Data processing terms
Last updated 6 October 2026. These terms form part of the terms of use and apply whenever you upload a client's statements.
Roles
For your client's bank statements and anything read from them, you are the controller and Productimiser Ltd (company number 15016956, InfoHub, 41 Petley Road, London, W6 9SU) is your processor, under Article 28 of the UK GDPR.
What we process
| Subject matter | Producing a LoanLogs report from business bank statements you upload. |
|---|---|
| Data | Bank statement pages and the transactions on them, including names of payers and payees. Optionally a company number, and directors' and shareholders' names from Companies House. |
| People | Your client's business, its directors and owners, and anyone named in its transactions. |
| Purpose | Only to produce and show you the report. Nothing else. |
| Duration | Statements and transactions: deleted 7 days after upload, or when you press delete. Report: until you delete the case. |
What we commit to
- Process the data only on your instructions, which are to produce the report you asked for.
- Make sure everyone who can access it is bound by confidentiality.
- Keep the security measures described on our security page in place.
- Use only the sub-processors listed below, and tell you before adding or replacing one so you can object.
- Help you answer requests from the people in the data, and with any data protection impact assessment you need to carry out.
- Tell you without undue delay, and within 48 hours, after we become aware of a personal data breach affecting your cases.
- Delete the data at the end of processing, as set out above, unless the law requires us to keep it.
- Give you the information you need to show we meet these terms, and answer reasonable audit questions in writing.
Sub-processors
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Application server and database | Germany |
| Cloudflare, Inc. | Statement file storage and backups (R2) | Western Europe |
| OpenRouter, Inc. | Routing statement pages to AI models | United States |
| Google LLC | AI model (Gemini) that reads the statements | United States / global |
| Anthropic PBC | AI model (Claude) used for some checks | United States |
Where a sub-processor is outside the UK, the transfer relies on the safeguards UK data protection law provides for, such as UK adequacy regulations or the International Data Transfer Agreement.
Your side
You confirm you have a lawful basis to share your client's statements with us for a business finance enquiry, and that your client has been told their statements will be checked this way.
Contact
Data protection questions: support@exactsum.com. If you need these terms signed as a separate document, ask and we'll send a copy.