Data Processing Addendum

Effective August 6, 2026

This Addendum forms part of the AP Control Terms for a customer that submits personal data through the service. It should be reviewed with counsel before a negotiated enterprise engagement.

Roles and scope

The customer is the controller of Customer Content and AP Control Labs acts as processor, processing Customer Content only to provide, secure, support, and maintain the service under the customer's documented instructions. The subject matter is invoice, purchase-order, account, API, and workflow data; processing continues for the agreement term and applicable retention period.

Processing instructions

AP Control may collect, store, retrieve, normalize, extract, compare, transmit through customer-configured webhooks, and delete Customer Content. The purpose is to deliver read-only finance and operations controls. AP Control will not sell Customer Content, use it for targeted advertising, or use it to train a general-purpose model.

Confidentiality and security

AP Control restricts access to authorized personnel and subprocessors under confidentiality obligations and applies the documented safeguards in the Security page, including tenant-scoped authorization, private document storage, encrypted secrets, short-lived object URLs, audit events, and retention controls. The customer remains responsible for authorized users, its API keys, and selecting an appropriate retention period.

Subprocessors

Current service subprocessors are Supabase (authentication and database), Railway (application hosting), Cloudflare R2 (private object storage), AWS Textract (document extraction), Stripe when billing is enabled, and Sentry when error monitoring is enabled. Each may process only the data needed to provide its service. Customers may ask questions or object on reasonable data-protection grounds at the contact address below; AP Control will work in good faith on a reasonable alternative where practicable.

Assistance, incidents, and deletion

AP Control will reasonably assist verified requests concerning Customer Content and will notify the customer without undue delay after confirming a security incident involving Customer Content, subject to legal and investigative constraints. On termination or a verified deletion request, AP Control will delete Customer Content according to the customer's retention setting and scheduled deletion process, except for limited data retained for security, dispute, billing, or legal obligations.

Review and priority

On reasonable written request, AP Control will provide available information needed to demonstrate these commitments. This Addendum is subordinate to mandatory law; if it conflicts with the Terms on processing Customer Content, this Addendum controls. It does not alter the service's read-only boundary or create an uptime commitment.

Data-processing contact: apcontrollabs.support@gmail.com