Privacy Policy

Statemently converts bank statements into structured accounting data. Bank statements are sensitive, so this policy explains plainly what we collect, what we do with it, and what we deliberately do not do. If anything here is unclear, contact us at privacy@statemently.app.

Who we are

Statemently (“we”, “us”) provides a bank-statement conversion and analysis service. This policy applies to the Statemently website and application.

What we collect

Account information

When you create an account we store your email address and authentication credentials (passwords are stored only as a secure hash, never in plain text). If you sign in with Google or GitHub, we receive your basic profile and email from that provider.

Statement data you upload

When you convert a statement we process the file to extract transactions. We store the extracted, structured data — dates, descriptions, amounts, balances, a masked account number (last few digits only), the detected bank/currency/period, and validation results — so you can review, edit and export it.

What we do NOT store

• We do not retain the original uploaded file’s raw bytes on our servers after processing; we keep only its extracted data and a content fingerprint (a one-way hash) used to detect duplicate uploads.
• We do not store the password of a password-protected PDF. It is used only in memory to open the document during processing and is then discarded.
• We do not store full account numbers — account identifiers are masked to their last digits.

Billing

Payments are processed by our payment provider (Dodo Payments). We do not receive or store your full card details; we store only your subscription status and plan.

Usage & technical data

We keep aggregate, privacy-safe operational metrics (for example: how a document was read, page counts, number of transactions extracted, and processing outcome). These metrics never contain transaction descriptions, amounts, account numbers or other statement content.

How we use your data

• To convert your statements and let you review, correct and export the results.
• To provide analytics and insights on your own statements.
• To operate your account, enforce plan limits, and process billing.
• To maintain security, prevent abuse, and diagnose problems using privacy-safe metrics.

We do not sell your data. We do not use your statement contents to train AI models.

Advanced document recognition and AI processing

Most statements are read entirely by Statemently’s own software, including scanned pages, which our own OCR reads on our servers first. Only when that reading cannot be verified, and your plan includes advanced document recognition (within its monthly allowance), does Statemently send images of the affected pages to an external AI provider, Groq, Inc., to transcribe the transactions. If you use Ask Statemently, your question and the result Statemently already calculated for it (for example a total, a count or a weekday breakdown, and up to 8 example transactions) are sent to the same provider so it can phrase the answer.

• We send only what the task needs: images of the pages that need recognition, or computed summaries for questions. A page image contains everything printed on that page, which can include your name, address, account number and transaction details. We never send the rest of the file, PDF passwords, or your login details. For questions, each example transaction includes only its date, amount, debit/credit and a payee name with reference and account numbers removed; a balance is included only when your question asks about balances. Whole statements, account numbers, page images and files are never sent for questions.
• The provider’s output is never treated as financial truth. Statemently parses every amount and date itself and checks the result against the statement’s balances; anything that does not reconcile is flagged for your review.
• According to Groq’s published data policy, Groq does not retain inference data by default but may retain it for up to 30 days for system reliability and abuse monitoring, and stores customer data in the United States.
• Recognition results may be held in our server memory for up to 30 minutes so that a retry of the same document is not processed twice. They are not written to any additional storage.
• Conversions on the Free plan, and conversions made before signing in, never use this feature.

Sharing

We share data only with the service providers that make Statemently work — our cloud database and hosting provider, our payment provider, and our AI document-recognition provider (Groq, only for the processing described above) — and only as needed to deliver the service. Statements and their transactions are visible only to the account that uploaded them; inviting someone to a workspace does not share your statements with them.

Data retention & deletion

Your statements and their data remain available in your account until you delete them. Deleting a statement removes its transactions and associated records. You can delete your account to remove your data, subject to any records we must keep for legal or accounting reasons. Anonymous (pre-signup) conversions are automatically expired and removed after a short window if unclaimed.

Security

We encrypt data in transit, store credentials as hashes, mask account numbers, and design our processing so sensitive values (like PDF passwords) are never persisted. No online service can promise perfect security, but we take these responsibilities seriously — see our Security & Data Handling page for specifics.

Your rights

Depending on where you live, you may have rights to access, correct, export or delete your personal data. You can exercise most of these directly in the app, or contact us at privacy@statemently.app.

Changes

We may update this policy; we will change the “last updated” date above and, for material changes, notify you in the app.