Data Processing Agreement
Last updated 2026-11-12
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Muhammad Shakir Yasin, operating StatementPanda (“Processor”), and the business customer using the service (“Controller”). It applies when the Controller uploads personal data covered by the EU GDPR or UK GDPR, and is accepted by using the service. If you need a signed copy, save this page as a PDF, fill in your details and email it to hello@statementpanda.com.
1. Subject and duration
The Processor converts bank and card statements uploaded by the Controller into structured data. Processing lasts for as long as the Controller uses the service and ends with deletion as described in section 5.
2. Data and data subjects
Data: contents of uploaded statements, such as account holder names, addresses, account numbers, transaction dates, descriptions and amounts, plus the Controller's account email. Data subjects: account holders named on the statements, the people they transact with, and the Controller's users.
3. Instructions
The Processor processes the data only to provide the conversion service and as instructed by the Controller (using the service is an instruction), unless the law requires otherwise. The data is never sold and never used to train AI models.
4. Security
- Encryption in transit (HTTPS) for all traffic, and encryption at rest by our hosting providers.
- Access to production systems is limited to the Processor and protected by individual accounts.
- Each customer can only see its own conversions, or its team's for team accounts.
- Statement passwords are used only to open the file for that conversion and are never stored.
5. Retention and deletion
Uploaded files are deleted as soon as each conversion finishes, whatever the outcome. Extracted transactions are kept in the Controller's history until the Controller deletes them (one statement, or all at once from the account page). On request, the Processor deletes the account and remaining data within 30 days.
6. Subprocessors
The Controller authorises these subprocessors. The Processor will update this list before adding a new one, and the Controller may object by email.
- Convex: application database, file processing and temporary file storage (United States)
- Cloudflare: website hosting and delivery (global network)
- Anthropic: AI reading of scanned pages and photos, and categorising transaction descriptions, under terms that don't allow training on customer data (United States)
- Resend: sign-in codes and account emails (United States)
- Paddle: payments and invoicing, as our reseller and Merchant of Record (United Kingdom)
- Sentry: website error reports, without statement contents (United States)
7. International transfers
Where data is transferred outside the EU or UK, the transfer relies on the European Commission's Standard Contractual Clauses (with the UK Addendum) or an adequacy decision, as offered by each subprocessor.
8. Assistance and breaches
The Processor helps the Controller answer data subject requests, and notifies the Controller without undue delay, and within 72 hours where possible, after becoming aware of a personal data breach affecting the Controller's data.
9. Audits
On reasonable written request, once a year, the Processor provides the information needed to show compliance with this DPA.
Parties
Processor: Muhammad Shakir Yasin, trading as StatementPanda, hello@statementpanda.com.
Controller: ______________________ (company, address, contact email)
Signed for the Controller: ______________________ Date: ____________