Privacy Policy

DataExtract.ai is a product of North Star Labs, Andrea Syggrou 4, Lakatamia 2300, Nicosia, Cyprus. For any privacy question or request, contact us at contact@nstarlabs.com.

Accounting practices often upload documents that contain their clients' personal or financial data. For that content, you are the controller and we act as your processor: we process it only to produce the spreadsheet you asked for.

• The uploaded PDF is stored temporarily on our server only while it is read, then deleted.
• The text of the document is sent to our AI provider to extract the columns you requested.
• The resulting spreadsheet is deleted from our server once it has been sent to you.
• We do not keep the content of your documents or of the extracted spreadsheets, and we do not use it to train AI models.

A data processing agreement is available on request.

• Account: your email address and password (stored in encrypted form by our authentication provider).
• Usage records: for each extraction, the file name, file size, number of pages, the column names you requested, the result status and the time. These power your History page and your plan limits.
• Free trial without an account: your IP address and a cookie identifier, used only to apply the free-trial limit.
• Payments: handled by Stripe. We receive your subscription status and billing details, but never your full card number.
• Waitlist and contact: the email address and message you send us through our forms.

• To provide the service you signed up for — performance of a contract.
• To prevent abuse of the free tiers — our legitimate interest.
• To keep payment and invoicing records — our legal obligations under Cyprus tax law.

We use these providers to run DataExtract.ai. Each receives only what it needs for its task.

• Supabase — database and sign-in (servers in Frankfurt, Germany).
• Render — the server that processes your documents.
• Vercel — hosting of this website.
• OpenRouter, and the AI model provider it routes to (currently Anthropic) — reading the document text to extract data.
• Stripe — subscription payments.
• FormSubmit — delivery of waitlist and contact form messages.

Some of these providers are based outside the European Economic Area. Where data is transferred outside it, the transfer is protected by safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

• Uploaded documents and extracted spreadsheets: deleted immediately after processing.
• Account and usage records: while your account exists. Ask us and we will delete your account.
• Free-trial records (IP address and cookie identifier): up to 90 days.
• Payment records: as long as Cyprus tax law requires.

We use only cookies needed for the service: sign-in cookies that keep you logged in, one cookie (de_visitor) that applies the free-trial limit for visitors without an account, and one cookie (de-lang) that remembers the language you chose. Your colour theme is kept only in your own browser. We do not use advertising or analytics cookies.

Under the GDPR you can ask to access, correct, delete or export your personal data, and to restrict or object to how we use it. Email contact@nstarlabs.com and we will reply within one month.

You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).

If we change this policy, we will update the date at the top of this page and, for significant changes, tell account holders by email.