Privacy policy

We process the bank statements you upload only to extract and check their transactions for you. We don't store the PDF, we delete extracted data after 24 hours, and we never sell your data or use it to train AI models.

• Statement contents you upload: transaction dates, descriptions, amounts, balances, statement period and the last four digits of the account number. Other content on the statement (such as your name and address) is read during processing but not stored.
• Edits you make while reviewing.
• Purchase records: order reference, pack, amount, status and credit balance. Stripe processes your payment details; we don't receive card numbers.
• Technical data: a session cookie (stored by us only as a keyed hash), IP address for rate limiting (not stored in our database), and request logs without document content.

To provide the conversion, verification and export you request; to process purchases and restore them with your recovery code; to prevent abuse; and to keep the service secure. We don't use statement data for advertising, profiling or model training.

To understand which pages and steps work, we record a small set of usage events (for example “page viewed”, “statement converted”, “export downloaded”) with a random identifier stored in your browser. Events never contain statement contents, file names, amounts, account details or your IP address; we pass only an approximate country and state. Events are sent through our own servers to our analytics provider, Amplitude, which processes them on our behalf. No analytics scripts from third parties run on this site and we don't use session recording. We honor Global Privacy Control and Do Not Track signals.

Uploaded PDFs are not stored. Extracted transactions are deleted 24 hours after upload or when you delete them. Purchase records are kept as long as required for accounting and tax purposes [period to be confirmed]. See Privacy & security for details, including how backups are handled.

We share data only with service providers that help us run DocuBridge (hosting: Vercel and Google Cloud; product analytics: Amplitude; payments: Stripe, once paid plans start), under contracts that limit their use of it, or when required by law. [Subprocessor list and data processing terms to be finalized.]

You can delete a statement at any time from the review page. Depending on where you live (for example, California and other US states with consumer privacy laws), you may have rights to access, delete or correct personal information and to opt out of its sale or sharing — DocuBridge does not sell or share personal information as those laws define it. [State-by-state wording and request process to be finalized with counsel.]

DocuBridge is not directed at children under 13 and we don't knowingly collect their information.

DocuBridge is offered to users in the United States and processes data in the United States. [GDPR applicability to be assessed before accepting users outside the US.]

Questions or requests, including deletion and access requests: email robin421@gmail.com.