Data Processing Addendum (DPA)

1. Scope and Applicability

This DPA governs the processing of Customer Data by MERAKAN in connection with the MERAKAN Lite Service where MERAKAN processes such data on behalf of the Customer.

This DPA does not apply to information that MERAKAN processes independently for its own legitimate business purposes, including:

• account administration;
• billing and payment administration;
• security and abuse prevention;
• legal and compliance obligations;
• Service administration;
• maintaining acceptance and contractual records; or
• other processing for which MERAKAN acts as an independent controller, business, or equivalent role under applicable law.

The parties intend this DPA to govern only the processing relationship described in this document and not to expand the Service or create obligations unrelated to the Service.

2. Roles of the Parties

For Customer Data processed solely on behalf of the Customer:

• the Customer determines the purposes and principal means of processing;
• the Customer is responsible for providing lawful instructions;
• MERAKAN acts as the Customer's processor, service provider, or equivalent role where applicable under law; and
• MERAKAN processes Customer Data in accordance with the Customer's documented instructions and the contractual terms governing the Service.

Where MERAKAN processes information for its own independent purposes, MERAKAN may act as an independent controller, business, or equivalent role as described in the Privacy Policy.

3. Customer Data

“Customer Data” has the meaning given in the Terms (Section 14). References to “Customer Content” in this DPA mean Customer Data.

Customer Data may include information contained in invoice and receipt images uploaded by authorized Customer users.

The Customer determines what Customer Data it submits to the Service.

4. Customer Responsibilities

The Customer is responsible for:

• determining whether use of the Service is appropriate for its data;
• ensuring that it has the necessary rights and permissions to submit Customer Data;
• providing any required notices to individuals;
• obtaining any required consents or authorizations;
• providing lawful and appropriate processing instructions;
• ensuring that Customer Data is reasonably necessary for the intended use;
• complying with applicable retention obligations;
• maintaining appropriate copies of important business records; and
• ensuring that its users comply with the Terms and Acceptable Use Policy.

The Customer must not instruct MERAKAN to process data in a manner that violates applicable law or the contractual terms governing the Service.

5. Processing Instructions

MERAKAN may process Customer Data as necessary to:

• provide MERAKAN Lite;
• receive and process uploaded invoice and receipt images;
• perform AI-assisted extraction and related processing;
• return extracted or processed results;
• provide account and Service functionality;
• maintain and secure the Service;
• prevent abuse and unauthorized access;
• troubleshoot and maintain the Service; and
• comply with documented Customer instructions consistent with the Service.

MERAKAN may process Customer Data as otherwise necessary to perform the Customer's agreement with MERAKAN, where permitted by applicable law.

6. Nature and Purpose of Processing

The principal processing activities include receiving Customer Content; storing Customer Content; transmitting Customer Content to authorized processing infrastructure; performing image and AI-assisted extraction; returning extraction results; maintaining temporary upload and extraction queue records; providing access controls and account functionality; maintaining operational and security records; and deleting Customer Data according to the applicable retention schedule.

The nature and purpose of processing are further described in Annex 1.

7. Categories of Data Subjects

Depending on the Customer's use of the Service, Customer Data may relate to:

• Customer employees;
• Customer contractors;
• Customer representatives;
• Customer vendors or suppliers;
• Customer customers;
• individuals identified in invoices or receipts; and
• other persons whose information is contained in Customer-submitted documents.

The Customer determines which categories of individuals are included in Customer Data.

8. Categories of Personal Data

Depending on the Customer’s use of the Service, Customer Data may contain names; business contact information; invoice and receipt information; transaction details; business addresses; dates; amounts; product or service descriptions; document identifiers; customer names and phone numbers entered manually on sales invoices; free-text notes; attachment images; and other information contained in supported invoice or receipt images.

The Customer determines which personal data is submitted and must minimize information that is not reasonably necessary for the intended Service purpose.

9. Special or Highly Sensitive Data

MERAKAN Lite is not designed as a specialized system for processing:

• medical records;
• biometric databases;
• government identification databases;
• authentication credentials;
• financial account credentials; or
• similarly highly sensitive datasets unrelated to invoice and receipt extraction.

Customers should not intentionally submit such information unless its processing is necessary, lawful, and consistent with the Service's intended functionality and applicable contractual restrictions.

10. Duration of Processing

MERAKAN will process Customer Data for the duration of the applicable Customer relationship and as otherwise necessary to provide the Service.

After account deletion or termination, Customer Data will be deleted according to the applicable retention schedule, subject to:

• temporary processing requirements;
• backup retention;
• security and fraud-prevention records;
• legal obligations; and
• other limited retention expressly described in the Privacy Policy and Terms.

11. Retention and Deletion

The applicable retention and deletion schedule is set out in Annex 4. MERAKAN applies the schedule to active systems subject to legal holds, security investigations, dispute preservation, provider backup cycles, and other limited exceptions expressly described in the Terms or Privacy Policy.

Deletion from active systems may occur before deletion from backups. Provider-side short-lived AI caching, where applicable, is described in Annex 3 and the Subprocessors & Service Providers Policy and is not a separate persistent MERAKAN Customer Data store.

12. Deletion Upon Termination

Following termination or deletion of the Customer account, MERAKAN will delete or render inaccessible applicable Customer Data according to the retention periods stated in the Privacy Policy and Terms.

MERAKAN is not required to immediately remove information from backup systems that are maintained for disaster recovery, security, or operational continuity, provided that such information remains subject to appropriate protection and is deleted according to the applicable backup lifecycle.

13. Confidentiality

MERAKAN will require personnel who are authorized to access Customer Data to maintain appropriate confidentiality obligations.

Access to Customer Data will be limited according to operational requirements and applicable access controls.

Nothing in this DPA prevents MERAKAN from disclosing information where disclosure is required by law.

14. Security Measures

MERAKAN maintains reasonable technical and organizational measures appropriate to the nature of the Service and Customer Data. The measures currently in place are described in Annex 2 and may evolve as the Service and underlying infrastructure develop.

MERAKAN does not represent that any security measure can eliminate all risk. Security commitments in this DPA describe reasonable safeguards, not a guarantee of absolute security.

15. Customer Security Responsibilities

The Customer remains responsible for security measures within its own environment, including:

• account credentials;
• authorized users;
• devices used to access the Service;
• internal access controls;
• secure handling of downloaded or exported information;
• appropriate configuration of Customer systems; and
• promptly reporting suspected unauthorized account access.

The Customer must not share credentials with unauthorized persons.

16. Subprocessors

MERAKAN may use authorized subprocessors to provide the Service. Current principal subprocessors that may process Customer Data include Google Cloud Platform, Google Vertex AI, Firebase / Google Identity Platform, and Google Workspace for customer correspondence. The current list and functions are set out in Annex 3 and the Subprocessors & Service Providers Policy.

Paddle acts as authorized reseller and Merchant of Record for paid website transactions and is not used to process invoice images or extracted invoice data. For the reseller relationship, Paddle is treated as an independent transaction party rather than a Customer Data subprocessor, except to the extent a different role is required for a specific transfer by applicable law or the applicable Paddle agreement.

17. Subprocessor Obligations

MERAKAN will require applicable subprocessors to process Customer Data only for authorized purposes and to maintain appropriate contractual and security protections appropriate to their role.

MERAKAN remains responsible for its contractual obligations concerning subprocessors to the extent required by applicable law and the DPA.

Subprocessors may process information in accordance with their authorized function and applicable contractual restrictions.

18. Changes to Subprocessors

MERAKAN may add, replace, or change subprocessors where reasonably necessary to operate, secure, maintain, or improve the Service.

Where reasonably practicable and contractually applicable, MERAKAN will provide at least 30 days’ advance notice of a material addition or replacement of a principal subprocessor that will process Customer Data. Notice may be given by email to account Owners and by a dated update to the published Subprocessors page.

The notice period may be shorter where reasonably necessary because of a security incident, urgent provider failure, discontinuation, legal requirement, or other circumstance in which advance notice is not reasonably practicable.

19. Subprocessor Objections

Any objection to a new or replacement subprocessor should:

• identify the specific subprocessor;
• state the reasonable data-protection concern; and
• be submitted within the applicable notice period.

MERAKAN will consider reasonable objections in good faith.

If the parties cannot reasonably resolve a material objection, the remedies available to the Customer will be governed by the Terms and applicable law.

MERAKAN does not guarantee that an alternative subprocessor will always be available.

20. AI-Assisted Processing

MERAKAN Lite uses AI-assisted technology to process supported invoice and receipt images. Document images are stored in Google Cloud Storage when uploaded and are transmitted to Google Vertex AI only when a user requests extraction.

AI-assisted output may be inaccurate, incomplete, or unexpected. All AI-generated or AI-assisted output must be reviewed and verified by a suitably qualified natural person before reliance for accounting, tax, financial, legal, operational, or other consequential purposes.

21. No AI Model Training

MERAKAN does not use Customer Data to train, fine-tune, or improve any artificial-intelligence model and does not grant any provider permission or instruction to do so.

MERAKAN may use aggregated operational statistics that do not identify a Customer or individual and contain no invoice content, such as volumes, error rates, processing times, and success rates, to operate, secure, and measure the Service.

22. Google Cloud and Vertex AI

Google Cloud and applicable Google AI services may process Customer Data as authorized subprocessors for the functions described in Annex 3 and the Subprocessors & Service Providers Policy.

MERAKAN’s use of those services is subject to Google’s applicable cloud terms and the Service configuration. AI extraction involves transmitting the applicable document image to Vertex AI through a global endpoint.

Google’s published Vertex AI data-governance documentation states that Customer Data is not used to train or fine-tune managed AI/ML models without the customer’s prior permission or instruction. Google also documents that, unless caching is disabled at the project level, Gemini models may cache inputs in memory and, for supported models, in encrypted durable storage, isolated to the project and deleted no later than 24 hours after being written. Under the Google Cloud Platform Terms of Service, Google may also log prompts to detect potential abuse and violations of its Acceptable Use Policy and Prohibited Use Policy.

23. International Processing

Customer Data may be processed in the United States and other locations where MERAKAN or its authorized subprocessors operate relevant infrastructure or services. Primary database and file storage is currently in us-central1 (Iowa, United States).

AI extraction uses a global Vertex AI endpoint; authentication, network protection, logging, and communications may use distributed Google infrastructure.

MERAKAN Lite is not currently marketed or offered to Customers established in the European Union, European Economic Area, United Kingdom, or Switzerland, and this version of the DPA does not include EU Standard Contractual Clauses or a UK transfer addendum. If the Customer’s submission of Customer Data would be subject to the GDPR, the UK GDPR, or another law requiring a specific cross-border transfer mechanism, the Customer must not submit that Customer Data unless MERAKAN has first agreed in writing to an appropriate transfer mechanism.

24. Data Subject Requests

Where applicable law requires MERAKAN to assist the Customer with a data-subject request concerning Customer Data processed on the Customer's behalf, MERAKAN will provide reasonable assistance appropriate to the Service and the nature of the request.

The Customer remains primarily responsible for responding to requests from individuals concerning Customer Data.

MERAKAN may require sufficient information to verify the request and identify the relevant Customer account or data.

25. Government and Legal Requests

If MERAKAN receives a legally binding request from a governmental authority for Customer Data, MERAKAN may disclose the information where legally required.

Where legally permitted and reasonably practicable, MERAKAN may provide notice to the Customer so that the Customer may seek appropriate protective measures.

MERAKAN is not required to provide notice where prohibited by law or where doing so would create a legal, security, or operational risk.

26. Security Incidents

If MERAKAN becomes aware of a security incident involving Customer Data that requires notification to the Customer under applicable law or this DPA, MERAKAN will notify the Customer without undue delay and within any shorter mandatory period applicable to MERAKAN in its role as processor/service provider. MERAKAN becomes aware of a security incident when it has a reasonable basis to believe that the incident has occurred and has affected Customer Data.

The notice may include information reasonably available concerning the nature of the incident, affected systems or data, known or reasonably suspected impact, measures taken, and reasonable mitigation steps. MERAKAN may supplement information as the investigation develops and is not required to provide speculative or unverified information.

27. Incident Cooperation

Where reasonably necessary and appropriate, MERAKAN will provide reasonable cooperation concerning a security incident involving Customer Data.

The Customer remains responsible for its own legal notifications, communications, and incident-response obligations unless applicable law expressly assigns such obligation to MERAKAN.

The parties will reasonably cooperate to reduce further harm.

28. Data Protection Impact Assessments

Where applicable law requires assistance with a data protection impact assessment or similar regulatory assessment concerning processing performed by MERAKAN on the Customer's behalf, MERAKAN may provide reasonable information about the relevant processing activities and security measures.

The Customer remains responsible for determining whether an assessment is required and for completing its own regulatory obligations.

29. Audits and Compliance Information

On reasonable written request, MERAKAN will provide information reasonably necessary to assess compliance with this DPA, subject to confidentiality, security, protection of other customers, protection of MERAKAN confidential information, availability of existing documentation, and reasonable limits on scope and frequency.

MERAKAN may satisfy reasonable audit or monitoring requests through existing security information, questionnaires, technical documentation, provider certifications, or other appropriate evidence. Unless required by mandatory law or expressly agreed in writing, MERAKAN does not provide unrestricted physical access, production penetration testing, or on-site audits.

A Customer may ordinarily request such compliance information no more than once in a 12-month period, except following a confirmed material security incident involving that Customer’s Data or where mandatory law requires additional review.

MERAKAN does not currently represent that it holds its own SOC 2 or ISO 27001 certification. Google Cloud certifications apply to Google infrastructure and should not be represented as MERAKAN certifications.

30. Customer Instructions

MERAKAN will follow documented Customer instructions concerning the processing of Customer Data to the extent those instructions:

• are consistent with the Service;
• are technically feasible;
• do not conflict with applicable law;
• do not require a materially different service; and
• do not impose obligations beyond the contractual scope without mutual agreement.

Instructions requiring material changes to the Service may require a separate written agreement.

31. Data Export

Customers may export applicable invoice data in Excel format using functionality made available by the Service. Individual document images can be viewed and downloaded from their document pages. Bulk export of document images is not currently provided.

The Customer remains responsible for maintaining required originals and independent copies of important records. Data availability after termination or deletion is limited by the retention schedule in Annex 4.

32. No Sale or Behavioral Advertising

MERAKAN does not sell or share Customer Data as a commercial data product and does not use Customer Data for cross-context behavioral advertising.

Where MERAKAN processes personal information as a service provider or contractor under the California Consumer Privacy Act (“CCPA”), the additional restrictions in Section 43 apply.

33. Ownership

As between MERAKAN and the Customer, the Customer retains its rights in Customer Data.

Nothing in this DPA transfers ownership of Customer Data to MERAKAN.

MERAKAN receives only the limited rights necessary to process Customer Data and provide the Service according to the Terms, this DPA, and applicable law.

34. Confidentiality and Proprietary Information

Customer Data will be treated as confidential information subject to the confidentiality provisions of the Terms.

The Customer remains responsible for identifying and protecting its own confidential information, trade secrets, and proprietary business information.

MERAKAN may disclose confidential information where required by law or as otherwise permitted under the governing agreement.

35. Liability and Indemnification

The parties' liability, indemnification, and related financial obligations are governed by the MERAKAN Lite Terms & Conditions unless a separate written agreement expressly provides otherwise.

Nothing in this DPA independently expands MERAKAN's liability beyond the applicable contractual limitations, except to the extent such limitation is prohibited by applicable law.

36. Regulatory Cooperation

The parties will reasonably cooperate concerning applicable regulatory requirements relating to processing covered by this DPA.

Neither party is required to:

• violate applicable law;
• disclose another party's confidential information;
• provide unrestricted access to systems;
• incur unreasonable costs; or
• perform services outside the agreed scope without appropriate agreement.

37. No Expansion of Service

This DPA does not:

• create new Service features;
• require MERAKAN to process unsupported data types;
• create new geographic availability;
• create an uptime guarantee;
• create a service-credit obligation;
• create a new payment method;
• require 24/7 live support; or
• otherwise expand the commercial or technical scope of MERAKAN Lite.

38. Termination

This DPA remains effective for as long as MERAKAN processes Customer Data on behalf of the Customer under the applicable Service agreement.

Upon termination, applicable Customer Data will be handled according to the deletion and retention provisions of this DPA, the Terms, and the Privacy Policy.

Provisions that by their nature should survive termination will continue to apply.

39. Amendments

MERAKAN may update this DPA where reasonably necessary to reflect:

• changes to the Service;
• changes to processing activities;
• changes to applicable law;
• changes to subprocessors;
• security or operational developments; or
• other legitimate contractual requirements.

Material amendments will be handled according to the applicable contractual change procedures.

40. Conflict and Precedence

If there is a conflict concerning Customer Data processing covered by this DPA, mandatory applicable law controls; then any expressly negotiated written data-processing agreement; then this DPA. The Terms continue to govern commercial matters, liability, intellectual property, and matters not specifically addressed by this DPA.

The Billing & Refund Policy controls MERAKAN billing administration; the Service Availability & Support Policy controls availability and support matters; the DMCA & Copyright Policy controls copyright-notice procedures; the AUP controls acceptable-use matters; and the Subprocessors & Service Providers Policy provides current provider information subject to this DPA.

41. Severability

If any provision of this DPA is determined to be invalid or unenforceable, the remaining provisions will remain in effect to the fullest extent permitted by law.

42. Governing Law

This DPA is governed by the same governing-law and dispute-resolution provisions stated in the MERAKAN Lite Terms & Conditions, except to the extent mandatory applicable law requires otherwise.

43. U.S. State Privacy and California Service-Provider Terms

This Section applies only to the extent Customer Data includes personal information subject to a U.S. state privacy law that imposes processor, service-provider, contractor, or similar contractual requirements, including the CCPA.

For CCPA-covered personal information processed on behalf of a Customer that qualifies as a “business,” MERAKAN agrees that:

• MERAKAN will process the personal information only for the specific business purposes described in Annex 1: hosting and storing Customer Data; receiving and processing supported documents; AI-assisted extraction; displaying, saving, editing, reporting and exporting Customer records; authentication and access control; security, abuse prevention, support, backup, recovery, deletion, and compliance assistance;
• MERAKAN will not sell or share such personal information as those terms are defined by the CCPA;
• MERAKAN will not retain, use, or disclose such personal information outside the specific business purposes stated in this DPA or outside the direct business relationship with the Customer, except as otherwise permitted by the CCPA and its regulations;
• MERAKAN will not combine such personal information with personal information received from or on behalf of another person or collected from MERAKAN’s own interaction with an individual, except as permitted by the CCPA and its regulations;
• MERAKAN will provide the same level of privacy protection required of service providers or contractors by applicable CCPA provisions, will notify the Customer if MERAKAN determines it can no longer meet those obligations, and will allow the Customer to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information;
• the Customer may take reasonable and appropriate steps to ensure that MERAKAN uses the personal information in a manner consistent with the Customer’s obligations under the CCPA, including through the compliance information described in Section 29;
• MERAKAN will cooperate with the Customer regarding qualifying consumer requests, cybersecurity audits, risk assessments, and other assistance required from a service provider or contractor to the extent applicable to the processing and reasonably available to MERAKAN; and
• MERAKAN will require a subcontractor processing the same covered personal information on MERAKAN’s behalf to be subject to applicable contractual restrictions appropriate to its role.

MERAKAN certifies that it understands the restrictions in this Section and will comply with them to the extent the CCPA applies to the relevant processing.

Annex 1 — Description of Processing

Annex 2 — Technical and Organisational Measures

Annex 3 — Subprocessors and Other Material Providers

Paddle is listed for transparency but is not treated as a Customer Data subprocessor for its reseller and Merchant-of-Record function. See the Subprocessors & Service Providers Policy for current details.

Annex 4 — Retention and Deletion

Annex 5 — Customer Instructions and Contact

Documented Customer instructions are the Terms, this DPA, use of configured Service functionality, and other written instructions agreed by MERAKAN that are lawful, technically feasible, and within the Service scope.

MERAKAN LLC

Registered Office: 30 N Gould St Ste R, Sheridan, WY 82801, United States

Website: www.merakan.com | Service Application: app.merakan.com

General Inquiries: info@merakan.com | Support: support@merakan.com | Billing: billing@merakan.com

Security Reports: support@merakan.com | Privacy & Data Requests: support@merakan.com

DMCA Notices: store@merakan.com

DMCA Designated Agent: Ahmad Almusalam | Phone: +1 307-381-8088 | Registration No.: DMCA-1081799

© 2026 MERAKAN LLC. All rights reserved.