Privacy Policy

1. What data we collect

When you create an account, we collect your email address and a hashed password. When you upload a PDF bank statement for conversion, we temporarily process the file to extract transaction data. We also collect basic usage data such as the number of conversions performed, pages processed, and the output format selected.

We do not read, store, or analyze the financial content of your bank statements beyond what is necessary to perform the conversion you requested.

2. How we use your data

Your email address is used for account authentication, subscription management, and essential service communications such as password resets. Usage data is used to enforce plan limits and improve the service. We do not sell, rent, or share your personal data or financial information with third parties for marketing purposes.

3. Data retention

StatementToExcel operates on a zero data retention architecture. Uploaded files (PDFs) and converted outputs (Excel files) are processed entirely in volatile memory (RAM) and are never written to persistent storage, databases, or filesystems. All data is permanently deallocated from memory immediately after the converted file is delivered to the user's browser.

We do not retain, archive, or backup any user-uploaded documents or their contents. Our AI processing partner (Anthropic) operates under a zero data retention agreement and does not store or train on any data submitted through our API.

Metadata such as conversion timestamps, file names, and page counts may be retained for billing and service improvement purposes. No financial data, transaction details, account numbers, or document contents are included in any logs. Your account information and conversion history (file names, page counts, dates — not file contents) are retained until you delete your account.

4. Third-party services

We use the following third-party services to operate StatementToExcel:

• Supabase — authentication and database hosting (data stored in secure, SOC 2 compliant infrastructure)
• Dodo Payments — subscription billing and payment processing (we never see or store your full card number)
• Anthropic (Claude API) — AI-powered document processing with zero data retention (Anthropic does not store or train on API data)
• Lovable — application hosting

5. Security

All data is encrypted in transit using TLS. Access to your account data is protected by row-level security policies. We enforce strict CORS policies, content security policies, and use parameterized queries to prevent injection attacks. PDF uploads are restricted to the PDF file type only.

6. Your rights

You may request deletion of your account and all associated data at any time by contacting us. Upon deletion, all personal data, conversion history, and any stored files are permanently removed from our systems.