Data processing terms.Before any file moves.

For the exports you send, you are in control and Silentleak works on your instructions: under European rules you are the controller and we are the processor; under US state privacy laws we act as your service provider. We never sell or share your data, and never use it for anything other than your review and the claims you approve.

For our own outreach and website, Silentleak is the controller; that is covered in the privacy notice.

Purpose

Find money lost to payment providers, marketplaces, carriers and platforms; prepare claims you approve; reconcile what comes back

Data

Business records: order, invoice, transaction, dispute and parcel references, dates, amounts, statuses, SKUs

Not wanted

Names, email addresses, phone numbers, street addresses, card or bank numbers, dates of birth

How you send it

A private upload link for your company, valid 14 days, that you can ask us to revoke at any time

Every file is checked for personal data in your browser before upload and again on our server, by column names and by cell values. A file that contains personal data is deleted on arrival and never read; you are asked to remove the columns and upload again.

Supabase

Database and private file storage · European Union (Ireland)

Resend

Email delivery · European Union (Ireland)

Vercel

Website hosting · global network, no file storage

OpenRouter

Drafts readouts and claim letters for our review · receives findings only (references, dates, amounts), never files · zero data retention on every request · United States

We tell you by email at least 30 days before adding or replacing a sub-processor, so you can object.

• Files in a private storage bucket, encrypted at rest and in transit; downloads by our team use links that expire after 60 seconds.
• Upload links are stored only as a fingerprint; the link itself is shown once.
• A file must really be what it says: renamed, password-protected or scripted files are refused.
• Access to client files is limited to the principal; every download and deletion is logged.
• No logins to your systems: you send exports; we never ask for passwords or admin access.

After the readout

Files deleted within 30 days, with an emailed receipt

Without a readout

Files deleted at the latest 90 days after upload

On request

Deleted sooner whenever you ask

What stays

The findings and claims you approved (references, dates, amounts), and invoices, as long as the law requires

If we become aware of a breach affecting your data, we tell you without undue delay, with what happened, what was affected and what we are doing about it, so you can meet your own obligations. Security reports reach us at hello@silentleak.com.

We send these terms as a data processing agreement together with the review terms, before any files are shared. If your company uses its own template, send it to hello@silentleak.com and we will review it. For security questionnaires, the same address.