Data Processing Addendum
DRAFT — needs legal review before launch. Replace every
[bracketed]placeholder. Business customers in the EU/UK will usually expect Standard Contractual Clauses to be attached.
Last updated: [date]
This addendum applies when you (the "Customer") use AlFasil to process personal data on behalf of your business or your clients. It forms part of the Terms of Service.
1. Roles
The Customer is the controller of personal data contained in uploaded documents (for example names and contact details of suppliers or employees on receipts). [Your legal name] ("Processor") processes that data only on the Customer's documented instructions, which are: to extract, check, store and export document data as configured in the Customer's workspace.
2. Nature of the processing
| Item | Description |
|---|---|
| Subject matter | Extraction of data from invoices, receipts and similar documents |
| Data subjects | Customer's suppliers, buyers, staff and other people named in documents |
| Categories of data | Names, business contact details, tax/VAT identifiers, addresses, transaction details |
| Special categories | None intended. Customers should not upload documents containing special-category data |
| Duration | For the term of the agreement. Originals are deleted after the retention period chosen by the Customer (default 24 hours; 1 hour – 7 days). Extracted data is deleted when the Customer deletes it or the account |
3. Processor commitments
The Processor will:
- process personal data only on documented instructions, including for international transfers;
- ensure that people authorised to process the data are bound by confidentiality;
- implement appropriate security measures, including: encryption in transit (TLS); encrypted storage at rest by the hosting provider; automatic deletion of originals; no document content in application logs; hashed API keys; access controls per workspace;
- not use Customer data to train AI models;
- assist the Customer with data subject requests (self-service export and deletion are provided in the product);
- notify the Customer without undue delay after becoming aware of a personal data breach;
- delete or return all personal data at the end of the service, unless the law requires retention;
- make available information needed to demonstrate compliance, and allow for reasonable audits.
4. Sub-processors
The Customer authorises the following sub-processors. The Processor will give notice of any new sub-processor at least 30 days in advance, during which the Customer may object.
| Sub-processor | Service | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, email routing | Global |
| Anthropic, PBC | AI document reading (no training on API data) | United States |
| Paddle.com Market Ltd | Payments (merchant of record) — billing data only | United Kingdom |
| Google LLC | Sign-in — account data only | Global |
5. International transfers
Where personal data is transferred outside the EEA/UK, the parties rely on [Standard Contractual Clauses / UK Addendum / other mechanism — to be completed].
6. Contact
[privacy@your-domain]