Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the InvoSlick Terms of Service between you (the “Customer”) and Guy Sinai, Israel (“we”). It applies automatically when the documents you submit contain personal data, with no separate signature needed. It covers the EU and UK GDPR, the Israeli Protection of Privacy Law and similar laws, to the extent they apply.

For personal data in your documents and the data extracted from them, you are the controller and we are your processor. For account, billing and usage data we are the controller, as described in our Privacy Policy. If this DPA and the Terms conflict about personal data, this DPA wins.

• Purpose and nature: reading documents you upload or forward, extracting their data, storing the results in your history and providing exports.
• People concerned: people named on your documents, such as drivers, dispatchers, shippers, consignees, carrier and broker staff.
• Types of data: names, business addresses, phone numbers, email addresses, signatures, and reference numbers printed on the documents. The Service is not meant for special categories of personal data.
• Duration: uploaded files are deleted once extracted; extracted data is kept while your account is active and deleted as described in section 9.

We process the personal data only on your documented instructions, which are the Terms, this DPA and the way you use the Service, unless the law requires otherwise (in which case we'll tell you first where the law allows). We'll tell you if we believe an instruction breaks data protection law. You are responsible for having a lawful basis, and giving any notices required, for the personal data you submit.

We don't sell or share the personal data, use it for our own purposes, or use it to train AI models.

Only people who need access to run the Service can access the personal data, and they are bound by confidentiality.

• Data is encrypted in transit (HTTPS) and stored with providers that encrypt it at rest.
• Uploaded files and forwarded emails are kept in private storage and deleted once extracted.
• Database access rules ensure each customer can read only their own data.
• Access to production systems and keys is limited to the people who run the Service.
• Error monitoring is configured not to collect documents, extracted data, cookies or URL tokens.
• Sign-in, uploads and the demo are rate limited, and the demo has a bot check.

You authorize us to use these sub-processors for the personal data in your documents, each under written terms that protect it at least as well as this DPA:

• Supabase: account sign-in, the database that stores your account and extracted data, and short-lived storage of files while they are extracted
• Anthropic: AI extraction of the documents you upload (Claude API)
• Vercel: hosting the website and application, and cookieless visit statistics (Web Analytics)
• Zoho: sending our emails to you (including the results of documents you forward) and receiving your messages
• Cloudflare: DNS, receiving the emails you forward to your InvoSlick forwarding address, and the bot check on the landing page demo (Turnstile)

Anthropic deletes data sent through its API within 30 days (longer only for content flagged as breaking its usage policy, or where the law requires) and doesn't use it to train its models. We'll update this list and email account owners at least 14 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, you can end your subscription and we'll refund any prepaid, unused period. We remain responsible for our sub-processors.

We operate from Israel, which the European Commission and the UK recognize as providing adequate protection. Sub-processors in the United States receive data under the Standard Contractual Clauses or the EU-US Data Privacy Framework (and its UK extension).

• We'll help you answer requests from the people concerned (access, correction, deletion and so on). You can export and review extracted data from your dashboard at any time; for anything else, email guy.sinai@invoslick.com.
• We'll give reasonable help with impact assessments and consultations with authorities.
• If we become aware of a breach affecting the personal data, we'll notify you without undue delay and within 48 hours, with what we know and what we're doing about it, and update you as we learn more.

When your account is deleted, we delete the personal data in your documents and extracted data within 30 days, unless the law requires us to keep it. Export anything you need first.

We'll answer reasonable written questions about how we comply with this DPA. If that isn't enough to show compliance, or an authority requires it, you may audit us once a year on 30 days' notice, at your cost, under confidentiality, without access to other customers' data.

This DPA lasts as long as we process personal data for you. Liability under it is subject to the limits in the Terms, except where the law doesn't allow them.