Building a custom email extractor for PDF and document workflows

Australian businesses often receive the same contact details in quotes, invoices, statements of work, supplier forms, and scanned documents. A custom email extractor can convert those files into structured records, saving teams from re-entry when a Sydney consultancy receives supplier PDFs or a Melbourne agency circulates Word proposals for client review.

The workflow combines document parsing, OCR, pattern recognition, normalisation, verification, and data provenance while retaining a link back to each source. Its purpose should be narrow: process documents your organisation owns or has permission to use, rather than indiscriminately harvesting addresses from public sites, gated portals, or leaked files.

Selecting an extraction method

Start by matching the parser to the document type. PDFs with a text layer are usually fastest, while image-only scans need OCR; Office files and spreadsheets require format-aware readers rather than a single generic parser.

Input	Best extraction route	Advantage	Main limitation
Native PDF	Read text objects and coordinates	Fast and usually accurate	Confusing reading order
Scanned PDF	Render, deskew and apply OCR	Handles paper files	OCR errors and higher processing cost
DOCX or PPTX	Parse the package XML	Preserves clean text	Misses text embedded in images
Email bundle	Walk MIME attachments	Handles mixed files	Nested formats and failed attachments

Hybrid inputs are common in Australian offices: a proposal may mix editable paragraphs, charts, and signature images, while a shared-drive invoice may be an emailed PDF. Route each page by content, retain page and bounding-box coordinates, and keep the original file so reviewers can resolve ambiguous OCR without repeating the entire job.

Designing the document ingestion pipeline

A reliable pipeline separates ingestion from recognition. Inspect MIME declarations and file signatures, reject unexpected formats, scan attachments, and assign each job a run identifier. For PDFs, libraries such as PyMuPDF or pdfplumber can recover the text layer; for Office Open XML files, read the document package directly rather than stripping visible text from a rendered screen.

For scanned pages, render at roughly 300 DPI, deskew them, and send only low-text pages to an OCR engine such as Tesseract or a managed OCR API. Language and layout settings matter, especially for Australian names, company suffixes, and pages with tables. Save OCR output alongside page coordinates, confidence values, and image quality indicators so poor scans can be queued for manual review.

Detecting candidate email addresses

Candidate detection should combine a tolerant address expression with contextual signals. A regular expression can locate the basic shape of an address, but it may also capture document IDs or a sentence ending beside a domain-like word. Nearby labels such as “Email”, “Contact”, or “E-mail”, as well as a matching display name, improve the score.

A second pass can use a stricter parser to reject malformed strings, detect Unicode confusables, and compare candidates with company domains already seen in the same document. Keep ambiguous matches instead of silently discarding them. Australian phone formats such as 0400 123 456 and +61 2 1234 5678 are common around contact blocks and should never be promoted to email records when OCR misreads a symbol.

Normalising and validating results

Normalise each accepted value before it enters the contact database. Apply Unicode normalisation, remove surrounding punctuation and accidental spaces, convert internationalised domains to a stable representation, and lowercase the domain. Preserve the original local-part and display spelling unless your business has a documented policy, because providers differ on dots, plus addressing, and case sensitivity.

Then separate three questions: whether the string is syntactically plausible, whether its domain has mail routing, and whether the person consented to receive outreach. Domain or MX checks can answer the second, but they do not prove ownership. Role-address and disposable-domain flags help with data quality, while consent records and source documents support the third. Low-confidence results should remain reviewable rather than being silently labelled valid.

Storing, deduplicating, and exporting data

Store the original value, normalised value, source filename, file hash, page number, bounding box, extraction confidence, processing time, and run identifier. SQLite is adequate for a local utility; PostgreSQL suits a shared service. Encrypt the database and extracted files, restrict access by role, and define a deletion schedule that matches the purpose of the collection.

Deduplicate on the normalised address while retaining every provenance record. Export to CSV, JSON, Excel, or a CRM through a mapped import template, and record whether each entry came from a direct statement, an email signature, or a third-party directory. For Australian teams, UTF-8, Australian date formats, and international phone formats on adjacent fields prevent import errors in systems such as Xero, MYOB, or a common CRM.

Scheduling processing and controlling risk

Automation works well when it follows normal Australian office habits: a broker emails a revised quote, an accountant uploads an invoice to a shared drive, and a coordinator drops a supplier pack into a watched folder. Microsoft 365 and Google Workspace are widely used, so connectors for shared mailboxes, SharePoint, OneDrive, or Google Drive can feed one queue without forcing staff to maintain a second filing system.

Process jobs asynchronously with checksums for idempotency, bounded retries, OCR concurrency limits, and a dead-letter queue for failures. Apply least-privilege credentials, malware scanning, quarantine folders, rate limits, and audit logs. Monitoring should report extraction rates and review queues without exposing harvested addresses in general-purpose analytics.

Applying Australian privacy and commercial rules

Privacy obligations depend on the organisation and data involved. Where the federal Privacy Act 1988 applies, the Australian Privacy Principles govern notice, purpose limitation, collection, use, disclosure, security, and access. Sensitive information needs additional care, and the NSW Privacy and Personal Information Protection Act 1998 or Victorian Privacy and Data Protection Act 2014 may also apply alongside federal rules.

For outreach, the Australian Spam Act 2003 requires sender identification, consent-based sending, and a functional unsubscribe mechanism. Public council directories, franchise networks, professional associations, and event-supplier lists also carry website terms, contractual restrictions, or intellectual-property considerations. Extract only within those boundaries, document the authority to process each collection, avoid purchased or cracked datasets, and keep human review between questionable source data and outreach.

A focused, auditable email document extractor is most valuable as a controlled workflow that turns authorised paperwork into verified, traceable contact records.