Privacy Policy

What we collect

Account. When you create an account we store your email address, your name and profile picture if you sign in with Google, your plan, how many pages you have converted, and your Stripe customer ID. We use this to run your account and to send sign-in emails. New accounts are also added to a contact list at our email provider (Resend). For a new account we also keep how it first reached us: the campaign source or referring site, the referring page without its query string, and the first page it landed on (from the first-visit cookie described under “Cookies and local storage”). If you cancel a paid plan in Stripe's portal, the reason you pick from its list is stored with the cancellation event; we do not read the free-text comment.

Bank requests. If you ask us to support a bank, we store your email address and the bank name you typed, or, if you leave it blank, the bank we recognised from the statement header, until you ask us to delete them. The recognised name always comes from our own list of banks, never from the statement text.

Usage. Without an account you can convert 10 pages per day. We count them in our database under a one-way keyed hash of your IP address that changes every day (UTC) and cannot be turned back into the address; the address itself is not stored, and these counters are deleted after two days. Request rate limits are kept per IP address in server memory only and are lost when the server restarts. We also record events such as “conversion completed” or “conversion failed” (see “Analytics and error reports” below).

Bank statement data

ConvertStatement processes an uploaded PDF in server memory. The PDF is not written to disk or stored in a database, and the transactions, descriptions, names and amounts in it are not written to our logs or sent to our analytics or error tools. When the request ends the data is released from memory.

AI reading (Claude by Anthropic): when you click “Read with AI”, and as an automatic re-check. Two things send a statement to Claude, an AI model provided by Anthropic, PBC (USA). First, for banks without a dedicated parser and for scanned PDFs, you can click “Read with AI”. Second, for statements from our 16 dedicated-parser banks, an automatic re-check of a supported bank's result: if the parser's result does not add up against the opening and closing balances printed on your statement, we send the PDF to Claude without a further click and use Claude's read only if it does add up; otherwise you get the parser's result as before. The re-check applies to website uploads only, reads up to 10 pages per statement for anonymous and Free use and 40 pages on paid plans, and is cut off when our daily AI budget or your per-account limit is used up. In both cases the PDF, including names, account details and amounts printed on it, is sent to Anthropic's API. Anthropic acts as our sub-processor: under its commercial terms it does not use API data to train models and deletes inputs and outputs within 30 days (longer only if flagged by its safety systems or required by law). We do not store the file; the extracted result is kept in our server's memory for up to 30 minutes so the download doesn't run the model again, then discarded. The Chrome extension and the MCP server never use AI. The extension converts CSV on your device and never uploads it; if you choose Excel, OFX or QBO in the extension, the PDF is sent to our server and converted by our dedicated parsers only, never by AI, whether or not you are signed in. The MCP server uses only the dedicated parsers.

Keeping your statement for a sign-in or upgrade. If, after an AI preview, you choose “Get the full file” or “Sign in”, the PDF is kept in the local storage of this browser (IndexedDB) for up to 60 minutes, so the page can pick up where you left off after you sign in or pay. It is deleted after you download the file, when you start a new file, or when it expires. It is never uploaded except by the automatic resend after you return, and nothing is saved before you click one of those buttons.

AI cost records. Each AI read writes a cost record (date, model, pages, cost) so we can keep to a daily budget. For paid accounts the record also carries a pseudonymous account key, a salted one-way hash that is not your account id, email or IP address, used for the per-account daily limit; it is removed after 35 days. The record never holds statement content.

Sharing a failed statement (optional). When a conversion fails, we offer to let you share a redacted skeleton of the statement so we can add support for it. In the skeleton every letter becomes x and every digit becomes 9, except a short fixed list of generic column headings (Date, Description, Balance and the like), so names, addresses, account, IBAN and card numbers, merchants, dates and amounts are not readable; only the layout remains. The skeleton also keeps where each piece of text sits on the page, so we can see the columns: for each run of text, which page and which line it is on and in which column, with columns placed on a coarse grid (2% of the page width) and a generic font family such as Arial or Helvetica. It holds no exact positions, widths or sizes; the letters are still x and the digits 9. You see the exact skeleton before deciding, and nothing is shared unless you click “Share.” We store only that skeleton, solely to improve the parser, and delete it after 30 days. The original PDF is never stored.

Who processes data for us

These providers keep data under their own terms and retention settings; see Stripe, PostHog and Sentry. Like any website, they see the IP address of the connection that reaches them.

Analytics and error reports

The events we send to PostHog describe what happened, not what the statement said: the bank detected, page and transaction counts, whether balances reconciled, plan, error codes and, for a failed conversion, an automatic failure fingerprint. It describes how the file is built and contains no statement text: how many pages and lines there are and how much text each page holds, how many dates and amounts appear and in which formats (for example 1,234.56 or 1.234,56), which currency signs and codes occur, how many generic column-heading words there are, the language, the PDF writing software (for example Microsoft Word or macOS Quartz), and the bank we recognised in the statement header. It is stored in our analytics and our own event log. It contains no text from your statement: only counts and formats derived from it. Signed-in users are identified by an internal random account ID and plan; we do not send your email address. For visitors who are not signed in, events carry a random identifier from the cookie described below or, where no cookie is possible, a keyed hash of the IP address that changes every day (UTC), never the address itself. PostHog's browser script also records page views and clicks and may record sessions with all text and inputs masked; file pickers are excluded from recordings, so the name of a file you choose is not captured. Error reports to Sentry carry the internal account ID and plan, not your email or statement content, and the browser error reporter does not record sessions.

Our own event log. The same kind of events (a conversion and its outcome, a sign-in, a payment, a cancellation and its reason, whether a sign-in email was delivered) are also written to our database: event type, outcome, counts such as pages and bytes, the bank detected, and your internal account ID or the random browser identifier. Never statement content, email addresses (for sign-in emails only the recipient's mail domain) or IP addresses. These records are deleted after 400 days. Our web server also writes a technical request log (time, path, status, duration, and the same daily hash instead of an IP address), kept for 90 days.

Cookies and local storage

All of these except PostHog's are first-party cookies set by convertstatement.com; we do not use advertising networks.

• Sign-in session (essential): keeps you signed in until it expires.
• vbf_aid: a random identifier, set when you convert a statement without being signed in; it ties together the events of one browser. Not derived from your IP address. One year, HttpOnly.
• vbf_ft: set on your first page view; holds the campaign source or referring site, the referring page without its query string, and the page you landed on. Copied to your account if you sign up. 30 days, HttpOnly.
• Campaign cookies: if you arrive through one of our own campaign links, first-party cookies record which campaign. 30 days.
• PostHog: stores an identifier in your browser (cookie and local storage) to tell visits apart.
• Browser flags: two small flags that make the pricing page smarter: that you have converted a statement here (local storage) and that you chose to subscribe straight away (session storage).

How long we keep data

• Uploaded PDFs: not stored.
• AI result: server memory, up to 30 minutes.
• Statement kept in this browser for a sign-in or upgrade: up to 60 minutes, on your device only.
• AI cost records: kept for spend history; the pseudonymous account key on them is removed after 35 days.
• Statement sent to Anthropic: deleted by Anthropic within 30 days (longer only if flagged by its safety systems or required by law).
• Shared failure skeleton: 30 days, then deleted automatically.
• Sign-in sessions: until they expire; expired ones are removed hourly.
• Anonymous page allowance: a daily keyed hash and a page count, deleted after 2 days.
• Request rate limits: server memory, cleared on restart.
• Event log (conversions, sign-ins, payments, email delivery): 400 days.
• Server request and error logs: 90 days on our server (database server logs 14 days); they contain technical messages, not statement content or IP addresses. Encrypted copies of the log files are kept in our disaster-recovery backup.
• Cookies: vbf_aid one year, vbf_ft and campaign cookies 30 days, sign-in session until it expires.
• Account, bank requests and billing records: until you ask us to delete them, except what we must keep for payments and accounting.

Payments

Payments are processed by Stripe. We do not see or store your credit card number, CVV, or full billing details. We store your Stripe Customer ID and payment records (amount, currency, date, invoice ID) to manage your subscription.

Data security

All data in transit is encrypted using HTTPS/TLS. Authentication is handled via NextAuth with secure, httpOnly session cookies.

Your rights

You can ask us to delete your account and the data tied to it, or to delete a bank request or shared skeleton sooner, by emailing [email protected]. Because we do not store your statements, there is generally nothing to delete beyond your account, billing and request records.

Changes to this policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date. Continued use of ConvertStatement after changes constitutes acceptance of the updated policy.

Contact

Questions about this privacy policy? Email us at [email protected].