Privacy Policy

Overview

StmtPilot is built for bank statement conversion workflows. This policy explains what information we collect, how uploaded files are handled, how long conversion data is retained, and when it is deleted.

Data We Collect

We may collect the following categories of data:

• Account and contact data: Information you provide when you contact us, subscribe, or create an account in areas of the site that require authentication.
• Usage and device data: IP address, browser information, pages visited, timestamps, and related diagnostics used to operate and secure the service.
• Statement conversion data: Files you upload for conversion, parsed transaction rows, processing metadata, generated exports, and related operational logs.

How We Use Data

We use collected data to:

• operate, maintain, and secure StmtPilot,
• validate uploaded PDFs and process conversions,
• generate review tables and CSV or XLSX exports,
• troubleshoot conversion failures and abuse,
• communicate with you about support, billing, or service updates.

Uploaded statement files and extracted rows are used only for conversion and related operational support. We do not use uploaded statement files or extracted transaction rows to train shared AI or model systems.

Legal Bases And Your Responsibility

Where applicable, we process data based on one or more of the following grounds:

• your request to use the service,
• our legitimate interest in operating and securing the product,
• compliance with legal obligations.

You are responsible for ensuring that you have the right to upload and process the financial documents you submit to StmtPilot.

Retention Windows

StmtPilot uses short-lived retention windows for statement conversion data:

• Raw uploaded PDFs are retained for up to 24 hours from upload.
• Anonymous upload sessions, extracted rows, and generated exports are retained for up to 7 days from session or export creation.
• Expired exports and expired sessions are removed by cleanup jobs together with their associated stored files.

These windows are operational defaults for the current v1 product and may be shortened when needed for abuse prevention, legal compliance, or infrastructure safety.

Deletion Behavior

When the retention window expires:

• raw uploaded PDFs are deleted from object storage,
• generated export files are deleted from object storage,
• expired upload-session records and related conversion records are removed from the application database.

During the active retention window, access to statement data is gated by the upload-session token or authenticated account context, depending on the feature used.

Sharing And Processors

StmtPilot does not sell uploaded statement data. We may share data with service providers that help us operate the product, such as:

• hosting and content delivery providers,
• object storage and database providers,
• payment processors,
• email and support providers,
• security, logging, and analytics vendors.

These providers process data on our behalf under their own contractual and technical controls.

Third-Party Processors

Some site features may also link to third-party services that have their own privacy policies. We are not responsible for the privacy practices of services we do not control.

Security

We use reasonable administrative, technical, and organizational safeguards intended to protect statement data and other personal data from unauthorized access, loss, misuse, or disclosure. No system can guarantee absolute security.

Your Choices And Requests

If you have questions about statement-data handling, need us to investigate a specific upload, or need to request deletion of data that is still within the active retention window, please contact us. We may ask you to verify your request before acting on it.

Changes To This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the date on this page.