Privacy policy
Effective Nov 1, 2026
This policy explains what personal data Amr Al Hallak, Sarajevo, Bosnia and Herzegovina (“we”) processes when you use Bank Statement Categorizer, why, and your rights. Contact: support@bankstatementcategorizer.com.
What we collect
- Account data: your email address and, if you use Google sign-in, your Google account email.
- Documents you upload: processed in memory to extract transactions, then discarded. We do not store the uploaded files.
- Extracted data: transactions, balances, bank name and the last four digits of the account number, stored so you can review and export them.
- Billing data: plan, purchases and a Paddle customer reference. Card details are handled by Paddle only.
- Technical logs: IP address, request times and error codes, kept up to 30 days for security and debugging. Logs never contain transaction contents.
- Website analytics (only if you accept): pages visited, device and browser type, approximate location and how you found the site, collected by Google Analytics with cookies. We use it to see which pages help people. Statement contents are never sent to analytics.
Why we process it (legal bases)
- To provide the service you asked for — contract (GDPR Art. 6(1)(b)).
- To keep the service secure and prevent abuse — legitimate interest (Art. 6(1)(f)).
- To meet tax and accounting obligations — legal obligation (Art. 6(1)(c)).
- Website analytics — your consent (Art. 6(1)(a)), which you can withdraw at any time with “Cookie settings” at the bottom of every page.
Who processes data for us
- Anthropic (AI model provider) — reads PDFs and photos to extract transactions and suggests categories. Not used for model training; may be retained by Anthropic for a limited period for safety monitoring.
- Supabase — database and sign-in.
- Paddle — payments; Paddle acts as merchant of record and is an independent controller for payment data.
- Our hosting provider — runs the server that processes your uploads.
- Email delivery provider — sends sign-in codes.
- Google (Google Analytics 4) — website analytics, only after you accept. IP addresses are not stored by Google Analytics 4.
Some of these providers are located outside the EEA; transfers are covered by Standard Contractual Clauses or an adequacy decision.
How long we keep it
Uploaded files: not stored. Extracted transactions: until you delete them, your automatic-deletion setting removes them, or you delete your account. Billing records: as long as tax law requires.
Your rights
You can access, export, correct and delete your data at any time in the app, or by emailing us. You can also object to processing, restrict it, and complain to your data protection authority.
Cookies
Essential cookies keep you signed in and remember your language; they don't need consent. Google Analytics cookies (_ga, _ga_*, up to 2 years) are set only if you click “Accept” in the cookie notice. You can change your choice at any time with “Cookie settings” at the bottom of every page.
Changes
We’ll post updates here and email you about material changes.