Privacy Policy

1. Information We Collect

• Uploaded files (e.g. bank statements) to provide our conversion services
• Basic account details (e.g. name, email, payment info) when you sign up
• Ratings and feedback you choose to give: a 1–5 star rating of a conversion or of the Service and, for a low rating, the problems you select and any comment you write
• Your decisions about your transactions, such as confirming or rejecting that two transactions are a transfer between your own accounts
• Technical data (e.g. IP address, browser type, usage patterns) for improving the Service

The Service is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it.

2. How We Use Information

• To process and convert uploaded files into structured data formats
• To improve parsing accuracy and extraction quality across statements
• To develop and maintain extraction templates for new banks and formats, which may include identifying structural patterns across documents to improve parsing accuracy and expand supported formats
• To debug issues and ensure Service reliability
• To provide customer support and billing
• To improve the Service and maintain security
• To track conversion quality per bank, look into the problems you report, and show average ratings on our website. Published figures are averages and counts and never include your comments or identify you
• To keep applying your decisions about your transactions when you return to your statements

Processing may involve automated systems, including OCR and AI models, to extract structured data from uploaded documents.

Important: We do not sell your data. We never share your documents, or anything extracted from them, with anyone for marketing purposes. We do not use customer documents to train models in a way that retains or reproduces personal data.

3. Data Returned to AI Assistants and API Clients

When you use Bankstatemently through an AI assistant (for example ChatGPT or Claude, via our MCP server) or through the developer API, our responses contain data from your own statements. What a response contains depends on who is asking:

• AI assistants (MCP): the statement's transactions (date, description, amount, direction, currency, balance), account names, the account holder name as printed on the statement, the last four digits of account or card numbers, the bank, statement period and page count, the file name you uploaded, and a document identifier and content hash so the assistant can refer back to the same statement. Statement lists also show the date you converted each statement. Full account or card numbers and processing details are not included.
• Developer API: the full parsed record, including full account and card numbers, for integrations you build and authorize with your own API key.
• Never returned: passwords, API keys, session or request identifiers, or logs.

The AI assistant provider handles the data in a response under its own privacy policy. We send statement data to an assistant only when you ask for it in that conversation.

4. Data Storage & Security

• Encryption in transit: All data is transmitted over HTTPS/TLS. We enforce HTTPS on all connections — unencrypted HTTP requests are automatically redirected.
• Encryption at rest: Uploaded files and extracted data are stored in encrypted databases and storage buckets. Encryption is applied at the infrastructure level.
• Data retention: Depends on whether your account holds an active subscription or credit pack.
  • No account, or free plan: files and results are deleted automatically once they are 24 hours old
  • Active subscription or credit pack: files and results are retained until your subscription or credit pack ends (a subscription until its current period end, a credit pack until its own end date), then deleted the same way
  • Account deleted: everything is deleted regardless of any active subscription or credit pack
  • Your own request: you can delete a document, or your whole account, at any time (see Your Choices below)
  • Ratings, feedback and transfer decisions: we keep them to improve the Service; ask us and we'll delete them
  • Backups: deleted data can remain in our database backups for up to 90 days before they expire
• Canceling does not end a subscription or credit pack early: a subscription you cancel keeps running, and your documents stay, until its current period end, not the moment you cancel; a credit pack runs to its own end date the same way.
• What deletion removes: the uploaded file, the file name, account identifiers, balances, transactions and everything else we extracted from your statements, and any chat about them. What we keep: statement metadata (bank, document type, currency, transaction count, and statement dates), so your document history keeps working without holding your personal or financial data.
• Isolated processing: Each file is processed in isolation. We do not commingle data between users or accounts.
• Cookies & tracking: We and our analytics providers use cookies and similar tracking technologies to understand how the Service is used. You can manage cookie preferences through your browser settings or our cookie banner.
• Advertising measurement: If you reach us by clicking one of our ads, we record that ad click's identifier. If the visit leads to a sign-up or a purchase, we send the click identifier, the type of conversion (sign-up or purchase), its time and its value back to the ad platform that showed the ad, so we can tell which ads work. We never send your documents or anything extracted from them.
• Third-party service providers: We use third-party service providers to operate and improve the Service:
  Authentication— Clerk

  Database & storage— Supabase

  Document processing— Anthropic, OpenAI, and/or self-hosted open-source models

  Hosting & infrastructure— Vercel, Fly.io

  Analytics— PostHog, Google Analytics, Google Tag Manager, Ahrefs

  Advertising measurement— Google Ads, Microsoft Advertising, OpenAI

  Error tracking— Sentry

  Logging & monitoring— Better Stack

  Email delivery— Brevo, Google

  Payments— Stripe

  Customer support chat— Crisp

  Location (for cookie consent)— ipapi.co

  These providers may process uploaded documents and related data as necessary to support the operation of the Service.

• Data breach notification: In the event of a data breach affecting your personal data, we will notify you and relevant authorities as required by applicable law.
• Derived templates: We create and maintain extraction templates based on patterns identified in processed statements. These templates contain only structural and formatting information (e.g. column positions, data markers) and do not retain or reproduce personal data. Templates are used only to improve accuracy for future processing of similar statements. Derived templates do not contain personal data and are not subject to deletion requests.

5. Legal Compliance & Data Protection

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Data portability — receive your data in a structured, machine-readable format

To exercise any of these rights, contact us at help@bankstatemently.com. We will respond within 30 days.

If you are processing personal data on behalf of your organization and require a Data Processing Agreement (DPA), please contact us to request one.

6. Your Choices

• You may request a copy of the personal data we hold about you by contacting us
• You may request deletion of your account and uploaded files by contacting us
• You can change a rating at any time by rating again

Emails we send you

• Account and purchase emails (for example your welcome email, purchase and cancellation confirmations, and payment problems): we send these because you have an account or bought something, and they cannot be turned off.
• Document notifications (the result of a conversion, or a summary when a batch upload finishes): turn them off with the "Single upload conversion emails" and "Batch upload conversion emails" switches in your account settings.
• Tips and check-ins: Occasional emails that help you get more out of Bankstatemently and ask how it is going. They are on by default. Turn them off with the "Tips and check-ins" switch in your account settings, or from the link at the bottom of any of them.
• Newsletter: Product announcements, a few times a year. Sent only if you sign up for it. Turn it off with the "Newsletter" switch in your account settings, or with the unsubscribe link in any issue.

7. Changes to This Policy

We may update this Privacy Policy at any time. If we make material changes, we will notify you by email or by posting a notice in the Service. Your continued use of the Service after changes take effect constitutes your acceptance of the updated Privacy Policy.

8. Contact Us

For questions, requests, or concerns about this Privacy Policy: help@bankstatemently.com