Privacy Policy

Last updated: 14 July 2026

1. Who we are

DataVance (ABN 16 787 418 307) operates the DVAP (DataVance Accounts Payable) API at api.dvap.datavance.com.au. This policy explains how we handle personal information under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where it applies to you, the EU/UK GDPR. Contact: support@datavance.com.au.

2. What we collect

• Account and usage data — organisation name, contact details, plan, hashed API keys (we store only a cryptographic hash, never the key itself), and usage records (endpoint called, timestamp).
• Document data — invoices and receipts you submit for processing, and the data extracted from them: vendor names, ABNs/tax IDs, bank details, amounts, dates, and line items. These may contain personal information about individuals named in the documents.
• Derived records — validation results, duplicate and fraud indicators, PO-matching results, approval decisions, and an append-only audit log of processing events.
• Marketplace data — if you subscribe via a marketplace (e.g. RapidAPI), we receive your marketplace username and subscription tier; the marketplace handles billing and its own data under its own privacy policy.

3. How we use it

To provide the service (extraction, validation, fraud screening, matching, approvals, export), enforce quotas and rate limits, secure and audit the service, respond to support requests, and improve the service. Our published accuracy metrics are computed from public benchmark datasets and synthetic documents — never from customer documents.

4. AI processing and service providers

• Anthropic (USA) — document content is sent to Anthropic's Claude API for data extraction. Anthropic processes it as a service provider and does not use API content to train its models without consent; see Anthropic's usage policies for its retention practices.
• Fly.io — hosting. Stored data (extracted data, derived records, audit log) is held in the Sydney, Australia region on encrypted volumes.
• RapidAPI (USA) — marketplace authentication and billing for marketplace subscribers.

Cross-border disclosure (APP 8): document content transits to Anthropic in the United States for extraction; our stored records remain in Australia.

5. Retention

We retain your data while your account is active. Audit events are append-only by design (they cannot be edited through the API). On written request — or 30 days after termination — we delete your organisation's stored data, except where we are legally required to retain it.

6. Security

TLS for all traffic, encrypted storage volumes, API keys stored only as hashes, HMAC-signed webhook deliveries, and role-based access controls on API keys.

7. Your rights

You may request access to or correction of personal information we hold (APP 12–13). If the GDPR applies to you, you also have rights of erasure, portability, restriction, and objection. Write to support@datavance.com.au; we respond within 30 days. If you are unsatisfied with our response you may complain to the Office of the Australian Information Commissioner (OAIC).

8. Changes

We may update this policy; the "last updated" date above reflects the current version. Material changes will be notified via the marketplace listing or your contact email.