outside Singapore other than to the Sub-processors and locations described in Annex C, and will ensure any such transfer has a lawful transfer mechanism as required by the Data Protection Laws.
7.3 Customer-directed destinations. Where the Customer directs Output to a destination of its own choosing — a Google Sheet in the Customer's own account, the Customer's mail application, an accounting platform, or a local folder that may be synchronised to a third-party cloud service — that data travels from the Customer's browser and does not pass through Extracto's systems. Extracto is not a processor for those transfers, and clause 7.1 does not extend to them. The Customer is responsible for the residency and lawfulness of any such transfer.
Extracto will make available information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits by the Customer or its mandated auditor, on at least 30 days' prior written notice, no more than once in any 12-month period — except where required by a regulator or following a Personal Data Breach, when no such limit applies. Audits are subject to confidentiality, must not compromise the security of other customers' data, and are at the Customer's cost unless a material non-compliance is found.
On termination or expiry of the Agreement, or earlier on the Customer's request, Extracto will delete or return Customer Personal Data in its control. The parties acknowledge that Extracto does not store Document content or extracted data; such data resides on the Customer's device — including the Customer's locally stored audit trail — and remains the Customer's responsibility to delete. Operational records are deleted automatically 30 days after licence expiry in accordance with the Privacy Policy, subject to any retention required by law.
10.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.
10.2 This DPA is governed by the laws of Singapore, and the parties submit to the exclusive jurisdiction of the courts of Singapore, consistent with the Agreement.
This DPA takes effect on the effective date of the Agreement and continues for as long as Extracto processes Customer Personal Data.
| Item | Description |
|---|---|
| Subject matter | Extraction of structured data from documents uploaded by the Customer to the Service. |
| Duration | For the term of the Agreement, and for each extraction only the transient period the request takes. |
| Nature and purpose | Automated AI-based reading and field extraction from Documents; optical character recognition and page-geometry analysis for bank statements and for editable Word output; deterministic reconciliation checks; and generation of exports at the Customer's direction. |
| Types of Personal Data | As contained in the Customer's Documents. May include names, contact details, business and tax identifiers (such as GST/SST registration numbers), addresses, bank account numbers and transaction histories (bank statements), payment and financial details, and, where the Customer uploads HR documents, employee identifiers, working hours, and remuneration data (offer letters, timesheets, claim and leave forms). |
| Categories of Data Subjects | As determined by the Customer. May include the Customer's employees, customers, suppliers, and other counterparties. |
| Sensitive data | The Customer determines what it uploads. The Customer should not upload special categories of personal data unless it has confirmed a lawful basis for doing so; the Service is not designed for, and makes no specific provision for, health, biometric, or similar sensitive data. |
| Data processed by Extracto as Controller (outside this DPA) | Licence and account identifiers, usernames and password hashes, usage counters, and hashed network addresses used to secure the Service. |
| Measure | Implementation |
|---|---|
| Transient processing | Document content is held in memory for the duration of the request and is not written to Extracto's database, to disk, or to logs. |
| Encryption in transit | HTTPS/TLS with HTTP Strict Transport Security. |
| Encryption at rest | Applied by the cloud platform to all stored operational records. |
| Credential protection | User passwords stored only as salted scrypt hashes, compared in constant time. No cloud credentials are exposed to the browser. |
| Administrator access control | Access protected by a secret held in a managed secret store, with optional time-based two-factor authentication, single-use code enforcement, and short-lived signed sessions. Administrator endpoints fail closed when unconfigured. |
| Application hardening | Strict Content-Security-Policy, anti-framing and related security headers; origin restrictions on the API. |
| Abuse prevention | Per-licence request-rate limiting, output-size ceilings, and escalating brute-force lockout keyed to a salted HMAC of the network address rather than the address itself. |
| Automatic deletion | Database time-to-live policies delete licence records 30 days after expiry and lockout records 7 days after the last failed attempt, without manual intervention. |
| Data-residency design | Inference, OCR, hosting, and storage all located in Singapore (asia-southeast1). |
| Logging discipline | Per-request access logs excluded from log storage; error logs exclude document content, request bodies, licence codes, and credentials. |
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud — Vertex AI (Gemini) | AI field extraction. Not used to train Google's models | Singapore (asia-southeast1) |
| Google Cloud — Document AI | OCR and page geometry for bank statements and Word output. Not used to train Google's models | Singapore (asia-southeast1) |
| Google Cloud Run | Application hosting | Singapore (asia-southeast1) |
| Google Cloud Firestore | Storage of licence, account, sign-in and security records | Singapore (asia-southeast1) |
No payment processor or email provider is currently engaged; licences are invoiced manually and the Service composes email in the Customer's own mail application. Any processor added later will be notified under clause 6.3 before it processes Customer Personal Data.
Destinations that are not Sub-processors. Google Sheets (via a script deployed in the Customer's own Google account), the Customer's mail application, accounting platforms the Customer imports files into, and local or cloud-synchronised export folders the Customer selects all receive data directly from the Customer's browser. See clause 7.3.
Signed for and on behalf of the parties:
| Extracto (Processor) | Customer (Controller) |
|---|---|
| Name: ____________________ | Name: ____________________ |
| Title: ____________________ | Title: ____________________ |
| Date: ____________________ | Date: ____________________ |