1. When this agreement applies
This agreement applies when you (the "customer") use NoRekey for a business and upload statements that contain other people's personal data, such as your clients'. It forms part of our Terms of Service: you accept it by using the service, and no signature is needed. Where this agreement and the Terms differ on data protection, this agreement takes priority.
2. Roles
For the statements you upload, the data extracted from them and the exports we produce ("customer data"), you are the controller and NoRekey is your processor. For account, billing and service data, NoRekey is the controller, as described in our Privacy Policy.
3. The processing
- Purpose — reading statements, extracting their transactions, checking them against the statement's balances and producing the exports you ask for.
- Duration — for as long as customer data is held under your team's retention settings (section 7).
- Personal data — whatever is printed on the statements: names, addresses, account numbers, balances and transaction details, including payers and payees.
- Data subjects — account holders and the people and businesses named in their transactions.
4. Our commitments
- We process customer data only on your instructions, which are your use of the service, your retention settings and your API requests. If the law requires us to do anything else, we'll tell you first unless the law forbids it.
- Only people who need access to run the service can reach customer data, and they are bound by confidentiality.
- We protect customer data with encryption in transit and at rest, restricted and audited production access, and two-factor authentication, and we delete it on the schedule in section 7.
- We help you answer requests from data subjects and meet your obligations on security, breach notification and data protection impact assessments, as far as the nature of the service allows.
- We tell you without undue delay after becoming aware of a personal data breach affecting customer data, with the information you need to assess and report it.
- We give you the information needed to show we meet this agreement, and allow for and contribute to audits by you or an auditor you appoint, on reasonable notice and normally answered first in writing.
5. Sub-processors
You authorise us to use these sub-processors for customer data:
- Laravel Cloud — application hosting and databases, in London.
- DigitalOcean — encrypted file storage, in London.
- Anthropic — transaction extraction. It receives the whole PDF and does not train on it. It deletes the PDF and its output within 30 days, may keep a request flagged under its usage policy for up to 2 years, and may keep data longer where the law requires.
- Cloudflare — network security and delivery in front of our servers.
- Laravel Nightwatch — error and performance monitoring.
Each is bound by data protection terms that protect customer data at least as well as this agreement, and we remain responsible for them. We'll update this page at least 14 days before a new sub-processor handles customer data. If you object to a change, email us; if we can't resolve it, you can stop using the service.
6. International transfers
Our servers and file storage are in London. Anthropic, Cloudflare and Laravel Nightwatch may process customer data outside the UK, including in the United States, protected by the safeguards in their data processing terms: the UK–US data bridge where the provider is certified, or the UK International Data Transfer Addendum to the EU standard contractual clauses.
7. Deletion
Uploaded PDFs are deleted from our storage as soon as processing finishes. Extracted rows and exports are deleted on your team's retention setting, from 30 minutes to 30 days, or sooner when you delete a conversion, your team or your account. Database backups are kept for 7 days, and Anthropic's copy is kept as described in section 5.
8. Your responsibilities
You confirm you have a lawful basis to upload the statements you send us, that you have given the people concerned any information the law requires, and that your instructions to us comply with data protection law.
9. Liability and contact
Liability under this agreement is subject to the limits in our Terms of Service. Questions, objections and audit requests go to support@norekey.com.