Privacy policy

1. Introduction

ConvertBank Statement Converter ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our bank statement conversion service at convertbank-statement.com.

By using our service, you agree to the collection and use of information in accordance with this policy.

2. Information we collect

2.1 Personal information

When you register for an account, we collect:

• Email address
• Name (optional)
• Payment information (processed securely through Stripe)

2.2 Bank statement data

When you upload bank statements for conversion, we process:

• PDF files containing bank statements
• Transaction data extracted from statements
• Account numbers and financial information present in the statement content

Conversion data: PDFs are sent to our servers for conversion. The standard conversion flow does not save the original PDF in the conversion database. Signed-in conversions save extracted transaction rows and conversion metadata to your account history. The public preview does not save results to your account.

2.3 Usage information

We record conversion outcomes, processing times and fixed technical error codes to investigate service problems. Signed-in activity can be linked to your account. These operational records do not contain PDF contents, transaction rows, filenames or raw error messages. Contact and support messages are stored separately so our team can respond even if an email notification fails.

We automatically collect:

• Number of conversions performed
• Conversion timestamps
• Browser type and version
• Device information
• IP address

3. How we use your information

We use your information to:

• Provide and maintain our bank statement conversion service
• Process your payments and manage subscriptions
• Send you service-related communications
• Monitor usage limits based on your subscription tier
• Improve our service and develop new features
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Data storage and security

4.1 Bank statement processing

Your bank statements are:

• PDFs are sent to our servers for conversion. The standard conversion flow does not save the original PDF in the conversion database.
• Signed-in conversions save extracted transaction rows and conversion metadata to your account history.
• If you choose to provide a document for a support request, that attachment and your message may be stored and reviewed by support. This is separate from standard conversion.
• Browser-to-service connections use HTTPS

4.2 Account data

Your account information is:

• Stored in encrypted databases (Supabase with PostgreSQL)
• Protected with industry-standard security measures
• Accessible only to authorised personnel
• Regularly backed up for disaster recovery

4.3 Payment information

Payment processing is handled entirely by Stripe, our PCI-DSS compliant payment processor. We do not store your credit card information on our servers.

5. Data sharing and disclosure

We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:

• Service providers: Stripe (payment processing), Supabase (account and conversion storage), Vercel (web hosting), Anthropic and parsing services (extraction and categorisation), Resend (service emails), and PostHog EU (optional public-site analytics).
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

6. Your rights (GDPR & UK GDPR)

As a UK-based service, we comply with the UK General Data Protection Regulation (UK GDPR). You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Restrict processing of your personal data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing of your personal data
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, please contact us at privacy@convertbank-statement.com

7. Data retention

• Original PDFs: PDFs are sent to our servers for conversion. The standard conversion flow does not save the original PDF in the conversion database. Support attachments are handled separately.
• New dashboard conversion results: Free: 7 days; Starter: 30 days; Professional: 365 days; Business: 730 days. Expired results are removed by a daily cleanup. You can also delete results from your history.
• Account Data: Retained while your account is active
• Usage Logs: Retained for 12 months for fraud prevention
• Operational diagnostics: Detailed events are removed after 30 days. Resolved incident summaries and closed contact enquiries are removed after 90 days; unresolved cases remain available while we investigate. Case status changes are retained for 90 days.
• Payment Records: Retained for 7 years for tax compliance

You can request account deletion at any time, which will remove all personal data except records required for legal compliance.

8. Cookies and tracking

We use essential cookies to:

• Maintain your session while logged in
• Remember your preferences

With your consent, we use PostHog EU to measure visits to public pages, contact and pricing clicks, page speed, and counts of browser errors. It stores an anonymous browser ID and a visit ID in local storage. This integration does not collect form values, documents, query strings, error messages or session recordings, and does not run in private portals. You can allow or withdraw this optional collection using the Site insights control. Contact clicks measure intent, not messages sent or completed purchases. You can control cookies through your browser settings. Disabling essential cookies may affect service functionality.

9. Third-party services

Our service integrates with:

• Stripe: Payment processing (Stripe Privacy Policy)
• Supabase: Database hosting (Supabase Privacy Policy)
• Vercel: Web hosting (Vercel Privacy Policy)
• Anthropic and parsing services: Statement extraction and transaction categorisation
• Resend: Service email delivery
• PostHog EU: Optional analytics, with no form values, documents or session recordings

These services have their own privacy policies and we recommend reviewing them.

10. International data transfers

Your data may be transferred to and processed in countries outside the UK. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK ICO
• Adequacy decisions recognised by UK law
• Binding Corporate Rules where applicable

11. Children's privacy

Our service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

12. Changes to this privacy policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification for material changes

Your continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: