Privacy Policy

Overview

StmtPilot is built for bank statement conversion workflows. This policy explains what information we collect, how uploaded files are handled, how long conversion data is retained, and when it is deleted.

Data We Collect

We may collect the following categories of data:

• Account and contact data: Information you provide when you contact us, subscribe, or create an account in areas of the site that require authentication.
• Usage and device data: IP address, browser information, pages visited, timestamps, and related diagnostics used to operate and secure the service.
• Statement conversion data: Files you upload for conversion, recognized text, parsed transaction rows, manual review history, processing metadata, generated exports, and related operational logs.

How We Use Data

We use collected data to:

• operate, maintain, and secure StmtPilot,
• validate uploaded PDFs and process conversions,
• generate review tables and CSV or XLSX exports,
• troubleshoot conversion failures and abuse,
• communicate with you about support, billing, or service updates.

Uploaded statement files and extracted rows are used only for conversion and related operational support. We do not use uploaded statement files or extracted transaction rows to train shared AI or model systems.

Scans And Browser Text Recognition

English scanned PDFs can use local OCR in your browser. Recognition code and English model assets are served by this website; recognition does not call a third-party OCR service. Recognized text and page information are then sent to StmtPilot servers to parse transaction rows, support review, and generate exports. The original PDF is still uploaded to our storage for file validation and source preview, so the full conversion workflow is not confined to your device. Scan quality and layout affect results; check every row.

Legal Bases And Your Responsibility

Where applicable, we process data based on one or more of the following grounds:

• your request to use the service,
• our legitimate interest in operating and securing the product,
• compliance with legal obligations.

You are responsible for ensuring that you have the right to upload and process the financial documents you submit to StmtPilot.

Retention Windows

StmtPilot uses short-lived retention windows for statement conversion data:

• Raw uploaded PDFs are retained for up to 24 hours from upload.
• Upload sessions, recognized text, extracted rows, and manual review history are retained for up to 7 days from session creation. Generated exports are retained for up to 7 days from export creation. Soft-deleted rows and their edit history remain until the session expires so you can undo deletion and inspect changes. Original-PDF preview expires after 24 hours even when the review results remain available.
• Aggregate service counters may be retained after these windows. They contain only a UTC calendar date, a fixed event category, anonymous/signed-in classification, and a count—not user or session identifiers, IP addresses, filenames, or statement content. They cannot reconstruct your statement or identify individual visitors.
• Expired exports and expired sessions are removed by cleanup jobs together with their associated stored files.

These windows are operational defaults for the current v1 product and may be shortened when needed for abuse prevention, legal compliance, or infrastructure safety.

Deletion Behavior

When the retention window expires:

• raw uploaded PDFs are deleted from object storage,
• generated export files are deleted from object storage,
• expired upload-session records and related conversion records are removed from the application database.

During the active retention window, access to statement data is gated by the upload-session token or authenticated account context, depending on the feature used.

Sharing And Processors

StmtPilot does not sell uploaded statement data. We may share data with service providers that help us operate the product, such as:

• hosting and content delivery providers,
• object storage and database providers,
• payment processors,
• email and support providers,
• security, logging, and analytics vendors.

These providers process data on our behalf under their own contractual and technical controls.

Third-Party Processors

Some site features may also link to third-party services that have their own privacy policies. We are not responsible for the privacy practices of services we do not control.

Security

We use reasonable administrative, technical, and organizational safeguards intended to protect statement data and other personal data from unauthorized access, loss, misuse, or disclosure. No system can guarantee absolute security.

Your Choices And Requests

If you have questions about statement-data handling, need us to investigate a specific upload, or need to request deletion of data that is still within the active retention window, please contact us. We may ask you to verify your request before acting on it.

Changes To This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the date on this page.