Privacy Policy

Online account records

When you open your account or use signed-in batch review, we save your account identifier, free account status and account creation date in our hosted database. We also store your verified email address for sign-in. We store hashes of login codes and session tokens, with expiry times and request counters, to authenticate you and limit abuse. We retain this account record while your account is in use, until you request deletion, except where retention is legally required. This record does not include statement files, transaction data or saved batches. Contact contact@statementimporter.com for account deletion requests.

1. Who is responsible

StatementImporter is operated by Yang Ding, an individual based in Beijing, China. Yang Ding is responsible for personal information processed by this service. For privacy, support or security enquiries, email contact@statementimporter.com.

2. Your statements stay on your device

The current converter extracts PDF text, performs OCR and prepares exports in your browser. It does not upload source PDFs, PDF passwords or extracted transactions to our servers or to a remote AI model for conversion. We do not request bank login credentials or use your statements to train AI models.

Unsaved files and results are held in the current tab and cleared when it closes or reloads. If you explicitly save a batch, the PDFs, transactions, review notes and correction history are stored in this browser’s local database. Saved copies survive closing the tab and signing out. They are not cloud backups and are not encrypted by the application. Use a private browser profile and delete saved work or clear site data on shared devices. Downloaded exports remain wherever you save them.

3. Other information processed

When you sign in with email, we send a one-time code through Resend. Your email address is shared with that provider to deliver the code. We store your email, a site account identifier, hashed verification and session data, and send-limit counters. Codes expire after 10 minutes, with at most five attempts; session cookies expire after seven days and are revoked when you sign out. We use a necessary HttpOnly session cookie, not advertising cookies. Network address hashes and request counters help limit abuse.

Website delivery and security involve technical information such as IP address, browser information, requested URL, request time and error information. Hosting and security providers may process this information. If you email us, we receive your email address, message and any attachments you choose to send. Do not email unredacted financial documents, passwords or payment card details.

For service operation and troubleshooting, we record successful registration and sign-in, and browser-reported conversion completion, conversion failure and export actions, linked to your account and time. Where our hosting platform supplies them, we record the request IP address and approximate country or region. Browser events may be incomplete or inaccurate; they do not certify conversion results. We do not send statement filenames, contents, transaction details, PDF passwords or raw error text with these events.

4. Purposes and legal bases

We use account information to provide requested account features, and correspondence to answer your requests. Where applicable, the legal basis is performance of a contract or steps you request before a contract. Necessary security and troubleshooting use our legitimate interests where that basis is available under applicable law; legally required processing relies on legal obligations. Where consent is legally required, it must be obtained separately. This policy is not blanket consent to unrelated processing.

5. Cookies and device storage

Hosting and sign-in services may use cookies necessary for authentication and security. Local storage is used for explicitly saved batches and downloaded OCR resources. Clearing site data removes local saved work and may require OCR resources to download again. The application does not currently include advertising pixels or a marketing analytics integration. We do not currently send marketing campaigns.

6. Providers and disclosures

The website uses OpenAI Sites and its Cloudflare infrastructure for hosting, delivery, authentication and security. Email providers process support correspondence. These providers handle relevant account, technical or communication data; local conversion does not send them the contents of your statements.

We do not sell personal information or share it for cross-context behavioural advertising. Information may be disclosed when required by law or necessary to protect legal rights. We do not disclose your local statement contents because the conversion service does not receive them.

We use a private Lark group for operational notifications. Lark receives the account email, event type, event time and approximate country or region when available. Raw IP addresses are restricted to our administrator view and are not included in these messages. Notifications are accessible to authorised operators and processed by Lark under its service arrangements.

7. Retention and deletion

Source statements and conversion results: zero server-storage days in the current conversion workflow. Unsaved browser data lasts for the tab session; explicitly saved batches remain until you delete them or the browser removes its storage. Downloaded files are under your control.

Support correspondence is retained while needed to resolve your request and any related dispute or legal obligation. You may request deletion by email. Hosting, authentication and email providers maintain their own records under their policies; deleting local batch data does not delete your sign-in account or provider logs. Expired code, session and rate-limit rows are cleaned up when new code requests are processed; expiry is enforced even before cleanup. We do not promise a fixed deletion period for records outside our control.

Operational event records are visible to administrators for 30 days; older records are deleted when a new event is recorded or an administrator opens the event page. Lark notification copies are separate from these records and may remain under that service’s retention arrangements. Contact us to request deletion from both systems.

8. Your privacy rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing and withdraw consent where processing relies on it. Email contact@statementimporter.com with your request. We may need proportionate identity verification and will respond within the period required by applicable law. You may complain to the relevant data protection authority. We do not need your original bank statement to process a routine privacy request.

You can delete saved batches using the local save controls or clear this website’s browser storage. For deletion of your sign-in account and associated sessions, email our support address from your registered email.

9. International processing and security

The operator is based in China. Hosting, authentication and email services may process account and technical information in other countries, subject to their service arrangements and applicable law. Local PDF conversion does not itself transfer your statement contents overseas. We do not claim a particular data-residency region or certification for this product.

The website uses HTTPS. Account features require authenticated identity, but local saved copies are not encrypted by this application. No system is perfectly secure. Please report suspected incidents to contact@statementimporter.com. Where notification is legally required, we will notify affected people and authorities as required by applicable law.

10. Age, changes and contact

The service is intended for adults aged 18 or older. If you believe a child has sent personal information to us, contact us to request its removal.

Changes will be published on this page with an updated date. Material changes will be highlighted on the website, and consent will be requested where required. Server-side statement processing or paid checkout will not be treated as already covered by a claim that all data remains local.

Operator: Yang Ding (individual). Location: Beijing, China. Support, privacy and security: contact@statementimporter.com.