Privacy Policy

Export Bank Statement is the data controller. For anything in this policy, including requests to access or delete your data, write to rudra@exportbankstatement.com. A real person reads it.

When you upload a statement, the file is passed to our conversion service, which reads the pages, extracts the transactions and checks that they reconcile. The result is returned to your browser. The file is not written to any database, object store or backup, and is discarded once the response is sent. The extracted transactions are returned to you and are not retained on our servers.

Being precise about where it goes: the website and the conversion service are separate systems, so the contents of your statement are transmitted between them over an encrypted connection during processing. Both are operated by us, and neither retains the file afterwards.

Password-protected PDFs. If your statement is encrypted, the password is used by JavaScript running in your own browser to unlock the file there. The password is never transmitted to us, never logged and never stored. Only the unlocked page content is sent for processing. This matters because these passwords are usually built from a date of birth or a customer ID.

You can convert without an account. If you create one, we store your email address and sign-in records so we can operate the account and apply your allowance. We use Google sign-in or an emailed magic link; we never see or store a password for your account.

Paid plans are sold through Dodo Payments, which acts as merchant of record. That means Dodo — not us — takes your payment, handles tax, and issues the invoice. Your card details are entered on Dodo's systems and are never seen by or transmitted to us. We receive confirmation that a subscription started, renewed, lapsed or was cancelled, along with the email address and plan it relates to, so we can grant or remove access.

If you choose to connect Xero or QuickBooks, we receive an access token from that provider. Both connections are read-only: we read basic details such as your organisation or company name so your account shows which books are connected, and we never create, change or delete anything in them. Tokens are stored with our Redis provider (Upstash) and deleted when you disconnect, which you can do at any time from your account page or from inside Xero or QuickBooks.

• Usage limits.To enforce free limits we keep a signed cookie in your browser and a short-lived count against your IP address. It isn't used to identify you or for advertising.
• Page allowance. For subscribers we count how many statement pages you convert each month, so we can apply the plan you bought.
• Public API. If you use our API we store the key, its owner, and a log of requests made with it, for billing and abuse prevention.
• Support. If you email us, we keep the message and your address so we can reply.
• Server logs. Timestamps, request paths, IP addresses and error details, for security and reliability, kept briefly.

We use the following providers. Each is bound by contract to process data only on our instructions. Locations are where the relevant service runs.

• Vercel — hosting and serverless execution of the website (United States).
• Hugging Face — hosts the conversion service that reads your statement during processing.
• Supabase — database for site content and account records (Singapore).
• Upstash — Redis for sign-in sessions, usage counts, subscription state, and the access tokens for Xero or QuickBooks if you connect them.
• Google — sign-in, if you choose it; and Google Tag Manager / Analytics for site statistics.
• Zoho Mail — sending sign-in links and replying to you.
• Dodo Payments — payment processing as merchant of record.
• Cloudflare R2 / S3-compatible storage — images and files used by the website itself. Your statements are never written here.

Some of the providers above run outside the UK and EEA, including in the United States and Singapore. Where that happens we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or on the provider's own adequacy arrangements, to protect the transfer.

• To perform our contract with you — converting a statement, running your account, taking payment.
• Legitimate interests — keeping the Service secure, preventing abuse, and understanding how it is used, balanced against your rights.
• Consent — analytics cookies, and marketing email if you ask for it. You can withdraw it at any time.
• Legal obligation — tax and accounting records relating to payments.

• Uploaded statements — not retained; discarded once converted.
• Account records — while your account exists, then deleted on request.
• Usage counts — days for daily limits, roughly two months for monthly page allowances.
• Payment records — as long as tax law requires, typically six years.
• Server logs — a short period for security and debugging.

If you are in the UK or EEA you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Ask at rudra@exportbankstatement.com and we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk, or to your local supervisory authority.

If you are in India, you have equivalent rights under the Digital Personal Data Protection Act, including access, correction, erasure and grievance redressal — use the same address. If you are in California, we do not sell or share personal information as those terms are defined by the CCPA, and you may request access or deletion.

We use a small number of cookies: one to keep you signed in, one to hold your free-usage count, and one to remember which country's pages you are reading. These are necessary for the Service to work. If analytics is enabled we also use Google Tag Manager and Analytics to understand which pages are useful; you can block these with your browser or an extension without affecting conversion.

Everything travels over TLS. Statements are never written to disk by us. Account passwords do not exist — sign-in is by Google or emailed link, so there is no password for us to lose. API keys are stored hashed, not in plain text. No system is perfectly secure, and we will tell you promptly if something happens that affects you.

The Service is for business use and is not directed at anyone under 16.

If this policy changes materially we will update the date above and, where the change affects you, say so on the Service. This page is a description of how the Service actually works, not a template, so it changes when the Service does.

rudra@exportbankstatement.com