Privacy Policy

Last updated: 30 July 2026

1. Who we are

DataVance (ABN 16 787 418 307) operates the DVAP (DataVance Accounts Payable) API and its related products, distributed through API marketplaces. This policy explains how we handle personal information under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where it applies to you, the EU/UK GDPR. Contact: [email protected].

2. What we collect

• Account and usage data — organisation name, contact details, plan, hashed API keys (we store only a cryptographic hash, never the key itself), and usage records (endpoint called, timestamp).
• Document data — invoices and receipts you submit for processing, and the data extracted from them: vendor names, amounts, dates, and line items. These may contain personal information about individuals named in the documents. Bank details and ABNs/tax IDs are not stored: they are returned once in the API response, then reduced to a keyed cryptographic fingerprint (HMAC-SHA256 with a secret held outside the database) plus the last 4 digits for display. The raw values cannot be recovered from what we keep.
• Derived records — validation results, duplicate and fraud indicators, PO-matching results, approval decisions, and an append-only audit log of processing events.
• Marketplace data — if you subscribe via a marketplace (e.g. RapidAPI), we receive your marketplace username and subscription tier; the marketplace handles billing and its own data under its own privacy policy.
• Website analytics — our website (datavance.com.au) uses Cloudflare Web Analytics to count page views and referrers. It sets no cookies, does not track you across sites, and does not build a profile of you; Cloudflare processes the request (page, referrer, browser type, and a country derived from your IP address) to produce aggregate counts. This applies to the website only — the API itself carries no analytics.
• Server logs — our hosting provider records standard request logs. Where a marketplace does not identify its subscribers to us, we also log which request header names that marketplace forwards, so we can tell whether subscriber identification is possible; header values are withheld from those log entries apart from a small set of non-identifying technical headers.

3. How we use it

To provide the service (extraction, validation, fraud screening, matching, approvals, export), enforce quotas and rate limits, secure and audit the service, respond to support requests, and improve the service. Our published accuracy metrics are computed from public benchmark datasets and synthetic documents — never from customer documents.

4. AI processing and service providers

• Anthropic (USA) — document content is sent to Anthropic's Claude API for data extraction. Anthropic processes it as a service provider and does not use API content to train its models without consent; see Anthropic's usage policies for its retention practices.
• Fly.io — hosting. Stored data (extracted data, derived records, audit log) is held in the Sydney, Australia region on encrypted volumes.
• Cloudflare (USA) — DNS, CDN, and TLS for the website, plus the cookieless Web Analytics described above. Website traffic passes through Cloudflare's network, so it processes visitor IP addresses in transit. API traffic to our marketplace-served endpoints does not pass through Cloudflare.
• RapidAPI (USA) — marketplace authentication and billing for marketplace subscribers.
• Zyla API Hub (Zyla Labs, USA) — marketplace authentication and billing for marketplace subscribers.
• API.market (USA) — marketplace authentication and billing for marketplace subscribers.

Cross-border disclosure (APP 8): document content transits to Anthropic in the United States for extraction; our stored records remain in Australia.

5. Retention

We retain your data while your account is active. Audit events are append-only by design (they cannot be edited through the API). On written request — or 30 days after termination — we delete your organisation's stored data, except where we are legally required to retain it. Deletion covers every record we hold for your organisation: processed invoices and their line items, vendor records and fingerprints, purchase orders, goods receipts, approvals, duplicate-check fingerprints, webhook subscriptions, usage records, audit events, and API keys.

Duplicate-check fingerprints: the duplicate-check endpoint stores a fingerprint of each document you check (file hash, invoice number, total, vendor name — never the document) so later submissions can be matched against it. These fingerprints are retained for 365 days from the date of the check and are then deleted automatically, whether or not your account is still active. Pass remember=false to check a document without storing a fingerprint at all.

6. Security

TLS for all traffic, encrypted storage volumes, API keys stored only as hashes, vendor bank details and tax IDs stored only as keyed fingerprints (never raw), HMAC-signed webhook deliveries, and role-based access controls on API keys.

7. Your rights

You may request access to or correction of personal information we hold (APP 12–13). If the GDPR applies to you, you also have rights of erasure, portability, restriction, and objection. Write to [email protected]; we respond within 30 days. If you are unsatisfied with our response you may complain to the Office of the Australian Information Commissioner (OAIC).

8. Changes

We may update this policy; the "last updated" date above reflects the current version. Material changes will be notified via the marketplace listing or your contact email.