Legal
Privacy policy
We convert your statement and delete it. We never keep, sell or train on your files. This page explains what else we handle, why, and for how long.
Who we are
Bank Statement Converter (bankstatement-converter.com) is run by a company registered in Malta. We are the controller of the personal data described on this page. For anything about your data, email contact@bankstatement-converter.com or choose "Privacy or data request" on our contact page.
Your statements
What happens to them: your PDF is uploaded over an encrypted connection, converted on our servers in Frankfurt, Germany, and deleted automatically about an hour after upload. The converted table and your Excel and CSV files are deleted at the same time. We never back up uploaded files.
Who sees them: nobody on our team opens or reads your statements, and we never use them to train AI models, ours or anyone else's. File contents and file names are kept out of our logs, error reports and database.
Scanned statements (Pro): to read a scanned statement, we send it to Google Cloud Document AI in the EU, which extracts the text without keeping the file or using it for training. Statements with selectable text never leave our own servers.
Legal basis: we process statements to provide the service you asked for (Article 6(1)(b) GDPR).
Statements about other people: if you upload statements for clients or your employer, you decide what is processed, and we act on your instructions as your processor. See "If you upload statements for clients" in our Terms.
Other data we handle
Account (optional): your email, your name if you give one, your sign-in method, your plan and your page counts. Kept until you delete your account, then removed within 30 days. Legal basis: providing the service (Article 6(1)(b)).
Payments: Stripe handles your card details, and we never see or store them. We keep your Stripe customer ID, plan, invoices and payment history for as long as tax law requires. Legal basis: providing the service and our legal obligations (Article 6(1)(b) and (c)).
Free-use limits: for visitors without an account, we count pages with a salted hash of your IP address that changes every day, and delete it after 48 hours. Legal basis: our legitimate interest in fair use and preventing abuse (Article 6(1)(f)).
Server logs: IP address, time, page requested and browser type, kept for up to 30 days for security and to keep the service running. Logs never contain file contents or file names. Legal basis: Article 6(1)(f).
Messages: when you write to us, we keep your name, email and message for as long as we need to help you, and for up to two years after. Legal basis: Article 6(1)(f).
Analytics (only if you accept): if you accept analytics cookies, Google Analytics counts visits and which pages are used, with a random ID and your browser details, never your statements. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time on the cookie policy. We don't use advertising cookies, and we don't sell or share your personal data with anyone for advertising.
Service providers we use
Each provider processes data only on our instructions, under a data processing agreement.
| Provider | What for | Where |
|---|---|---|
| Render | Conversion servers and file processing | Frankfurt, Germany |
| Google Cloud Document AI | Text extraction for scanned statements on Pro | EU |
| Neon | Account database | Frankfurt, Germany |
| Vercel | Website hosting | EU, with some logs possibly processed in the US |
| Clerk | Sign-in and accounts | US |
| Stripe | Payments. Stripe also acts as an independent controller for fraud prevention and financial regulation. | EU and US |
| Google Analytics | Visit statistics, only if you accept analytics cookies | EU and US |
We update this list before a new provider starts handling personal data.
Transfers outside the EU
Your statements are processed only in the EU. Some account, payment and log data may be processed in the US by Clerk, Stripe and Vercel, and by Google Analytics if you accept it. We only use providers certified under the EU-US Data Privacy Framework or bound by the European Commission's standard contractual clauses.
Your rights
Under the GDPR you can ask us to access, correct, delete, restrict or export your personal data, and you can object to processing based on our legitimate interests. Email contact@bankstatement-converter.com from the address on your account, and we'll reply within 30 days. You can also delete your account at any time in your account settings.
If you're unhappy with how we handle your data, you can complain to Malta's Information and Data Protection Commissioner (idpc.org.mt) or to the data protection authority where you live.
If you live in the US: we don't sell or share personal information as defined by California law.
How we protect your data
Uploads and downloads are encrypted in transit (TLS 1.2 or higher), and stored files are encrypted at rest. File links are random and expire, and no user can reach another user's files. Access to our production systems is limited to as few people as possible and needs two-factor sign-in.
Children
Bank Statement Converter isn't meant for anyone under 16, and we don't knowingly collect their data. If you think a child has given us personal data, contact us and we'll delete it.
Changes to this policy
When we change this policy, we update the date at the top. If a change is significant, we tell account holders by email or on the site before it takes effect.