DRAFT, NOT IN EFFECT. Pending review by the operator (and ideally a lawyer) before launch. Bracketed items are placeholders.

Privacy Policy

Last updated: DRAFT, not yet in effect

This policy explains how Jack Keyser, sole proprietor dba Statemio, doing business as Statemio ("we", "us"), operator of https://statemio.com, handles personal information.

1. Statements you upload

Uploaded PDFs are processed in a temporary file that is deleted when processing finishes. We do not keep a copy of the PDF. Extracted transaction data is held in server memory for up to one hour so you can download it, or until you delete it, and is not written to our database or logs. Scanned PDFs are read with optical character recognition software running on our own server. [If the optional AI vision fallback is enabled: page images of scanned statements that local OCR cannot read may be sent to [AI PROVIDER] for processing under its API terms, which [do not permit training on API data]. This feature is currently disabled.]

2. Information we collect

Account data: your email address, and records of sign-in links and sessions.
Usage data: number of pages converted per day; for visitors without an account, a salted, daily-rotating hash of the IP address for the free allowance.
Payment data: order, subscription and refund status, and a customer reference, received from our payment provider. We do not receive full card details.
Technical data: standard server logs (time, URL path, status code, and IP address [retained for [14] days]) for security and abuse prevention. [If error monitoring is enabled: error reports via [Sentry], configured not to include statement contents.]

3. How we use it

To provide the service, sign you in, apply your page allowance, process purchases, prevent abuse, and meet legal obligations. We do not sell personal information and do not use your statements to train models. We do not use advertising trackers.

4. Service providers

Hosting: [Render Services, Inc.] (servers and database) [region: US].
Payments and tax: Polar Software, Inc. (polar.sh), as merchant of record. Polar processes payment details under its own privacy policy.
Email delivery: [Resend], for sign-in links and service messages.
[Optional: error monitoring, bot protection (Cloudflare Turnstile), AI vision provider.]

5. Retention

Statement data: up to 1 hour in memory (see section 1). Account data: until you delete your account. Usage counters: [13 months]. Order records: as long as tax and accounting law requires [typically 7 years], kept with the account link removed after deletion.

6. Your rights

You can access, correct, export or delete your account data. Account deletion is available on the account page; for anything else, contact us. Depending on where you live (for example, the EU/UK under the GDPR or California under the CCPA/CPRA), you may have further rights, including objecting to processing and complaining to a regulator. Our legal bases are contract (providing the service), legitimate interests (security and abuse prevention), and legal obligation (tax records).

7. Cookies

We use one strictly necessary cookie (statemio_session) to keep you signed in. No analytics or advertising cookies. [Update this if analytics are added.]

8. Security

See our Security page for technical measures. No method of transmission or storage is perfectly secure.

9. Children

The service is not directed to children under 16.

10. Changes and contact

We will post changes here and update the date above. Contact: support@statemio.com, [POSTAL ADDRESS IF REQUIRED].