Data Processing Agreement

Save or print this page and put it on file. If your compliance process needs a countersigned copy on letterhead, email support@statementtable.com and you will have one back the same business day, with our sub-processors named individually.

1. Parties, and how this agreement takes effect

This agreement is between you, the customer ("you", "the controller"), and StatementTable ("we", "the processor"), the service described in our terms of service. We are operated from Türkiye; the postal address is sent to you on request and is written into any countersigned copy of this agreement.

It applies whenever you upload a statement that contains personal data belonging to someone else, such as a client, an employer or a counterparty. It forms part of the terms of service and takes effect for you when you first use the service. Nothing has to be requested, negotiated or signed for it to bind us.

It is written to satisfy Article 28(3) of the EU GDPR and of the UK GDPR, and the equivalent obligations of a data importer under Law No. 6698 (KVKK). Article references below use the shared GDPR numbering.

Sections 2 to 5 are the description of the processing that Article 28(3) requires. Section 9 is the description of the technical and organizational measures that Article 32 requires. Together they are the annex to this agreement.

2. Subject matter and duration

Subject matter. Our processing of personal data contained in the documents you upload, and in the account you use to upload them, so that we can return the converted result to you.

Duration. For each document, the processing lasts only as long as the conversion runs. This agreement itself runs for as long as you have an account or use the service, and its confidentiality, deletion and audit provisions survive that.

3. Nature and purpose of the processing

The processing is automated. We read the pages of the document you upload, extract the transactions printed on them, rebuild the running balance from those transactions and compare it against the balances the bank printed, and produce the export formats you request. We do this for one purpose: to give you the converted file.

We do not use the contents of your documents for any purpose of our own. We do not use them to train models, we do not enrich them, we do not sell or share them, and we do not build a profile of any person named in them. The provider that performs the extraction step is contractually barred from training on them.

The operations performed are: collection on upload, storage in memory for the duration of the job, structuring, format conversion, transmission to you, and erasure.

4. Types of personal data

You choose what to upload, so you determine the exact scope. In the ordinary case a bank or credit-card statement contains:

• Identity and contact data printed on the statement: account holder name, and postal address where the bank prints one.
• Financial identifiers: account number, sort code, IBAN, and card number as printed, which issuers usually mask.
• Transaction data: dates, descriptions, merchant and counterparty names, amounts, running balances, currency.
• Inferences a reader could draw from those transactions, which we neither look for nor derive.

Separately, and as controller rather than processor, we hold the account data described in our privacy policy: the email address you sign in with, your credit ledger, and a conversion history of counts and dates that records nothing from inside a statement.

A statement can incidentally reveal a special category of data under Article 9, a payment to a hospital or a political party for example. We do not look for it, we do not derive anything from it, and it is deleted with the rest of the file when the conversion ends. If your instruction to us would require the systematic processing of special-category data, tell us before you upload.

5. Categories of data subjects

• Your clients, and the account holders whose statements you convert.
• The counterparties, merchants and employees named in the transactions on those statements.
• The people in your own organization who hold a sign-in for the service.

6. Your obligations as controller

• You determine the purposes and means of the processing you ask us to carry out, and you are responsible for having a lawful basis for it.
• You confirm that you are entitled to upload each document, and that the people whose data it contains have been given the notice their law requires.
• Your instructions to us are the act of using the service, plus anything you send in writing to support@statementtable.com. Please do not send us a statement by email for support; a description of the layout is enough, and it keeps the data out of a mailbox.
• You keep access to your sign-in email address secure. Anyone who can receive your sign-in codes can sign in and spend your credits.
• You review the output before you rely on it, as section 2 of the terms of service sets out.

7. Our obligations as processor

• We process personal data only on your documented instructions, including for transfers to a third country, unless a law that binds us requires otherwise. If that happens we tell you first, unless the same law forbids it.
• We tell you if, in our opinion, an instruction infringes the GDPR or another data protection law.
• We keep the processing confidential, on the terms in section 8.
• We apply the measures in section 9, and we take account of the state of the art, the cost of implementation and the risk to the people concerned when we change them.
• We engage a sub-processor only on the terms in section 10, and we remain liable to you for its performance.
• We assist you with data subject requests, as set out in section 12, and with your obligations under Articles 32 to 36, including security, breach notification and data protection impact assessments.
• We delete personal data at the end of the processing, as set out in section 15.
• We make available the information you need to demonstrate compliance, and we accept audits, as set out in section 14.

8. Confidentiality

Access to production infrastructure is limited to the operator, who is bound to confidentiality over everything the service processes. That access is protected by two-factor authentication.

Statements are read by software, not by people. Nobody at StatementTable reads your statement in the ordinary course of the service, and we have no mechanism that would let us: the file is gone within the hour and its contents are never written to a log or to a database. If diagnosing a fault ever required looking at a document, we would ask you for it, in writing, first.

Any future personnel, contractor or agent with access will be under the same written confidentiality obligation before that access is granted, and that obligation will survive the end of their engagement.

9. Security measures

These are the measures in force. They are the same controls described on the security page, stated here as a contractual commitment.

Minimization and erasure

• Your file is held in the memory of the single request that converts it, along with the page images prepared from it and the transactions extracted from it. All three go when that request ends, whether it succeeded or failed. A conversion takes minutes at most, and nothing survives an hour.
• The file is never written to disk, never queued and never copied into object storage or a database. There is no bucket to leak and no backup of a statement to restore.
• Statement contents are never written to logs, not in errors and not in debug output. Logs record page counts and error types. What survives a conversion is one counter row: page count, native or scanned, whether the balance check passed, and the processing cost.
• We record no file names, bank names or account numbers in the conversion history shown on your account.

Encryption

• All traffic is encrypted in transit with TLS: between you and us, and between us and every sub-processor in section 10.
• Nothing from inside a statement is stored at rest, so there is no encrypted archive of documents and no key that would open one.
• Secrets and API keys are held in the platform's encrypted secret store and never appear in source code. The repository is scanned for secret patterns before every release.

Access control

• Access to production infrastructure requires two-factor authentication.
• Sign-in uses a single-use six-digit code sent to your email address, so there is no password database. The code is stored only as a keyed hash, never in the clear, it expires after ten minutes, and the attempt counter is incremented atomically before the comparison so that parallel guessing cannot exceed the limit. Comparison is constant time. A new request invalidates earlier codes.
• Session cookies carry 32 random bytes; the database holds only a hash of the token, so a database copy cannot be turned into a session. Cookies are HttpOnly, Secure and SameSite=Lax, sessions last 30 days, and deleting your account invalidates every session immediately.
• Every state-changing request is checked for same-origin provenance, so a third-party page cannot act as you.
• Card numbers never reach our systems. Payment runs on the hosted checkout of Polar, our merchant of record, and inbound payment webhooks are accepted only with a valid signature and a fresh timestamp.

Integrity of the processing

• Uploads are identified by file signature rather than by the name or content type the browser claims, and are subject to size and page limits before any expensive work begins.
• The extraction provider's output is validated against a strict schema; a response outside the schema is rejected rather than shown to you. The document is treated as untrusted input throughout, and the model has no tools and can take no action.
• Exported spreadsheets are sanitized against formula injection, so a description crafted to execute in a spreadsheet cannot.
• Every release is validated against a fixed test corpus with known-correct output before it ships. How we test.

Resilience and governance

• The service runs on a global edge platform with the availability and denial-of-service protection that platform provides. Rate limits apply per address to conversion, export, sign-in and contact.
• The runtime dependency list is deliberately short and is checked for known vulnerabilities before each release.
• Every release is preceded by a review of these controls, and the review is written down: what was checked, what changed, and what is still open. We keep that record and will show you the current entry on request.
• Vulnerability reports go to support@statementtable.com with "security" in the subject line, an address also published at /.well-known/security.txt. We reply within one business day and take no legal action against good-faith research.

9a. If you are subject to US financial privacy rules

Some of our customers are financial institutions under the Gramm-Leach-Bliley Act, tax return preparers and accounting firms among them, and the FTC Safeguards Rule (16 CFR Part 314) requires them to contract with their service providers on specific terms. This section is that contract, and it is part of this agreement for any customer who needs it.

• We maintain the safeguards set out in section 9, and we maintain safeguards appropriate to the customer information we receive from you.
• We use the information you send us only to perform the conversion you asked for. We do not use it for our own purposes, we do not sell or share it, we do not use it to train models, and we do not retain it beyond the request that converts it.
• We disclose it to no one except the sub-processors in section 10, each of which is bound by a written contract to the same standard.
• We tell you about a security event affecting your data on the terms in section 13, which is inside the 30 days the Safeguards Rule allows for notifying you.
• We give you the information you need to demonstrate that oversight, on the terms in section 14.
• The same commitments meet the contractual requirements the California Consumer Privacy Act places on a service provider, and the equivalent requirements of the comparable state privacy statutes. We are a service provider under those statutes, not a third party, and we neither sell nor share personal information.

If your regulator or your professional body needs a specific form of words, send it to support@statementtable.com and we will sign it where we can meet it.

10. Sub-processors

You give us general written authorization to engage the sub-processors below. This is the complete list.

There is no analytics provider, no advertising network, no session-recording tool, no CRM and no data broker.

Changes. We give account holders at least 30 days' written notice by email before a new sub-processor begins processing, and we publish the change on the privacy policy with a new "last updated" date. If you object on reasonable data protection grounds within those 30 days, tell us and we will try to offer an alternative. If we cannot, you may stop using the affected part of the service before the change takes effect and we refund your unused credits in full.

Each sub-processor is bound by a written contract imposing data protection obligations no less protective than those in this agreement. We remain fully liable to you for their performance.

11. International transfers

We are established in Türkiye and the sub-processors above are established in the United States, so personal data leaves the UK, the EEA, Australia and Canada.

Where personal data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, in the controller-to-processor and processor-to-processor modules as applicable, together with the UK International Data Transfer Addendum, or on a sub-processor's certification under the EU-US Data Privacy Framework where it holds one. By entering into this agreement you instruct us to make those transfers and, where the clauses require it, to conclude them on your behalf with our sub-processors.

We carry out a transfer risk assessment for each sub-processor and apply supplementary measures: encryption in transit on every hop, no statement contents in logs, a contractual bar on training, and deletion within one hour on our side. For transfers under Turkish law, Article 9 of Law No. 6698 applies, on the basis of appropriate safeguards or explicit consent as the case requires.

Ask at support@statementtable.com for a copy of the safeguards in force for a given transfer.

12. Assisting with data subject requests

If a person exercises a right against you over data we processed for you, we help you answer them, at no charge, taking account of the nature of the processing and the information available to us.

In practice the help is usually short, because we retain nothing from inside a statement. There is no copy of a converted document to access, rectify, port or erase, and no record linking a transaction to a person. What we can do is confirm what was processed and when from the counter rows, describe the processing, and act on your instruction for the account data we hold.

If a data subject comes to us directly, we do not respond on your behalf. We tell them to contact you, and we tell you that they wrote, unless the law forbids it.

13. Personal data breaches

We notify you by email within 48 hours of becoming aware of a personal data breach affecting personal data we process for you. The first notice carries what we know at that point: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the full picture takes longer to establish, we send it in stages rather than delay the first notice, and we tell you when the investigation closes.

We keep a record of every breach, its effects and the remedial action taken, and we make that record available to you. We do not notify a supervisory authority or a data subject on your behalf unless you ask us to in writing, since that notification is yours to make as controller.

Where we are the controller, for account data rather than statement contents, we notify the supervisory authority within 72 hours where Article 33 requires it and tell affected account holders by email without undue delay.

14. Audit and information rights

We make available to you the information necessary to demonstrate compliance with Article 28, and we answer security and privacy questionnaires from you or your regulator within ten business days. That is normally the fastest route, and the security page plus section 9 above will answer most of a standard questionnaire on their own.

Beyond that, you may audit our compliance with this agreement, or appoint an independent auditor to do so, on 30 days' written notice, no more than once in any 12-month period, during business hours, in a way that does not disrupt the service, and subject to confidentiality. You may audit more often if a supervisory authority requires it or following a breach that affected your data. Audits are at your cost, except where the audit finds a material breach of this agreement, in which case we bear the reasonable cost.

Our answer to a review is direct evidence rather than a badge. We answer any question about the controls in section 9 in writing, we name every sub-processor, and we will walk you through the code path that handles a file if that is what your review needs.

15. Deletion and return at the end

Statement data is already gone. Each file, its page images and the transactions extracted from it end with the request that converted them, so at the end of the relationship there is nothing left to return or to delete. You hold the only lasting copy of a conversion: the file you downloaded.

For the account data we hold as controller, deleting your account is immediate and permanent: your email address is removed, and the identifier on your ledger entries is replaced with a short code that carries no name and no email address. You can do that yourself from your account page at any time, or ask us to. Those pseudonymized entries are kept as accounting records for the period tax law requires and are not linked back to you. Support threads are deleted after 12 months.

On request at the end of the relationship we confirm the deletion in writing.

16. Liability, precedence and governing law

This agreement forms part of the terms of service. Where it conflicts with the terms of service on a data protection question, this agreement prevails. Where it conflicts with the Standard Contractual Clauses, the clauses prevail. The liability limit in section 10 of the terms of service applies to this agreement, except where the law does not permit it to.

Governing law and jurisdiction follow section 12 of the terms of service, without prejudice to the law governing the Standard Contractual Clauses and to any mandatory protection you hold under the law of your own country.

Questions, a countersigned copy, a named list of sub-processors, or a completed security questionnaire: support@statementtable.com, one business day.

17. Related documents

Privacy Policy · Terms of Service · Security and data flow · Refund Policy