Held briefly.
Then deleted.

An uploaded statement is used for one thing: producing your conversion. The PDF is deleted as soon as its conversion finishes, whether it succeeded or failed. The converted CSV is kept for 1 hour after completion so you can download it, then deleted. Nothing about your statement is read by a person, used to train anything, shared, or sold.

The try-it demo on the landing page works the same way without an account: the uploaded PDF is deleted as soon as it has been converted, and the on-screen preview after 15 minutes.

An account is an email address. There is no password to store or to lose: signing in emails a one-time link to the address, which stops working 15 minutes after it is sent, and the session it starts lasts up to 30 days or until you sign out. We send email only to operate the service: the sign-in link, and billing notices such as a renewal that needs you.

Payments are handled by Stripe. Your card details go to Stripe directly and never reach our servers; we keep only your subscription state and what Stripe needs to identify your customer record. Stripe processes them under its own privacy policy.

Like every web service we see the IP address of each request, which we use for rate limiting and abuse protection. It is recorded with a sign-in request, a session and an audit event, and it goes when the row it is on is swept. Your email address is not in the audit trail: a sign-in request records a keyed hash of it instead, so that "how many links went to this address" stays answerable while a copy of the trail holds no addresses.

The audit trail — a plan changed, a conversion refused, a sign-in link sent — is append-only: no query can rewrite it. It is swept after 1 year. Requests are logged for operating the service, and a line names the account, the conversion and a request id — never the email, the sign-in link, the session token or the filename.

We load no analytics and no advertising trackers, and the fonts are served from this site rather than from a font network, so no third party sees your address. Cookies are limited to what the demo, signing in and security require.

You can ask us at any time for a copy of the data we hold about you, or for your account and its data to be deleted. Because statements and results are deleted automatically as described above, in most cases the only data we still hold is your account and billing record.

If this policy changes in a way that matters, we will note the new effective date here.