Privacy Policy

StatementConverter (“we”, “us”) is committed to protecting your privacy. This policy explains what data we collect, how we use it, and the choices you have. We comply with the GDPR (EU), CCPA (California), and other applicable data protection laws.

Your bank statement PDFs contain sensitive financial information. Here is exactly what happens:

• Upload: Files are stored temporarily in encrypted object storage (Cloudflare R2).
• Processing: The PDF is parsed in an isolated worker process. Extracted data is saved as JSON.
• Auto-deletion: The original PDF is deleted immediately after parsing completes.
• Result expiry: Parsed result data is automatically deleted after 30 minutes.
• No training: We never use your files or data to train any AI model.
• No sharing: We never sell, share, or rent your data to third parties.

We use three categories of cookies:

You can change your cookie preferences at any time by clicking the “Cookie Preferences” link in the footer.

Under GDPR (EU residents) and CCPA (California residents), you have the right to:

• Access — Request a copy of your personal data
• Rectification — Request correction of inaccurate data
• Erasure — Request deletion of your data (“right to be forgotten”)
• Restriction — Request limitation of processing
• Portability — Receive your data in a machine-readable format
• Objection — Object to processing based on legitimate interests
• Withdraw consent — Withdraw cookie consent at any time
• Opt-out of sale — We do not sell your data. CCPA “Do Not Sell My Personal Information” — N/A.

We use the following third-party services to operate our product:

• Stripe — Payment processing. They receive your payment data directly; we never see card details.
• Cloudflare R2 — Temporary file storage. EU/US data residency available.
• Supabase — User accounts and billing records (PostgreSQL, EU-hosted).
• Plausible — Privacy-first analytics. No cookies, no personal data.
• Vercel / Railway — Hosting infrastructure.

We do not use Google Analytics, Facebook Pixel, or any tracking-heavy third-party services.

• HTTPS encryption for all data in transit
• Files validated via magic-byte check (no fake PDFs)
• IP-based rate limiting to prevent abuse
• Worker processes isolated and sandboxed
• No persistent storage of financial data
• Regular security audits of dependencies

To exercise any of your rights (access, deletion, portability), or if you have questions about this policy:

Our service is not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, please contact us for immediate deletion.

We may update this policy as our service evolves. Material changes will be announced on this page with an updated date. Continued use after changes constitutes acceptance.