Privacy policy

This policy describes how MyBankStatementConverter handles the statements you convert. It is written to match what the system actually does.

Consent

By using this website, you consent to the terms of this Privacy Policy and to the processing of your information as described below.

Information we collect

If you contact us directly, we may receive additional information you choose to provide, such as your name, email address, and the contents of your message or any attachments.

If you create an account, we collect the email address you register with. See What we store, and for how long below for how account and statement data is retained.

Documents you upload are processed solely to generate your converted file and are not shared with third parties. Retention periods, including the standard 24-hour deletion and the limited exception for unrecognized layouts, are set out below.

What we never store

Your transaction data never enters our database. There is no transactions table. Parsed rows exist only inside the CSV or Excel file that is generated for you. A breach of our database would expose no statement contents.

We also never put your filename into a storage path. Files are stored under generated identifiers only; the original name is kept in a single database column so downloads can be named sensibly.

What we store, and for how long

• The uploaded PDF — deleted within 24 hours. The original statement is the most sensitive thing we hold, so an automatic sweep removes it from storage. You keep your own copy.
• The generated CSV — deleted after 30 days. Kept so you can download it again from your history, or delete the statement sooner to remove it immediately.
• Metadata — until you delete the statement. Filename, detected bank, page count, transaction count, status and any warning. No transaction contents.
• Account data. Your email address and authentication record, for as long as your account exists.
• Encryption. Your upload travels to us over an encrypted connection, and files and metadata are encrypted at rest by our storage provider. This is not end-to-end encryption: the PDF is decrypted on our servers for as long as it takes to read the transaction table, which is what the conversion is.

Statements kept for improvement

We may retain an uploaded statement for up to 30 days to improve our product, then it is deleted automatically.

If you'd prefer we not retain yours, please contact us and we will remove it.

Anonymous use

Converting without an account creates no account and no history — the result is returned straight to your browser, and the uploaded file is subject to the 30-day retention described above. To enforce the one-per-24-hours limit and to understand how the site is used, we record a one-way SHA-256 hash of your IP address alongside conversion metadata (status, detected bank, page count). We cannot recover your IP address from that hash. These records are deleted after 90 days.

Processors

We use Supabase for database, storage and authentication (Singapore region), Render for hosting (Singapore region), and Resend for account emails such as confirmation and password reset. We use Google Analytics to understand traffic and how the site is used. We do not sell data, and we do not use it to train models.

Your choices

You can delete any statement from your history at any time, which removes both the stored file and its metadata. You can request deletion of your entire account and everything attached to it. See also our terms of service.

Your data protection rights

Depending on where you live, you may have the following rights over your personal data:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Ask us to correct inaccurate data or complete data you believe is incomplete.
• Erasure. Ask us to delete your personal data, under certain conditions.
• Restriction of processing. Ask us to limit how we process your personal data, under certain conditions.
• Objection. Object to our processing of your personal data, under certain conditions.
• Data portability. Ask us to transfer the data we hold to another organization, or to you directly, under certain conditions.

To exercise any of these rights, please contact us — we will respond within one month.