BankStatementToCSVFile.com ("we", "us", or "our") operates the website located at bankstatementtocsvfile.com. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

By using our service, you agree to the practices described in this policy. If you do not agree, please do not use the service.

1. Information We Collect

We collect only the information needed to run the service:

• Uploaded PDF files: Your PDF is processed in memory to extract the transactions. If our fallback text extractor is needed, the PDF is written to a temporary file that is deleted as soon as extraction finishes. We do not keep your PDF.
• Extracted transactions and filename: The transactions extracted from your PDF and its original filename are kept in server memory for up to 2 hours so you can download your file, then discarded. They are not written to our database.
• Hashed IP address: To enforce the free plan (30 pages per month), we store a one-way hash of your IP address with your monthly page count in our database (Supabase). We do not store your raw IP address for this purpose.
• Conversion statistics: For each conversion we record anonymous statistics — plan type, number of pages, number of transactions, export format and country (from our CDN) — to monitor and improve the service. These records do not include your file, filename or transactions.
• Account and subscription data: If you sign in or subscribe, we store your email address, plan and usage in our database, and access tokens for token-based subscriptions.
• Server logs: Our server logs record operational events, which can include your account email address, the filename of an uploaded statement, and page and transaction counts. Logs never contain the contents of your statement.
• Analytics: Our website uses Google Analytics and Microsoft Clarity to understand how visitors use the site (see section 5).

2. How We Use Your Information

• To convert your PDF bank statement to CSV or Excel format
• To enforce free-tier page quotas by IP address
• To authenticate paid subscribers via access tokens
• To send your access token and plan information by email after purchase
• To monitor and maintain the reliability of our service

We do not use your data for advertising, profiling, or any purpose beyond operating the service.

3. Your Uploaded Files

We understand that bank statements contain sensitive financial information:

• Your PDF is processed in memory; if a temporary file is needed for text extraction, it is deleted immediately after extraction
• We do not keep a copy of your PDF
• The structured transaction data (dates, amounts, descriptions) and the filename are held in server memory for up to 2 hours so you can download CSV, Excel, QBO or OFX files without re-uploading, then automatically discarded
• This transaction data is never written to our database
• We do not read, analyze, sell or share the contents of your financial documents beyond what is necessary to perform the conversion
• All file transfers use encrypted HTTPS connections

4. Payment Processing

Payments are processed by our third-party payment processors, Stripe and LemonSqueezy. BankStatementToCSVFile.com does not collect or store payment card information. Their privacy policies govern how they handle your payment data: stripe.com/privacy and lemonsqueezy.com/privacy.

5. Cookies, Local Storage and Analytics

We use your browser's localStorage to keep your access token or sign-in session on your device so you don't need to re-enter it on each visit.

We use Google Analytics 4 to measure visits and conversions, and Microsoft Clarity, which records anonymized usage such as clicks, scrolling and session replays, to improve the site. Both set cookies and receive information such as your IP address, device and browser details, and the pages you visit. We do not send the contents of your bank statements to either service. You can opt out of Google Analytics with the Google Analytics opt-out add-on, and you can block these cookies in your browser settings. Learn more in Google's privacy policy and Microsoft's privacy statement.

We do not use advertising cookies and we do not sell your personal data.

6. Third-Party Services

We use the following third-party services to operate the platform:

• Render — cloud hosting provider where our server runs
• Cloudflare — content delivery network and security
• Supabase — database for accounts, subscriptions, usage counts and conversion statistics
• Stripe and LemonSqueezy — payment processing and subscription management
• Supabase Auth and our SMTP email provider — transactional email (sign-in links and access tokens)
• Google Analytics and Microsoft Clarity — website analytics

Each of these providers has its own privacy policy governing how it handles data.

7. Data Retention

• Uploaded PDF files: Not kept. Any temporary file used for text extraction is deleted immediately after extraction.
• Extracted transaction data and filename: Held in server memory for up to 2 hours to allow downloads, then automatically discarded. Never written to our database.
• Free-plan usage (hashed IP and page count): Stored in our database and used for the monthly quota.
• Conversion statistics: Anonymous records (plan, pages, transactions, format, country) kept to monitor the service.
• Account emails, plans and tokens: Retained while your account or subscription is active and for up to 30 days after cancellation for support purposes, unless you ask us to delete them sooner.
• Server logs: Retained for up to 30 days for operational monitoring. Logs may include account emails and filenames, but never file contents.
• Analytics data: Retained by Google Analytics and Microsoft Clarity according to their retention settings.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of personal data we hold about you
• Deletion: Request that we delete your personal data (token, email)
• Correction: Request correction of inaccurate data
• Portability: Request your data in a machine-readable format
• Objection: Object to processing of your personal data

To exercise any of these rights, contact us at hello@bankstatementtocsvfile.com. We will respond within 30 days.

9. Children's Privacy

Our service is not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. International Data Transfers

Our service is operated from servers in the United States. If you access the service from outside the United States, your data may be transferred to and processed in the US. By using the service, you consent to this transfer.

11. Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. All data is transmitted over encrypted HTTPS connections. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify subscribers of material changes by email. The "Last updated" date at the top of this page will reflect the most recent revision. Continued use of the service after changes constitutes acceptance of the updated policy.