BankStatementToCSVFile.com ("we", "us", or "our") operates the website located at bankstatementtocsvfile.com. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

By using our service, you agree to the practices described in this policy. If you do not agree, please do not use the service.

1. Information We Collect

We collect only the minimum information necessary to operate the service:

• Uploaded PDF files: Files you upload for conversion are held in memory only and never written to disk. They are permanently discarded immediately after text extraction is complete — within seconds of upload.
• IP address: We record your IP address solely to enforce the free-tier usage quota (30 pages per month). This information is held in memory only and is not written to permanent storage.
• Access tokens: Paid subscribers receive an access token. We store the token, associated plan name, email address, and usage data in our database (Supabase) to authenticate your subscription.
• Email address: Provided at the time of purchase through our payment processor (LemonSqueezy). We use it only to deliver your access token and essential service communications.
• Usage data: We log basic server activity (e.g., number of pages converted) for quota enforcement and operational monitoring. Logs do not contain the content of your uploaded files.

2. How We Use Your Information

• To convert your PDF bank statement to CSV or Excel format
• To enforce free-tier page quotas by IP address
• To authenticate paid subscribers via access tokens
• To send your access token and plan information by email after purchase
• To monitor and maintain the reliability of our service

We do not use your data for advertising, profiling, or any purpose beyond operating the service.

3. Your Uploaded Files

We understand that bank statements contain sensitive financial information. We treat your files with the highest level of confidentiality:

• Your PDF is held in memory only and is never written to disk on our servers
• The PDF is permanently discarded immediately after text extraction is complete — this happens within seconds of upload
• Only the structured transaction data (dates, amounts, descriptions) extracted from your PDF is retained temporarily in server memory — for up to 2 hours — so you can download CSV and Excel without re-uploading
• This structured data is never written to disk and is automatically cleared from memory within 2 hours
• We do not read, analyze, store, or sell the contents of your financial documents beyond what is necessary to perform the conversion
• All file transfers occur over encrypted HTTPS connections

4. Payment Processing

All payments are processed by LemonSqueezy, our third-party payment processor. BankStatementToCSVFile.com does not collect, store, or process payment card information. LemonSqueezy's privacy policy governs how your payment data is handled. You can review it at lemonsqueezy.com/privacy.

5. Cookies and Local Storage

We use browser localStorage to store your access token on your device so you do not need to re-enter it on each visit. This data is stored locally in your browser and is never transmitted to us except when verifying your subscription status.

We do not use tracking cookies, advertising cookies, or third-party analytics scripts that collect personal data.

6. Third-Party Services

We use the following third-party services to operate the platform:

• Render — cloud hosting provider where our server runs
• Supabase — database for storing subscriber token and usage data
• LemonSqueezy — payment processing and subscription management
• Brevo (Sendinblue) — transactional email delivery for sending access tokens

Each of these providers has their own privacy policy governing how they handle data.

7. Data Retention

• Uploaded PDF files: Never written to disk. Discarded from memory immediately after text extraction (within seconds of upload)
• Extracted transaction data: Held in server memory for up to 2 hours to allow CSV/Excel downloads, then automatically cleared. Never written to disk.
• Free-tier IP usage: Held in memory only, reset monthly, never persisted to disk
• Subscriber tokens and email addresses: Retained in our database while your subscription is active and for up to 30 days after cancellation for support purposes
• Server logs: Retained for up to 30 days for operational monitoring. Logs contain only UUIDs and page counts — not file contents.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of personal data we hold about you
• Deletion: Request that we delete your personal data (token, email)
• Correction: Request correction of inaccurate data
• Portability: Request your data in a machine-readable format
• Objection: Object to processing of your personal data

To exercise any of these rights, contact us at hello@bankstatementtocsvfile.com. We will respond within 30 days.

9. Children's Privacy

Our service is not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. International Data Transfers

Our service is operated from servers in the United States. If you access the service from outside the United States, your data may be transferred to and processed in the US. By using the service, you consent to this transfer.

11. Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. All data is transmitted over encrypted HTTPS connections. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify subscribers of material changes by email. The "Last updated" date at the top of this page will reflect the most recent revision. Continued use of the service after changes constitutes acceptance of the updated policy.