Privacy Policy

Last updated: 2026-09-14 · Free Beta

What files are processed

You upload a bank statement PDF. The server validates it, extracts text, parses transactions in memory / temporary storage, and returns a preview for export.

How long PDF files are retained

By default, original PDFs are written to a temporary directory only for processing and are deleted immediately afterward (including on errors). Preview results are kept briefly in server memory for export, then expire. A copy may also stay temporarily in your browser (IndexedDB) only so we can ask for optional improvement consent after you export — if you decline or close without agreeing, that local copy is removed.

Optional improvement samples

After a successful export, we may ask whether you are willing to share that one PDF to help us improve parsing accuracy. Sharing is entirely optional and never automatic. If you agree, the file is stored privately in our Cloudflare R2 storage, with metadata (such as parse status and transaction count) in Cloudflare D1. We use these samples only to debug layouts and improve this product. We do not sell them, do not share them with advertisers, and do not send them to third-party LLM / OCR / Vision APIs. Samples are retained for a limited period (about 90 days) unless we delete them sooner after review.

Transaction contents

We do not store full transaction lists, descriptions, or account numbers in the analytics database unless you explicitly opt in to share the PDF as an improvement sample (in which case the PDF itself may contain that information). Preview data may exist temporarily in your browser session storage and short-lived server memory.

Third-party AI

This beta does not send your PDF to third-party LLM / OCR / Vision APIs. Parsing is performed by our local text-based parser.

Training

We do not use your uploaded PDFs to train third-party foundation models. Opt-in samples are used only to improve our own statement parser and product quality.

Anonymous technical metrics

We collect anonymous product metrics such as page count, file size, parse status, transaction count, confidence, reconciliation flags, processing time, parser version, and optional feedback labels. IP addresses are hashed for rate limiting.

We also use Google Analytics (GA4) to understand aggregate traffic (for example page views and referrers). Google Analytics may set cookies or similar identifiers according to Google’s policies. It is not used to store bank statement contents.

We use Microsoft Clarity for session insights (such as heatmaps and anonymized interaction recordings) to improve usability. Clarity may set cookies or similar identifiers according to Microsoft’s policies. It is not used to store bank statement contents.

We use Plausible Analytics (self-hosted at plausible.shipsolo.io) for privacy-friendly aggregate traffic stats. Plausible is designed to avoid personal tracking cookies; it is not used to store bank statement contents.

Contact

For privacy questions, email privacy@bankstatementxls.online.