Data processing terms

Pre-launch version: 29 October 2026. No real intake is open until legal/commercial and QA clearance. UK processing remains blocked pending transfer arrangements. This page does not invent a legal entity or substitute for a required executed international transfer agreement. Contact: suporte@rohnelt.dev.

Documented instructions

The customer is controller and CSV Repair is processor for uploaded bank transaction dates, signed amounts, descriptions and optional payee/reference, concerning the customer's authorised account holders and transaction counterparties. The subject matter is deterministic CSV preparation, format checks, private delivery and a limited guarantee investigation. Processing lasts for the retention period stated below. Only one account and currency per accepted batch; sensitive-category data, bank credentials and unrelated records are excluded.

Confidentiality and security

We process only the documented instructions confirmed in the private batch preview, except where law requires otherwise, and inform you of a legally required instruction where permitted. Persons with access must be bound to confidentiality. Measures include encryption at rest, restricted private storage, hashed random access tokens, HTTPS-only secure portal cookies, no financial files in email, size/row limits and authenticated deletion. We do not use the content for advertising, AI training or unrelated purposes.

Subprocessors and transfers

Hosting/processing is in Brazil. Resend, through the transactional bridge, processes email addresses and non-financial notification content. Stripe processes payments separately. No bank files go to these services. Before real intake, supplier identity, hosting arrangements and necessary subprocessor/transfer agreements must be resolved. We must give notice of a proposed additional processor, allow reasonable objection before use and impose equivalent data-protection obligations. UK restricted transfers require separately verified applicable arrangements and remain blocked.

Assistance and audit

We will reasonably assist the controller with access/erasure/other rights requests, security, breach response, impact assessments and regulatory consultations, taking into account the nature of processing and available information. We notify you without undue delay of a personal-data breach. We make information reasonably necessary to demonstrate compliance available and support proportionate audits/inspections, under confidentiality and without exposing other customers' data. Tell us if an instruction infringes applicable data-protection law; unlawful processing instructions are refused.

Return, deletion and term

You can download the paid package through the private portal and keep your originals. Unpaid intake expires in 24 hours; originals and results expire 14 days after delivery. Request earlier deletion through the portal. We delete bank-file content on expiry/termination, including private processing copies; no content backups are made. Minimum payment records required by law are retained without bank files. Obligations concerning confidentiality, deletion and statutory rights survive termination.