Skip to content
BankConv
Get started

Privacy Policy

We collect what we need to convert your statements and run the service. Uploaded statements and their results are deleted automatically after 24 hours by default. We don't sell your data, don't use advertising cookies, and don't use your statements to train AI models.

Updated

This Privacy Policy explains what data BankConv (“BankConv”, “we”, “us”) collects, why we collect it, who processes it for us, and how long we keep it. It applies to the website at https://bankconv.com, the web app at https://app.bankconv.com, the REST API at https://bankconv.com/api/v1 and the “BankConv for Google Sheets” add-on. BankConv is responsible for the personal data and documents described here.

What we collect

Documents you upload. When you convert a bank statement, with or without an account, we receive the PDF, any password you type to open it, and the data extracted from it (transaction rows, dates, amounts, balances and account details printed on the statement). The password is used to open the file and is not stored.

Account data. If you create an account, we collect your name, email address and a hashed password. For paid plans, our payment processor collects the billing details it needs; we do not see or store full card numbers.

Usage data. We log requests, conversion events, IP addresses, browser user agent and error traces, for security, abuse prevention and fixing problems.

Analytics. We use PostHog, a product analytics service, on the website and in the web app to understand which pages people visit and where the conversion flow breaks. It records page views and a few product events (for example, that an upload started or failed), never the contents of your statements. In the web app it may also record how pages are used (session replay) so we can find usability problems. Browsers that send a Do Not Track signal are not tracked on the website.

Cookies. We use first-party cookies for sign-in, sessions and security, and PostHog’s first-party analytics cookie (names starting with ph_), which lets us recognise the same browser across bankconv.com and app.bankconv.com. We do not use advertising cookies.

Google user data (Google Sheets add-on)

When you authorize the BankConv for Google Sheets add-on, it requests these OAuth scopes:

  • script.container.ui: to show the BankConv sidebar inside Google Sheets
  • script.external_request: to call the BankConv API at https://bankconv.com/api/
  • script.storage: to store your BankConv access token in Apps Script user properties
  • spreadsheets.currentonly (@OnlyCurrentDoc): to write converted transactions to the spreadsheet you have open

In practice:

  • The add-on only reads or writes the spreadsheet that is currently open. It cannot see your other Drive files.
  • The PDF you choose in the sidebar is uploaded to BankConv for conversion, and the result is written into a new tab in the same spreadsheet.
  • Your BankConv access token is stored in Apps Script user properties, scoped to your Google account, until you disconnect.
  • We do not read, copy or index any other content from your Google account.

Limited Use. BankConv’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train generalized AI models, we do not sell it, we do not share it with third parties for advertising, and human access is restricted to debugging or security investigations with your explicit consent or where required by law.

You can revoke the add-on’s access at any time from the sidebar’s “Disconnect” action or at myaccount.google.com/permissions.

How we use your data

We use the data we collect to:

  • Convert your statements and return the results to you
  • Authenticate you, secure your account and enforce usage limits
  • Bill paid plans and prevent fraud
  • Send transactional email (receipts, security alerts, service notices)
  • Understand how the website and app are used, and improve them
  • Meet legal obligations

We do not sell your data, and we do not use the contents of your bank statements or Google user data to train generalized machine learning models.

Who processes data for us

We share data only with the service providers we need to run BankConv:

  • Document processing providers: reading the text and tables in the statements you upload, so we can return them as rows
  • Stripe: payment processing and subscription billing
  • Cloud hosting and storage providers: running the Service and storing uploaded files until they are deleted
  • Email delivery providers: sending transactional email
  • Cloudflare: delivering the website and protecting forms from bots
  • PostHog: product analytics
  • Error monitoring providers: capturing application errors so we can fix bugs

Each provider may use your data only to provide its service to us. We may also disclose data when required by law or court order, or to protect the rights, safety and property of BankConv or its users.

How long we keep it

  • Uploaded PDFs and extracted data: deleted automatically after the retention window, which is 24 hours by default (48 or 72 hours if your team chose a longer window). This includes uploads made without an account. After that, download requests return 410 Gone.
  • Account data: kept while your account is active, then deleted or anonymized within 90 days of closure, except where tax or legal obligations require longer.
  • Logs and usage data: kept for up to 12 months for security and abuse prevention.
  • Google OAuth access tokens: stored in Apps Script user properties on your Google account until you disconnect the add-on, and revoked on our side when you disconnect.

Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, restrict or object to its processing, and withdraw consent. Email support@bankconv.com and we will respond within 15 working days. You can also delete your account from your dashboard at any time, and you have the right to complain to your local data protection authority.

Security

Files and data travel over HTTPS (TLS) between your browser, BankConv and our providers. Access to production systems is limited to the people who run the Service. If we discover a personal data breach that affects you, we will tell you without undue delay. More detail is on the security page.

International transfers

Your data may be processed in countries other than your own. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for these transfers.

Children

The Service is not directed to children under 16, and we do not knowingly collect data from them.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes are announced by email or in-product notice at least seven days before they take effect.

Contact

Privacy questions, data requests or complaints: support@bankconv.com.