extraction.app

GDPR overview

The privacy policy names the GDPR explicitly and lists six rights: access, rectification, erasure, restriction, portability and objection. Those rights are exercised through the contact page only, with no dedicated privacy address. Section 3 promises appropriate technical and organisational measures in generic terms, and section 6 states that only essential cookies are used. What the policy omits is as telling as what it says: no legal basis for processing, no data protection officer, no Article 27 EU representative, no mention of transfers outside the European Union, no DPA and no subprocessor list. One further caveat: the last-updated date is generated client-side, so it always renders the day you happen to read the page and therefore dates nothing. The framework is declared, but only partly evidenced.

Who owns the data?

Ownership of the files you upload is never stipulated. The privacy policy states only that extraction.app collects the email address given at registration and the documents submitted for extraction; it claims no licence over those documents and it disclaims none either. Because no terms of service exist, there is no second document to settle the point, so nothing on the site assigns rights over uploaded files or extracted output to either party. The one concrete control the publisher commits to is deletion: users can remove their files at any time. Anyone submitting client or third-party documents is therefore working without a written ownership clause to rely on.

Reuse rights

The privacy policy declares four uses: processing extraction requests, improving the publisher's AI services, sending account notifications, and security. Elsewhere the site states that files are processed securely and that customer data is never used to train external AI models. The two statements coexist rather than cancel each other out: external models are excluded, internal improvement of the publisher's own AI services stays open, and no page says whether that improvement draws on submitted documents. No training opt-out is documented and no setting exposes one. On the user's side, nothing published limits reuse of the extracted output, which comes back as Excel, CSV or JSON downloads, but with no terms of service that freedom rests on silence rather than on a granted right.

Data retention & training

Hosting summary

No hosting location is declared. Neither the privacy policy nor any other page names a country, a region, a cloud provider or a data centre for the storage of uploaded files or account data. Section 3 of the policy commits to appropriate technical and organisational measures without naming a single one, and the FAQ adds that data is encrypted in transit and at rest; both statements describe protection, not jurisdiction. Nothing addresses transfers outside the European Union, and no subprocessor list is published, so the chain of custody beyond the publisher is undocumented. One technical observation, outside anything the publisher declares: the domain is served behind Cloudflare's anycast network, which says nothing about where files are actually stored. A buyer with a data residency requirement will find no answer on the site to point to, and no DPA in which one could be committed.