Subprocessor List

1. What Is a Subprocessor?

A subprocessor is a third-party service provider engaged by Re-Doc to perform a specific service on our behalf.

Subprocessors may help us with activities such as:

• ·cloud hosting;
• ·authentication;
• ·payment processing;
• ·analytics;
• ·OCR and document extraction;
• ·PDF/DOCX conversion;
• ·AI-assisted document processing;
• ·infrastructure operations;
• ·security and reliability; and
• ·customer support.

Some subprocessors may process uploaded documents, extracted text, generated outputs, filenames, document metadata, account information, billing information, technical logs, or analytics data depending on the function they provide. Subprocessors are used only where necessary to provide, secure, operate, or improve the Services.

2. Why Re-Doc Uses Subprocessors

Re-Doc is a document anonymization and redaction platform. To provide document processing workflows reliably, the platform may need to perform multiple technical operations.

Depending on the document type and workflow selected by the customer, Re-Doc may need to:

• ·host uploaded documents temporarily;
• ·extract text from scanned or image-based documents;
• ·analyze document structure and layout;
• ·convert files between supported formats;
• ·identify sensitive information;
• ·perform redaction, anonymization, pseudonymization, or replacement;
• ·generate output files;
• ·authenticate users;
• ·process payments;
• ·understand product usage; and
• ·maintain platform security and reliability.

Re-Doc uses subprocessors to perform some of these specialized functions.

3. When Document Content May Be Shared

Some subprocessors may receive document content because the function they perform requires access to the document, extracted text, or generated output.

Document content may be processed by subprocessors when required for:

• ·OCR;
• ·document extraction;
• ·layout analysis;
• ·file conversion;
• ·AI-assisted entity detection;
• ·AI-assisted anonymization;
• ·AI-assisted pseudonymization;
• ·AI-assisted text replacement;
• ·redaction support;
• ·output generation; or
• ·troubleshooting a failed processing job.

Where possible, Re-Doc limits the information shared with subprocessors to the information necessary for the specific processing workflow.

4. When Document Content Is Not Shared

Re-Doc does not intentionally share uploaded document contents with subprocessors that do not need document content to perform their role.

For example, uploaded document contents are not intentionally shared with:

• ·payment processors;
• ·website analytics providers;
• ·authentication providers;
• ·standard product analytics tools; or
• ·marketing tools.

These providers may process account information, billing information, session information, usage information, or technical metadata, but they are not used to process uploaded document contents.

5. Current Subprocessors

The following table describes Re-Doc's current main subprocessors.

6. Document Processing Subprocessors

Certain subprocessors are used only when required by the customer's selected workflow.

For example:

• ·if a document is scanned or image-based, OCR or document extraction may be required;
• ·if a document must be converted between PDF and DOCX, document conversion may be required;
• ·if a workflow requires contextual detection or anonymization, AI-assisted processing may be required;
• ·if output files need to preserve layout or structure, conversion or document transformation may be required.

Not every document passes through every subprocessor. The subprocessors involved depend on:

• ·file type;
• ·document structure;
• ·whether the document is text-searchable;
• ·selected redaction or anonymization workflow;
• ·requested output format;
• ·customer configuration;
• ·technical processing requirements; and
• ·enterprise-specific settings, where applicable.

7. AI Processing and Zero Data Retention

Re-Doc may use OpenRouter and selected AI model providers to support AI-assisted document processing.

AI-assisted processing may be used for:

• ·entity detection;
• ·sensitive information identification;
• ·contextual analysis;
• ·anonymization;
• ·pseudonymization;
• ·text replacement;
• ·redaction support;
• ·classification;
• ·output generation; and
• ·related document-processing tasks.

Where supported by the relevant provider and configuration, Re-Doc routes AI-assisted processing through Zero Data Retention or similar provider-side settings designed to limit retention of prompts, extracted text, document content, and model outputs.

Because provider capabilities and routing options may vary, Re-Doc may restrict AI processing to providers, endpoints, or model configurations that are appropriate for the customer's workflow, subscription, or enterprise agreement.

8. OCR and Document Extraction

Re-Doc may use OCR and document extraction providers to process scanned documents, image-based documents, forms, tables, or documents where structure and layout need to be extracted.

OCR and document extraction may involve processing:

• ·uploaded document files;
• ·document images;
• ·page images;
• ·extracted text;
• ·table structures;
• ·layout information;
• ·confidence scores; and
• ·related document analysis outputs.

Re-Doc currently uses Microsoft Azure Document Intelligence for OCR, layout analysis, and document extraction where required by the workflow.

9. Document Conversion

Re-Doc may convert documents between supported formats where required to preserve layout, support downstream processing, or generate the requested output.

This may include, for example, converting PDF files to DOCX format for processing and converting DOCX files back to PDF format for delivery.

Document conversion is performed only where required for the selected workflow.

Document conversion may involve processing:

• ·uploaded files;
• ·temporary conversion files;
• ·converted DOCX files;
• ·converted PDF files;
• ·document images;
• ·embedded objects;
• ·tables;
• ·headers;
• ·footers;
• ·formatting; and
• ·layout-related content.

Re-Doc currently uses Adobe PDF Services for PDF/DOCX conversion and related document transformation where required. Where applicable, Re-Doc uses available delete functionality after processing. Adobe may also apply its own transient retention practices for assets processed through its services.

10. Hosting and Storage

Re-Doc's primary application and document-processing infrastructure is hosted on cloud servers located within the European Union.

Uploaded documents and generated outputs are temporarily stored in Re-Doc's active processing systems for the limited retention period described in the Privacy Policy.

Unless deleted earlier or agreed otherwise, uploaded documents and generated outputs are retained for up to 30 days.

Uploaded documents and generated outputs are not intentionally included in Re-Doc's code or application backups.

11. Authentication Providers

Re-Doc uses Google Sign-In for authentication. When a user signs in using Google, Re-Doc receives only the information necessary to authenticate the user and maintain the Re-Doc account, such as name, email address, authentication identifier, and profile information authorized by the user.

Google authentication is not used to process uploaded document contents.

Re-Doc does not access a user's Gmail, Google Drive, Google Calendar, Google Contacts, or other Google services unless separately disclosed and explicitly authorized.

12. Payment Providers

Re-Doc uses third-party payment providers such as Razorpay and PayPal to process payments.

Payment providers may process:

• ·billing details;
• ·payment method information;
• ·transaction identifiers;
• ·payment status;
• ·refund information;
• ·invoice details;
• ·tax-related information; and
• ·payment-related metadata.

Re-Doc does not store complete credit card or debit card numbers on its own systems.

Payment providers are not used to process uploaded document contents.

13. Analytics Providers

Re-Doc uses analytics providers such as Google Analytics and Microsoft Clarity to understand website usage, product flows, performance, usability, and user experience.

Analytics providers may process:

• ·page views;
• ·session data;
• ·browser information;
• ·device information;
• ·approximate location;
• ·clicks;
• ·scrolling;
• ·navigation events;
• ·referral source;
• ·feature usage; and
• ·performance signals.

Analytics providers are not used to intentionally process uploaded document contents, generated outputs, or extracted document text.

Re-Doc does not use uploaded documents or generated outputs for advertising profiling.

14. Access to Customer Content by Subprocessors

Subprocessors may access customer content only where required to perform the service for which they are engaged.

For example:

• ·a hosting provider may store uploaded files and generated outputs;
• ·an OCR provider may process a scanned document to extract text;
• ·a conversion provider may process a PDF to generate a DOCX or convert a DOCX back into PDF;
• ·an AI provider may process extracted text or relevant content to identify sensitive information or support anonymization;
• ·a support or infrastructure provider may process logs or operational records.

Re-Doc does not authorize subprocessors to use uploaded documents for their own unrelated purposes.

15. Retention and Deletion

Re-Doc applies the retention practices described in its Privacy Policy.

Unless deleted earlier or agreed otherwise:

• ·uploaded documents are retained for up to 30 days;
• ·generated outputs are retained for up to 30 days;
• ·account information is retained while the account remains active or as otherwise required;
• ·billing records are retained as required for tax, accounting, payment, or legal purposes;
• ·logs and technical records may be retained for operational, security, and support purposes.

Customers may request earlier deletion of uploaded documents and generated outputs, including immediate deletion where technically supported.

Deletion by Re-Doc does not necessarily control retention by third-party payment providers, analytics providers, or other providers that independently retain records for legal, security, billing, or compliance purposes.

16. International Processing

Re-Doc is operated by a company incorporated in India. Customer documents are primarily stored and processed on Re-Doc-controlled infrastructure located within the European Union.

Certain subprocessors may process information in other jurisdictions where required to provide OCR, document conversion, AI-assisted document processing, authentication, analytics, payments, security, or infrastructure services.

Re-Doc does not intentionally transfer uploaded documents to India for document storage or document processing.

Where Re-Doc engages subprocessors outside the customer's jurisdiction, Re-Doc takes reasonable steps designed to ensure that appropriate contractual, technical, or organizational safeguards are in place.

Enterprise customers may receive additional transfer terms through a Data Processing Addendum or written agreement.

17. Subprocessor Changes

Re-Doc may update its subprocessors from time to time as the Services evolve, new features are introduced, providers are replaced, or infrastructure changes are made.

Examples of subprocessor changes may include:

• ·adding a new OCR provider;
• ·changing an AI model provider;
• ·replacing a payment processor;
• ·adding a monitoring or security provider;
• ·changing hosting infrastructure;
• ·adding a provider for a new product feature; or
• ·removing a provider that is no longer used.

Where required by applicable law, contract, or enterprise agreement, Re-Doc will provide notice of material subprocessor changes.

Enterprise customers may receive specific subprocessor notice rights through a separate Data Processing Addendum or written agreement.

18. Customer Objections and Questions

If you have questions about Re-Doc's subprocessors or how a specific provider may process information, you may contact us at:

support@re-doc.com

Enterprise customers with contractual subprocessor objection rights should follow the process described in their Data Processing Addendum or written agreement.

If a customer objects to a new subprocessor, Re-Doc will review the objection in good faith and determine whether a reasonable alternative, configuration, or contractual resolution is available.

Some subprocessors are essential to providing the Services. If Re-Doc cannot provide the Services without a required subprocessor, the customer may need to stop using the affected feature or terminate the affected service in accordance with the applicable agreement.

19. Relationship With Other Documents

This Subprocessor List forms part of Re-Doc's privacy and trust documentation. It should be read together with:

• ·Privacy Policy;
• ·Terms of Service;
• ·Cookie Policy, if applicable;
• ·Security and Trust documentation;
• ·Upload consent notice;
• ·Data Processing Addendum, where applicable; and
• ·any enterprise agreement between Re-Doc and the customer.

If there is a conflict between this Subprocessor List and a signed enterprise agreement or Data Processing Addendum, the signed agreement will apply to the extent of that conflict.

20. Contact

For questions about this Subprocessor List, data handling, deletion, or enterprise security review, contact: