Data Processing Addendum and Security Addendum

Status of this draft

This addendum is a draft published so businesses can review it. It hasn’t been reviewed by a lawyer yet and doesn’t bind either party until it is finalised and accepted. AnyStatement is run by Ravi, a sole operator; full entity details (legal name and address) will be added before it is final. To discuss or request a signed copy, write to support@anystatement.com.

1. Roles

You, the customer, are the controller of the personal data in the statements you upload. AnyStatement is your processor: it processes that data only to provide the conversion service and only on your documented instructions, which are this addendum, the Terms of Service and your use of the service.

2. Subject matter, duration and nature

• Subject matter: converting PDF bank and credit card statements into spreadsheets and accounting files, checking them against their printed balances, and producing exports.
• Nature: storage, text recognition (OCR), structuring with a language model, reconciliation, display and export.
• Duration: each statement and everything extracted from it is deleted 24 hours after upload by default, or on the date you choose for a batch you keep while signed in (at most 30 days after upload), or sooner when you delete it. The addendum lasts as long as you use the service.

3. Categories of data and data subjects

• Data subjects: account holders named on the statements, and the people and businesses that appear in their transactions.
• Personal data: names, addresses and other details printed on statements; transactions, balances, statement periods and review edits. Structured account-number fields keep the last four digits; original statements and retained source or OCR text may contain full printed account and card numbers until deletion.
• Account data, for customers with an account: email address, plan, page balance and usage history.
• No special categories of data are intended. Don’t upload documents other than financial statements.

4. Processor obligations

• Process personal data only on your instructions, and tell you if we believe an instruction breaks the law.
• Never sell it, use it for advertising, or use your documents to train AI models.
• Look at your documents only when you ask us to help with a specific file, or when the law requires it.
• Keep the security measures in section 6 in place.

5. Confidentiality

Only the operator has access to production systems, and is bound to keep personal data confidential. Anyone who is later given access will be bound by the same duty in writing.

6. Security measures (Security Addendum)

• Encryption in transit: every connection uses TLS; unencrypted connections to storage are refused.
• Encryption at rest: files, results, account data and job messages are encrypted with a dedicated AWS KMS key.
• Direct uploads: browsers upload files straight to encrypted storage over short-lived links restricted to the file; files never pass through the website’s servers.
• Isolation: untrusted PDFs are opened in isolated processes with no access to our credentials.
• Access control: each file can be opened only by the anonymous session or account that owns it; anything else is answered as “not found”.
• Minimisation: PDF passwords are used once in memory and never stored; logs contain IDs, sizes, timings and error codes, never document contents, filenames, account numbers, email or IP addresses; IP addresses are kept only as keyed hashes.
• Deletion: automatic deletion 24 hours after upload by default, or on the chosen date (at most 30 days) for a kept batch, enforced the moment a file expires; storage lifecycle rules delete default files after 1 day and any file after 31 days as a backstop; no backups or old versions of documents are kept. Each deletion leaves a receipt holding only a random batch ID, dates, the reason and file and page counts.
• Sign-in: handled by WorkOS; the session cookie can’t be read by page scripts.

The Security page describes these measures in more detail.

7. Subprocessors

You authorise the subprocessors listed at AnyStatement’s subprocessor list. We bind each one to data-protection terms at least as protective as this addendum and remain responsible for them.

We give at least 30 days’ notice before a new subprocessor starts processing personal data, by email to account holders and on the policy change history. You may object on reasonable data-protection grounds within that period; if we can’t resolve the objection, you may stop using the service and delete your account.

8. Personal data breaches

We notify you without undue delay, and no later than 72 hours after becoming aware of a personal data breach affecting your data, with what we know about its nature, likely consequences and the measures taken. We update you as we learn more.

9. Assistance

We help you answer data-subject requests (access, correction, deletion and similar), and with security, impact assessments and consultations with authorities, as far as the nature of the processing allows. Most requests are already met by the service: documents expire on their own and can be deleted at any time, and Account → Your data → Download my data gives a copy of account data.

10. Deletion and return

Personal data in statements is deleted automatically 24 hours after upload, or on the date you chose for a batch you keep (at most 30 days). You can export your results before then, which is how data is returned. When you delete your account, its data is deleted at once, except the limited records described in the Privacy Policy.

11. Audits

On reasonable request, we provide the information needed to show compliance with this addendum, such as written answers to a security questionnaire. Further audits can be agreed in writing, at reasonable times and with reasonable notice, at your cost.

12. International transfers

Personal data is processed and stored in the United States (AWS us-east-1; OCR and AI in US regions), and our subprocessors are based in the United States. We don’t offer EU, UK or Canadian data residency. Where the law of your country requires a transfer mechanism, such as the EU Standard Contractual Clauses or the UK Addendum, it will be included once this draft has been reviewed by a lawyer; until then, no transfer mechanism is in place. See where your data is processed.

13. Liability and order of precedence

Each party’s liability under this addendum is subject to the limits in the Terms of Service. If this addendum and the Terms conflict on the protection of personal data, this addendum wins.