Privacy Policy

When you upload a bank statement PDF, it is transmitted over an encrypted connection and processed in memory only for the duration of that request. The PDF and the individual transactions it contains are never written to our disk or database and are discarded as soon as your result is returned.

Only the last four digits of the account number are ever extracted — never the full number.

Account data: your email address, and your name if you sign in with Google.

Usage metadata: for each analysis we keep summary metadata only — bank name, the last four digits of the account, statement period, page count, transaction count, reconciliation status and timestamp. We do not keep the transactions themselves.

Billing data: subscriptions are handled by Stripe. We store your Stripe customer and subscription identifiers and your current plan; we never receive or store your card details.

Technical data: essential cookies for your session and a cookie storing your language preference.

Performance of our contract with you — to provide the Service, your account and billing.

Our legitimate interests — to secure the Service, prevent abuse and improve the product.

Compliance with a legal obligation — to keep accounting and tax records for payments.

We rely on a small number of processors, each bound by a data-processing agreement: Mistral AI (transient OCR and structuring of the uploaded PDF), Supabase (authentication and database hosting), Stripe (payment processing) and Vercel (application hosting).

Some processors may process data outside the European Union under appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Account data and analysis metadata are kept while your account is active and deleted when you close it. Billing records are retained for the period required by law.

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, and to object to certain processing. To exercise any of these, email support@scanstatement.com.

You also have the right to lodge a complaint with your supervisory authority — in France, the CNIL (www.cnil.fr).

We use only essential cookies: those that keep you signed in and one that remembers your language choice. We do not use advertising or third-party tracking cookies.

We may update this policy; the date above reflects the latest version. Material changes will be communicated through the Service.