Privacy Notice

Effective version: 27 September 2026. MicroExtract is offered by Micro AI Agency Singapore, a brand of WORKFLOW AUTOMATION PTE. LTD. (UEN 202633458D), 7 Temasek Boulevard, #12-07 Suntec Tower One, Singapore 038987. The canonical approved notice is also published at app.microextract.ai/legal/privacy.md.

1. Our roles

For account administration, authentication, billing, security, product operations and direct support, Workflow Automation Pte. Ltd. may collect and use personal data for its own operational purposes and is responsible for those activities under applicable law.

For personal data contained in business documents that a customer uploads and instructs MicroExtract to process, Workflow Automation Pte. Ltd. generally processes that information on behalf of the customer. The customer remains responsible for determining whether it has lawful authority to submit and process that information.

Specific Enterprise arrangements may further define these roles in a Data Processing Agreement.

2. Personal data we may process

• Name, business email address and authentication information
• Organisation and workspace membership information
• Google OAuth identity information where Google Sign-In is chosen
• Uploaded business documents and document metadata
• Personal data appearing within uploaded documents
• Extracted and validated structured data
• Customer-supplied templates and mappings
• Job status, audit, usage and operational information
• Subscription and billing identifiers
• Security, diagnostic and availability logs
• Support messages and account-data requests

We do not need or request payment-card details directly where payment information is collected by Stripe through its hosted payment services.

3. Why we process data

• Create and authenticate accounts
• Provide customer workspaces
• Process uploaded documents and generate requested outputs
• Enforce plan entitlements and usage limits
• Provide billing and subscription management
• Secure the Service and prevent abuse
• Troubleshoot and improve reliability
• Respond to support, access, correction, export and deletion requests
• Comply with law and enforce agreements

4. AI processing

MicroExtract currently uses the OpenAI API for document extraction workflows. Customer document content may be transmitted to OpenAI when required to perform the requested extraction. Current MicroExtract extraction requests use store:false.

Workflow Automation Pte. Ltd. does not use Customer Content to train or improve general-purpose or foundation AI models unless the customer separately and expressly agrees in writing.

Provider handling remains subject to the applicable provider terms and the configuration used for the Service.

5. Authentication

MicroExtract uses Supabase for authentication and related account services. Users may authenticate with verified email/password credentials. Google OAuth is also available for users who choose Google Sign-In. MicroExtract authentication emails are delivered using Elastic Email under MicroExtract branding.

6. Payments

Stripe is used for paid self-service subscriptions, checkout, subscription management and billing webhooks. Stripe may process payment and billing information under its own terms and privacy obligations.

7. Infrastructure and service providers

MicroExtract uses service providers to operate the Service. The approved service documentation identifies providers verified in production, including Supabase, Cloudflare, OpenAI, Stripe, Google and Elastic Email.

We will not publish an unverified processing-location commitment. Material processing-location and transfer wording must match the verified production configuration.

8. Overseas transfers

Some service providers may process information outside Singapore. Where the Singapore Personal Data Protection Act applies, Workflow Automation Pte. Ltd. will take steps appropriate to its role to ensure overseas transfers are made in accordance with applicable transfer requirements, including contractual or other legally recognised safeguards where required.

Enterprise customers requiring a specific residency arrangement must have that requirement expressly agreed and technically validated.

9. Retention

We retain personal data only for as long as reasonably required for the purposes for which it is processed, legitimate operational requirements and applicable legal obligations.

Current product configuration provides customer-visible job history windows of:

• Free: 7 days
• Pro: 30 days
• Business: 90 days
• Enterprise: 365 days

For standard self-service plans, uploaded source documents, generated customer artifacts and normal job-history records are retained according to the applicable history window above and are then eligible for automated deletion from active systems. Customer templates may be retained while the workspace remains active because they are customer configuration assets.

Security and diagnostic logs are normally retained for up to 180 days unless a longer period is reasonably required for investigation, dispute resolution, legal hold or compliance. Financial, tax and transaction records may be retained for at least the period required by applicable law.

The production Supabase project is hosted in Singapore. Supabase Pro database backups are available on a rolling 7-day daily-backup basis. Supabase database backups do not include Storage objects. MicroExtract additionally maintains a same-region warm logical DR copy of relevant MicroExtract data and storage objects with a 30-day retention lifecycle. Residual deleted data may remain in protected backup or DR copies until the applicable backup expires and is not used for ordinary production processing.

10. Access, correction, export and deletion

Where applicable, individuals may request access to or correction of personal data in accordance with the Personal Data Protection Act and applicable exceptions. MicroExtract also provides customer account-data export and deletion request controls. Users who cannot access the application can use the public MicroExtract account deletion resource.

Deletion requests are verified and approval controlled. They do not immediately destroy data. Our operational target is to complete valid verified deletion requests from active systems within 30 days, subject to applicable legal retention requirements, security investigations, disputes, legal holds and the documented backup lifecycle.

11. Security

We use technical and organisational controls designed to protect information against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks. No online service can guarantee absolute security.

12. Data incidents

We maintain incident-response processes to assess suspected personal-data breaches and will make notifications required by applicable law.

13. Cookies and local browser storage

MicroExtract uses browser and security technologies necessary for authentication, session management, abuse prevention and application operation.

The authenticated MicroExtract application does not currently include third-party advertising trackers or optional web-analytics scripts. Authentication state is stored in browser session storage, and limited local browser storage is used for workspace and current-job continuity. Cloudflare Turnstile and other security technologies may process technical information necessary for abuse prevention and security. If optional analytics or advertising technologies are introduced later, this Notice and any required consent controls will be updated before those technologies are enabled.

14. Children

MicroExtract is a business service and is not intended to be used by children as a consumer service.

15. Changes

We may update this Notice when the Service, providers or legal requirements change. The applicable version and effective date will be identified in the Service.

16. Contact and Data Protection Officer

Data Protection Officer: Sam Shaikh

Privacy and data protection contact:
Workflow Automation Pte. Ltd.
Micro AI Agency Singapore / MicroExtract
7 Temasek Boulevard
#12-07 Suntec Tower One
Singapore 038987
[email protected]

Related approved documents: Terms · Retention · Subprocessors.