How files are handled
This page describes what actually happens to a statement between upload and download, written to be checkable against the product rather than to sound reassuring.
What is stored, and for how long
- The uploaded file is kept only while the job is being read: deleted when the conversion finishes, and within 24 hours even if the job is never paid for.
- The converted result stays at its link so you can come back to it. The link is a long random token, the page is marked
noindex, and it never appears in the sitemap. - The job record holds the file name, page count, the format you chose, and — if you gave one — your email, purely to send the link.
- A PDF password is never sent to the server: an unlock happens in the browser, so the password stays on your machine.
Who touches the data
| Processor | What for | Sees |
|---|---|---|
| Cloudflare | Serving the site, storing files and job records | The file and the result |
| Google (Gemini API) | Reading the statement to extract transactions | The file, for the one request that reads it |
| Polar | Taking the payment as merchant of record | Your payment details — never the statement |
No bank credentials are ever requested, and there is no bank connection to revoke.
Transport
The site is https-only, with Strict-Transport-Securityset, so a browser that has visited once will not fall back to plain http. Uploads go straight to the same origin over TLS.
Security questions
How long are uploaded files kept?
A file is deleted when its conversion finishes — the full read is the last thing that needs it — and within 24 hours even if the job is never paid for.
How long is the converted result available?
The result stays at its link, which is why the link is a long random token rather than a guessable address. The result page is marked noindex and is not in the sitemap.
Is the statement read by a third party?
Reading is done by Google’s Gemini API, which is the model that does the extraction. It is a processing subprocessor, not a place the file is kept.
Where is the data stored?
In Cloudflare, in the region Cloudflare picks for the storage bucket and database. Payments are handled by Polar, so card details never touch this site.
Do you need my bank login?
No. The product never asks for bank credentials; it works only on the statement file you upload.
Asking about any of this
Write to support@statementconverterai.com — including if you want the data-protection addendum, which is atDPA.