Data Processing Addendum

Last updated: October 15, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between the customer using the direct FreeOCR.AI API platform ("Customer") and Hantian Pang, an individual trading under the name FreeOCR.AI ("FreeOCR.AI", "we", "us", or "our"), and applies where FreeOCR.AI processes Personal Data on behalf of Customer in connection with the direct FreeOCR.AI API platform.

This DPA is intended to satisfy the requirements of Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) where applicable. It applies only to Customer Personal Data that FreeOCR.AI processes on Customer's behalf through the direct API. It does not apply to ordinary use of the public website or workspace features where FreeOCR.AI acts as a controller. Business customers that require processor terms for a non-API workflow must obtain a separate written agreement before submitting Personal Data through that workflow.

If this DPA conflicts with the Terms of Service or Privacy Policy concerning the processing of Customer Personal Data, this DPA controls to the extent of that conflict.

"Customer Personal Data" means Personal Data processed by FreeOCR.AI on Customer's behalf under this DPA. "Data Protection Laws" means the privacy and data-protection laws applicable to that processing, including the GDPR and UK GDPR where applicable. "Personal Data Breach" has the meaning given by applicable Data Protection Laws. "Core API subprocessor" means a provider that processes Customer Personal Data to deliver, host, secure, or route the direct API service.

"Service Data" means account, contact, API key, credit, billing, general usage, fraud-prevention, support, and security data that FreeOCR.AI processes for its own service-operation purposes as a controller. Service Data is governed by the Privacy Policy rather than this DPA, even when it relates to a direct API customer.

1. Contact Details

• Processor: Hantian Pang, an individual trading under the name FreeOCR.AI.
• Notice Address: Songjiang District, Shanghai 201602, People's Republic of China.
• Email for legal notices: admin@freeocr.ai.

2. Roles of the Parties

Customer is the controller or processor of Personal Data submitted to the direct FreeOCR.AI API platform. FreeOCR.AI acts as a processor or sub-processor when processing Personal Data on Customer's behalf to provide OCR, table extraction, and data extraction services.

Customer is responsible for ensuring that it has a valid legal basis, appropriate notices, permissions, and instructions for the Personal Data it submits to the API.

FreeOCR.AI separately acts as a controller for Service Data. Acting as both processor and controller for different data does not change the role applicable to Customer Personal Data under this DPA.

3. Scope of Processing

• Subject matter: Processing Personal Data through the direct FreeOCR.AI API platform to provide OCR, table extraction, and data extraction functionality.
• Duration: For as long as Customer uses the direct FreeOCR.AI API platform and until Customer Personal Data is deleted or returned under Section 9, unless applicable law requires longer retention.
• Frequency: On demand whenever Customer submits a direct API request, for the duration of the request and any limited retention described in Section 9.
• Nature and purpose: Automated receipt, transmission, analysis, extraction, conversion, and return of API results.
• Categories of data subjects: Customer's end users, employees, contractors, customers, suppliers, or other individuals whose data appears in uploaded documents.
• Categories of Personal Data: Uploaded images or documents, text and other Personal Data contained in those documents, requested extraction fields, and generated OCR or extraction output. Service Data is excluded from this list and is handled under the Privacy Policy.

4. Customer Instructions and Restrictions

Customer instructs FreeOCR.AI to process Personal Data only as necessary to provide and secure the direct FreeOCR.AI API processing and comply with applicable law. FreeOCR.AI will not use Customer Personal Data for advertising, analytics, or training or improving AI models. Infrastructure and AI inference providers may process Customer Personal Data only as necessary to provide, secure, diagnose, maintain, or improve the reliability of their services under their applicable terms. FreeOCR.AI does not authorize them to use direct API content to train AI models.

FreeOCR.AI does not intentionally store Customer Personal Data in its application database and does not routinely access or review API document payloads or outputs. Customer support does not include access to that content. If troubleshooting is required, Customer should provide redacted, anonymized, or synthetic examples separately and must not send live Personal Data in a support message.

If applicable law requires processing beyond Customer's documented instructions, FreeOCR.AI will inform Customer before that processing unless the law prohibits notice on important grounds of public interest.

Customer must not submit Special Category Data, protected health information, payment card data, or other regulated or highly sensitive data through the direct API. Such processing is outside the scope of Customer's documented instructions accepted by FreeOCR.AI and is not authorized under this DPA.

The Service is not designed or approved for such processing and is not represented as HIPAA-compliant, PCI DSS-compliant, or as satisfying another specialized regulatory framework. If Customer submits such data despite this prohibition, Customer breaches this DPA and remains responsible, to the maximum extent permitted by law, for the lawfulness of the data and the consequences arising from that submission. Nothing in this DPA excludes liability or data-subject rights that cannot lawfully be excluded.

5. FreeOCR.AI Processor Obligations

• Process Personal Data only on documented instructions.
• Promptly inform Customer if, in FreeOCR.AI's opinion, an instruction infringes applicable Data Protection Laws, unless the law prohibits that notice.
• Ensure persons authorized to process Personal Data are subject to confidentiality obligations.
• Implement appropriate technical and organizational measures considering the nature, scope, context, and purposes of processing.
• Assist Customer, where reasonably possible, with data subject requests, security obligations, breach notifications, data protection impact assessments, and regulatory inquiries.
• Notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.
• Delete or return Customer Personal Data as required by applicable law and this DPA, and delete existing copies unless applicable law requires retention.
• Make available information reasonably necessary to demonstrate compliance with this DPA and allow and contribute to audits as described below.

6. Subprocessors

Customer authorizes FreeOCR.AI to engage subprocessors to provide the direct API platform. FreeOCR.AI remains responsible for its subprocessors' performance of their data protection obligations to the extent required by applicable Data Protection Laws.

FreeOCR.AI will impose data-protection obligations on each subprocessor that are no less protective in substance than the obligations in this DPA for the processing it performs.

FreeOCR.AI will provide reasonable advance notice of a new or replacement Core API subprocessor through the Customer's account email, the developer dashboard, or another reasonable service notice. Customer may object within 15 days on reasonable data-protection grounds. The parties will work in good faith to address the objection. If no reasonable alternative is available, Customer may stop using the affected API service. A subprocessor change required urgently for security, availability, or legal compliance may take effect sooner, with notice provided as soon as reasonably practicable.

Vercel may separately process request metadata and operational logs as Service Data. Supabase and Upstash process Service Data for account, API key, metering, balance, security, and rate-limit functions; they do not intentionally receive direct API document payloads or OCR outputs. Billing, analytics, and marketing providers such as Paddle and PostHog likewise do not receive direct API document payloads or OCR outputs. These providers process controller-side data described in the Privacy Policy and are not Core API subprocessors under this DPA.

7. International Transfers

Hantian Pang trading as FreeOCR.AI is established in China, but direct API document payloads and outputs are not intentionally routed to or stored in China. Depending on the infrastructure and inference provider used, direct API processing may occur in the United States, Malaysia, Indonesia, the EU/EEA, or another disclosed location.

This public DPA does not by itself execute the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another customer-specific transfer instrument. If Customer is subject to EU/EEA, UK, Swiss, or other restricted-transfer requirements, Customer must contact FreeOCR.AI and the parties must complete any required transfer mechanism before Customer submits affected Personal Data through the direct API.

Where required, FreeOCR.AI will use applicable contractual transfer mechanisms made available by its subprocessors and provide reasonable information to support Customer's transfer assessment. Until an applicable customer-level transfer mechanism has been completed, Customer must not submit Personal Data subject to such transfer restrictions.

8. Technical and Organizational Measures

• HTTPS/TLS encryption for data in transit.
• API key authentication for direct API requests.
• Rate limiting and abuse prevention controls.
• Least-privilege access practices for production systems.
• Use of managed infrastructure providers with their own security controls, access controls, monitoring, and incident response processes.
• No intentional storage of API document payloads or OCR outputs in FreeOCR.AI's application database after processing, subject to temporary technical handling, security and abuse-prevention processing, subprocessor content-safety processing, and legal compliance.
• Separation of API usage/account records from API document payloads where technically practicable.
• Administrative access to API account, usage, and infrastructure systems restricted to persons with an operational, security, or compliance need. FreeOCR.AI personnel do not routinely access or review API document payloads or outputs.

9. Data Deletion

FreeOCR.AI does not intentionally retain API document payloads or OCR outputs after processing is completed. FreeOCR.AI may separately retain account, API key, credit, top-up, usage, billing, and security records that it processes as an independent controller for service operation, fraud prevention, support, tax, accounting, legal compliance, and dispute resolution. Subprocessor deletion and retention periods may apply according to their applicable terms and documentation.

At the end of the services involving Customer Personal Data, FreeOCR.AI will, at Customer's choice, delete or return Customer Personal Data that remains under FreeOCR.AI's control, unless applicable law requires retention. FreeOCR.AI will continue to protect retained data and will not process it for other purposes. Because API document payloads and outputs are not intentionally retained after processing, they may no longer be available for return. Backup copies, if any, will be put beyond active use and deleted through the ordinary backup lifecycle. On reasonable request, FreeOCR.AI will confirm completion of deletion or return.

10. Compliance Information and Audits

On reasonable written request, FreeOCR.AI will provide information reasonably necessary to demonstrate compliance with this DPA, including available security or subprocessor documentation.

Customer may conduct an audit no more than once in any 12-month period, except where required by a supervisory authority or following a reasonably suspected Personal Data Breach. Audits must be conducted on at least 30 days' written notice, during normal business hours, by Customer or an independent auditor bound by confidentiality, and in a manner that avoids unreasonable disruption and protects other customers' information. Customer bears its audit costs unless applicable law requires otherwise. The parties may first use current third-party reports, certifications, and written responses where they reasonably address the requested audit scope.

11. DPA Acceptance

This DPA may be accepted electronically. If Customer requires this DPA for GDPR Article 28 documentation, Customer may confirm acceptance by email to admin@freeocr.ai, referencing the Customer's account email, legal name, company name where applicable, intended direct API usage, and the date or version of the DPA being accepted. The acceptance must be sent by a person authorized to bind Customer and must clearly state that Customer accepts this DPA.

Continued direct API usage after acceptance of this DPA is governed by this DPA, the Terms of Service, Privacy Policy, Refund Policy, and any applicable written agreement between the parties.

12. Changes

FreeOCR.AI may update this DPA from time to time. Material updates will be reflected by updating the "Last updated" date. If a material change adversely affects Customer's rights under this DPA, Customer may contact FreeOCR.AI at admin@freeocr.aito discuss reasonable alternatives.