Security & Data Protection

You upload financial documents — bank statements, invoices, client records. Here is exactly what happens to them, in plain language. These are operating rules built into the system, not marketing claims.

Where your data lives

All files are received, stored and managed on servers located in Germany (EU).
AI text extraction is performed via enterprise cloud providers under data-processing agreements that prohibit storage and any use of your content for model training.
No document data is ever transferred for advertising or profiling purposes.

How long we keep your files

The original document you upload is deleted immediately after processing — within minutes.
The generated Excel/CSV stays available for download for up to 2 hours, then it is deleted automatically.
Large asynchronous conversions and Excel add-in source documents are kept for 30 days (so you can re-download them), then deleted automatically.
Temporary technical caches used for retries are purged within 24 hours.

No AI training on your documents

Your documents are never used to train AI models — neither by us nor by our processing providers (contractually excluded).
Each conversion is processed statelessly: extract, return, delete.

Security measures

All traffic is encrypted in transit (TLS 1.2+).
Production access is limited to key-based authentication for authorised personnel.
Nightly encrypted backups with off-site copies; restore procedures are tested weekly.
Payments are handled entirely by Stripe — we never see or store card numbers.

Sub-processors

Hetzner Online GmbH (Germany) — hosting and storage.
Enterprise AI cloud providers — text extraction, under GDPR data-processing agreements with no-training and no-retention clauses.
Stripe — payment processing.
Cloudflare — DNS.
SiteGround / SMTP2GO — transactional and product email delivery.

Your GDPR rights

Access, rectification, deletion: write to info@myocr.app and we act within the statutory terms.
Account deletion removes your personal data; conversion files are already deleted by the retention rules above.
Newsletter and lifecycle emails have one-click unsubscribe; transactional email is limited to service messages.

Need a Data Processing Agreement (DPA) for your firm's GDPR records? Read and print the standard DPA — for a countersigned copy write to info@myocr.app.

Is everything running? Real-time uptime and incident history at status.myocr.app — independent checks every 5 minutes.

Last updated: 4 September 2026