Privacy Policy — Extracto

Effective date: 29 October 2026 Last updated: 6 November 2026

This Privacy Policy explains how ERK SOLUTIONS ("Extracto", "we", "us", "our") collects, uses, discloses, and protects personal data in connection with the Extracto document-extraction service (the "Service").

We handle personal data in accordance with the Singapore Personal Data Protection Act 2012 (PDPA) and, where it applies to our customers' processing, the Malaysian Personal Data Protection Act 2010 (as amended, including the 2024 amendments).

1. Who we are and how to contact us

Entity: ERK SOLUTIONS, UEN 53534776J
Data Protection Officer: [email protected]
General contact: [email protected]

2. Our role: intermediary vs controller

Extracto processes two very different categories of data, and our legal role differs for each.

Account and operational data — information about the business or individual that subscribes to Extracto: the licence, sign-in credentials, and usage counters. Here we act as a data controller.
Document content — the invoices, receipts, bank statements, timesheets, offer letters, claim and leave forms and other documents a user uploads, and the personal data inside them (which often relates to third parties such as the customer's employees, customers, or suppliers). Here we act as a data intermediary (Singapore) / data processor (Malaysia), processing that content only on the instructions of, and on behalf of, the subscribing customer.

You, our customer, are responsible for having a valid legal basis and any necessary consent to upload documents and the personal data within them, and for issuing the privacy notices your own data subjects require.

3. Information we collect

3.1 Account and operational data (we are controller)

Licence record: your licence code (which is also your account identifier), tier, scan allowance and scans used, permitted document types, activation and expiry dates, auto-renewal flag, and any free-text administrative note we record against the account.
Sign-in credentials: if you set a login, your chosen username and a salted scrypt hash of your password, plus the date the password was set. We never store your password in readable form and cannot recover it — only reset it.
Sub-user records: where a Premium or Business account creates additional logins, the same fields for each Sub-user, plus a label chosen by the account owner and a link to the parent account.
Billing data: while licences are invoiced manually, we hold the billing contact details and invoice records you provide. We do not collect or store card details. If self-serve card payment is introduced, it will be handled by a third-party payment processor and this Policy and the sub-processor list will be updated before it goes live.

3.2 Document content (we are intermediary/processor)

When you run an extraction, the document is transmitted to our processing back-end and to our AI sub-processors (Section 5), and the extracted fields are returned to your browser.

We do not store the contents of your uploaded documents or the extracted data on our servers. Document content is held in memory only for as long as the request takes and is then discarded. It is not written to our database, not written to disk, and not recorded in our logs.

3.3 Data held on your own device

Most of what the Service produces stays on your device, in your browser's local storage, and is not visible to us:

What	Where	Cleared by
Your licence code	Local storage (`extracto_license_code`)	Signing out, or clearing browser data
Extraction results and in-progress work	Browser session	Clearing the session, or closing the app
Settings, field templates, department and Sheet configuration	Local storage (`docscan_settings_v1`)	The in-app reset control, or clearing browser data
Audit trail — verifier name, timestamp, document name, and fields edited	Local storage (`docscan_audit_log_v1`)	The in-app "clear audit log" control only
Chosen export folder	Browser IndexedDB (`qs_cloud`)	Changing the setting, or clearing browser data

Note the audit trail deliberately survives a session clear, so that a verification record is not lost when you clear your working data. It contains the name each verifier types in, and it is exportable to Excel. If your organisation treats verifier names as personal data of your staff, that record is yours to manage, retain, and delete — we have no access to it and cannot delete it for you.

3.4 Automatically collected technical data

IP address: processed transiently to operate rate limiting and brute-force lockout. We do not store raw IP addresses. Lockout records are keyed by a salted HMAC-SHA-256 hash of the address, which cannot be reversed to recover the original, and each record is automatically deleted 7 days after the last failed attempt.
Server logs: application error logs, kept for reliability and security. They do not contain document content, extracted data, request bodies, licence codes, or passwords. Per-request access logs, which would contain IP addresses, are excluded from log storage at the platform level.
Administrative security records: short-lived markers used to prevent replay of two-factor codes, which expire within roughly two minutes and contain no personal data.

4. How we use personal data

We use personal data to:

provide, operate, and maintain the Service and process your documents on your instruction;
authenticate users and enforce licence entitlements and scan allowances;
protect the Service against abuse, fraud, and unauthorised access, through rate limiting and lockouts;
provide support, communicate service and billing information, and respond to enquiries;
comply with legal obligations and enforce our Terms & Conditions.

5. Sub-processors and AI processing

To extract data from documents, the Service transmits document content to Google Cloud services. Processing is performed in Google Cloud's Singapore region (asia-southeast1).

Sub-processor	Purpose	Location
Google Cloud — Vertex AI (Gemini models)	AI field extraction from documents	Singapore (asia-southeast1)
Google Cloud — Document AI (OCR)	Optical character recognition and page geometry, used for bank-statement extraction and for the editable Word export	Singapore (asia-southeast1)
Google Cloud Run	Application hosting	Singapore (asia-southeast1)
Google Cloud Firestore	Storage of licence, account, sign-in and security-lockout records	Singapore (asia-southeast1)

No model training on your data. Document content sent to Vertex AI and Document AI is used only to generate the result for your request. It is not used by Google to train or improve its foundation models, consistent with Google Cloud's data-governance terms for these services. We do not use your document content to train any model.

Not sub-processors. Some destinations receive your data without it passing through our systems, and we are not a processor for them:

Google Sheets — the integration posts data from your browser directly to a script you deploy in your own Google account.
Email — the Service composes a message in your own mail application; we never transmit or receive it.
Export folders — files are written by your browser to a folder you choose on your own device. If you choose a folder synchronised to a cloud service such as Google Drive, Dropbox, or OneDrive, your exported data will be transmitted to that service under your own agreement with it, outside our control and outside our residency commitment.
Accounting platforms (Xero, QuickBooks, MYOB/ABSS, SQL Account, AutoCount, Financio) — we generate a file; you import it.

6. Data residency and international transfers

The Service is deployed so that AI inference, OCR, application hosting, and record storage all take place in Singapore (asia-southeast1). The AI models used in production are pinned to the Singapore regional endpoint rather than a global one.

We do not transfer personal data outside Singapore in the course of providing the Service. Where you choose an export destination outside Singapore — including a synchronised cloud folder — that transfer is yours, not ours.

7. Data retention

Data	Retention
Document content and extracted data	Not retained. Processed in memory for the duration of the request only
Licence and account records, including username and password hash	For the life of the licence, then automatically deleted 30 days after expiry
Security lockout records	Automatically deleted 7 days after the last failed attempt
Two-factor replay markers	Expire within approximately two minutes
Application error logs	Retained per platform default for reliability and security purposes
Billing and invoice records	As required by applicable tax and accounting law

Deletion of licence and lockout records is enforced automatically by database time-to-live policies, not by manual process, so the retention limits above hold without anyone having to act.

8. Security

We apply technical and organisational measures appropriate to the data, including:

encryption in transit (HTTPS/TLS with HSTS) and encryption at rest for stored records;
passwords stored only as salted scrypt hashes, and compared in constant time;
administrator access protected by a secret held in a managed secret store, with optional time-based two-factor authentication and short-lived signed admin sessions; administrator endpoints fail closed if the secret is not configured;
strict Content-Security-Policy and related browser-hardening headers; no cloud credentials are ever exposed to the browser;
service-account-based authentication between the application and cloud services;
per-licence rate limiting and escalating brute-force lockout;
automatic time-to-live deletion of expired records.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Disclosure of personal data

We do not sell personal data. We disclose personal data only:

to the sub-processors listed in Section 5, to operate the Service;
to the subscribing customer, for document content processed on their behalf;
where required by law, regulation, legal process, or a governmental request;
to protect the rights, safety, and property of Extracto, our users, or others;
in connection with a merger, acquisition, or asset sale, subject to this Policy.

10. Your rights

Subject to applicable law, you may request to access, correct, or withdraw consent for the processing of your personal data, and (where the Malaysia PDPA 2024 amendments apply) request data portability or deletion. Contact [email protected].

Two important limits:

Where a request concerns personal data inside an uploaded document — that is, third-party data we process on a customer's behalf — we will refer the request to that customer, who is the controller and is responsible for responding. We do not hold the document and cannot retrieve it.
Where a request concerns data held on your own device, such as your audit trail or saved settings, only you can act on it. We have no copy.

11. Business customers — Data Processing Agreement

Where we process document content on your behalf, that processing is additionally governed by our Data Processing Agreement, which sets out our obligations as a data intermediary/processor. Contact [email protected] to put one in place.

12. Cookies and local storage

The Service does not use advertising or analytics cookies and does not track you across sites. It uses browser local storage, session storage, and IndexedDB to hold the items listed in Section 3.3 on your device. You can clear them with the in-app reset controls, or by clearing your browser's site data. The audit trail is deliberately excluded from the ordinary session clear and has its own control.

13. Children

The Service is intended for business use and is not directed to children. We do not knowingly collect personal data from children.

14. Data-breach notification

In the event of a personal-data breach meeting the notification thresholds under the Singapore PDPA and/or the Malaysian PDPA, we will notify the relevant regulator and affected individuals or customers within the timeframes required by law, and will assist affected customers in meeting their own notification obligations.

15. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a revised "Last updated" date and, where required, notify you.

16. Contact

Questions or requests: [email protected] · Data Protection Officer: [email protected].