Privacy Policy — Simple Statement Converter

This Privacy Policy explains how Simple Statement Converter ("we", "us", or "our") collects, uses, stores, and protects information when you use our service. It applies to all users worldwide and is written to comply with the privacy laws of the jurisdictions listed in Section 11.

If you have questions, please contact us via our contact page.

Who We Are

Simple Statement Converter is a web application that extracts transaction data from PDF bank statements and produces downloadable CSV and Excel files, available to users globally. For the purposes of applicable data protection laws, we are the data controller (or responsible party) in respect of personal information processed through the service.

Information We Collect And Why

Uploaded PDF Files
When you upload a bank statement, the file is held in temporary server storage solely for the duration of processing (typically a few seconds). It is permanently and automatically deleted immediately after the output is generated and returned to your browser. We do not archive your PDF, analyse its contents beyond what is necessary to extract transaction data, or retain it in any form after processing is complete.

Automated Extraction
By default, transaction data is extracted entirely on our own servers using automated software we operate ourselves, and no statement content is sent to any third-party service. This includes scanned or image-only statements, which we read using our own optical character recognition (OCR) software locally. No third party is involved for these either. For the small minority of statements whose layout our local software doesn't recognize, or where our local result doesn't reconcile against the statement's own printed balance, that statement's already-extracted text (never the original PDF file) is sent to DeepInfra, a third-party AI model provider, to complete the extraction.

Before that text is ever built, it is narrowed down to only the rows our software has already recognized as dated transaction rows. This includes your name, address, account number, and any other letterhead content is excluded by construction, not by trying to detect and redact them after the fact. A second, regex-based scrubbing pass then runs over that already-narrowed text as defense in depth, automatically stripping anything sensitive-looking that might still appear inside a transaction description itself, including card numbers, government ID and tax numbers, IBANs, email addresses, phone numbers, and embedded API keys or access tokens. If our software cannot recognize even a single dated row in your statement, the AI fallback is skipped entirely rather than sending anything unscrubbed.

This fallback is used only when needed, is capped per account and system-wide to bound how much data is ever sent to a third party, is not stored by us afterward, and is subject to DeepInfra's own privacy policy for the duration of that single request. When you upload a small batch (up to 3 files), you can use our Privacy Preview feature in the app to see exactly what that already-redacted text would look like before any processing happens.

Account Data
To use the service you create an account with your name, email address, and a password. If you contact us, we also collect the content of your message. We use this information only to operate your account and respond to your enquiries. We do not add you to any mailing list.

Technical And Usage Data
We may collect anonymous, aggregated data such as error rates and page load times to monitor service reliability. This data cannot be linked to any individual and contains no financial information. If we use cookies or local storage, these are strictly necessary for the service to function. Please see our Cookie Policy for details.

Security And Account Activity Logs
We keep a security and activity log covering account-level events that includes registration, sign-in and sign-out, password and email changes, plan changes, and account deletion. Together with the IP address, browser/device information (user agent), and timestamp associated with each. We also log that a conversion was started, completed, or failed and that a result was downloaded, without ever recording the file's name or content. This is used to secure accounts against unauthorized access, investigate suspicious activity, and where a payment is disputed with our payment processor, to demonstrate that the account holder did in fact use the service. IP address and browser/device information are retained for up to 180 days and then automatically redacted; the underlying record that an action occurred on a given date is kept for longer where needed for the purposes described above, including after account deletion (see Section 10.2).

What We Do Not Collect
We do not collect government identification numbers, precise geolocation data, or any special categories of sensitive personal data beyond what may appear in a bank statement you choose to upload (which we process and immediately discard). We do not collect or store payment card details through the service; paid plans are managed through the payment processor.

Legal Basis For Processing (GDPR And UK GDPR)

For users in the European Economic Area (EEA) and the United Kingdom, we process personal data on the following legal bases:

Contract Performance (Article 6(1)(b) GDPR): Processing your uploaded PDF, and operating your account, is necessary to deliver the service you have requested.
Legitimate Interests (Article 6(1)(f) GDPR): Monitoring service reliability and security, keeping the security and account activity logs described in Section 2.5 to prevent fraud and resolve payment disputes, and retaining contact form submissions to respond to your enquiry, where these interests are not overridden by your rights.
Consent (Article 6(1)(a) GDPR): Where we seek your consent for any additional processing, you may withdraw that consent at any time by contacting us.

Data Retention

Uploaded PDF Files: Deleted immediately and automatically after processing. Retention period: zero.
Account Data: Retained for as long as your account is active. You may delete your account at any time from your account settings.
Security And Account Activity Logs: IP address and browser/device information are retained for up to 180 days, then automatically redacted. The record that an event occurred (e.g. that you signed in or completed a conversion on a given date) is kept for longer where needed for fraud prevention or to resolve a payment dispute, including after account deletion.
Contact Form Submissions: Retained for up to 24 months to allow us to follow up and maintain a record of our correspondence, then permanently deleted.
Anonymous Usage Statistics: May be retained indefinitely as they contain no personal data.

International Data Transfers

Our servers are located in London, United Kingdom. If you access the service from another country, your data may be transferred to and processed there. Where such transfers are regulated (for example, transfers of EEA personal data outside the EEA under GDPR), we rely on applicable transfer mechanisms such as standard contractual clauses or adequacy decisions where available. By using the service you acknowledge that your data may be processed in that location.

Third Parties And Data Sharing

We do not sell, rent, lease, or share your personal information with third parties for commercial or marketing purposes. We do not use third-party analytics scripts, advertising networks, or social media pixels. Statement processing (see Section 2.2) happens entirely on our own servers by default, with a limited AI-assisted fallback via DeepInfra for statement layouts we don't yet recognize. We may share data if required to do so by law, court order, or lawful government authority.

Security

We take reasonable technical and organisational measures to protect your information, including encrypted connections (HTTPS), automatic malware scanning of every uploaded file before it is processed, automatic deletion of uploaded files, hashed password storage, rate limiting on AI-assisted extraction to bound third-party exposure, and restricted access to account data. No method of internet transmission is 100% secure, and we cannot guarantee absolute security. If you become aware of a security concern, please contact us immediately.

Children's Privacy

The service is not directed at children under the age of 13 (or under 16 in the EEA where applicable). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Cookies

We use only strictly necessary cookies required for the service to function. We do not use tracking, advertising, or analytics cookies. For full details, see our Cookie Policy.

Your Rights

Depending on where you are located, you have specific legal rights in relation to your personal data. These are summarised below. To exercise any right, contact us via our contact page. We will respond within the timeframe required by applicable law (generally 30 days).

All Users (General Rights)

The right to be informed about how your data is used (this policy).
The right to access personal data we hold about you.
The right to correct inaccurate personal data.
The right to request deletion of your personal data where we have no lawful reason to retain it — you can do this yourself at any time from your account's Delete Account settings page. Certain security and account activity log entries (Security section above) are retained on a lawful basis after deletion, as described there.

EEA And UK Users (GDPR / UK GDPR)

Right of access (Article 15): Obtain confirmation of whether we process your data and a copy of it.
Right to rectification (Article 16): Correct inaccurate or incomplete data.
Right to erasure / "right to be forgotten" (Article 17): Request deletion of data where processing is no longer necessary, you withdraw consent, or the data has been unlawfully processed. This right does not extend to security and account activity log entries (Security section) that we are permitted to retain under Article 17(3) for fraud prevention or the establishment, exercise, or defence of legal claims, such as a payment dispute.
Right to restriction of processing (Article 18): Limit how we use your data in certain circumstances.
Right to data portability (Article 20): Receive your data in a structured, machine-readable format where processing is based on consent or contract.
Right to object (Article 21): Object to processing based on legitimate interests.
Right to withdraw consent: Where processing is consent-based, withdraw at any time.
Right to lodge a complaint: You may lodge a complaint with your local supervisory authority. In the EU this is your national data protection authority. In the UK this is the Information Commissioner's Office (ICO) at ico.org.uk.

California Users (CCPA / CPRA)

California residents have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to know: Request disclosure of the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purpose for collecting it, and the categories of third parties with whom it is shared.
Right to delete: Request deletion of personal information we have collected from you, subject to certain exceptions.
Right to correct: Request correction of inaccurate personal information.
Right to opt out of sale or sharing: We do not sell or share personal information for cross-context behavioural advertising. No opt-out is needed, but you may contact us to confirm this.
Right to limit use of sensitive personal information: We do not use sensitive personal information beyond what is necessary to provide the service.
Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To submit a verifiable consumer request, contact us via our contact page. You may also designate an authorised agent to make a request on your behalf.

Other US State Users

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Utah (UCPA), Oregon (OCPA), and other US states with comprehensive privacy laws have rights similar to those described above, including rights to access, correct, delete, and opt out of the sale of personal data and targeted advertising. We do not sell personal data or engage in targeted advertising. To exercise your rights, contact us via our contact page.

Canadian Users (PIPEDA / Law 25)

Canadian residents have the right under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation (including Quebec's Law 25) to access personal information we hold about them, challenge its accuracy, and withdraw consent to its collection, use, or disclosure (subject to legal or contractual restrictions). Complaints may be directed to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Brazilian Users (LGPD)

Residents of Brazil have rights under the Lei Geral de Proteção de Dados (LGPD), including the right to confirm the existence of processing, access data, correct incomplete or inaccurate data, anonymise or delete unnecessary data, obtain information about sharing, and revoke consent. Complaints may be directed to the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

Australian Users (Privacy Act 1988)

Australian residents have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), including the right to access and correct personal information held about them. Complaints may be directed to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Singapore Users (PDPA)

Singapore residents have rights under the Personal Data Protection Act 2012 (PDPA), including the right to access, correct, and withdraw consent for the use of personal data. Enquiries may be directed to the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

Japanese Users (APPI)

Japanese residents have rights under the Act on the Protection of Personal Information (APPI), including the right to disclose, correct, and cease use of their retained personal information. Enquiries may be directed to the Personal Information Protection Commission (PPC) at ppc.go.jp.

Laws And Frameworks This Policy Is Designed To Address

GDPR — EU General Data Protection Regulation (Regulation 2016/679)
UK GDPR — United Kingdom General Data Protection Regulation
CCPA/CPRA — California Consumer Privacy Act (as amended)
VCDPA — Virginia Consumer Data Protection Act
CPA — Colorado Privacy Act
CTDPA — Connecticut Data Privacy Act
TDPSA — Texas Data Privacy and Security Act
UCPA — Utah Consumer Privacy Act
OCPA — Oregon Consumer Privacy Act
PIPEDA — Canada Personal Information Protection and Electronic Documents Act
Quebec Law 25 — An Act to Modernize Legislative Provisions as Regards the Protection of Personal Information
LGPD — Brazil Lei Geral de Proteção de Dados (Law 13,709/2018)
Privacy Act 1988 (Cth) — Australia, including the Australian Privacy Principles
PDPA — Singapore Personal Data Protection Act 2012
APPI — Japan Act on the Protection of Personal Information
PDPA — Thailand Personal Data Protection Act B.E. 2562
PIPA — South Korea Personal Information Protection Act
ePrivacy Directive (2002/58/EC) as implemented in EU member states
PECR — UK Privacy and Electronic Communications Regulations 2003

Changes To This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be indicated by an updated date at the top of this page. Continued use of the service after changes are posted constitutes your acceptance of the revised policy.

Contact And Complaints

For any privacy-related questions, to exercise your rights, or to make a complaint, please contact us via our contact page. We aim to respond to all requests within 30 days. If you are not satisfied with our response, you have the right to escalate to the relevant supervisory authority in your jurisdiction as listed in “Your Rights”.