Privacy Policy
What we process, what we don't keep, who touches your data, and how to exercise your rights.
Last updated September 20, 2026
This policy is the binding document. The security page walks the same data flow in plain language, and the data processing agreement is the Article 28 contract your firm can put on file without writing to us first.
1. Who we are and who is responsible
StatementTable ("we") is operated by Halil İbrahim Umut Çolak, an individual based in Türkiye. Postal address on request, and on any agreement we countersign for you. Contact for anything in this policy: support@statementtable.com. We are the data controller for the processing described here, and the processor for the contents of the statements you upload, which remain your data throughout.
Payments are processed by Polar Software Inc., our merchant of record. Polar is the seller of record for every purchase and an independent controller for the billing data it collects, under its own privacy policy.
Questions about this policy, requests to exercise a right, and requests to name a provider all go to the same address: support@statementtable.com.
2. How we process your files
When you upload a statement, we do three things: we read the pages, we send the page text or page images to Anthropic's commercial API, where its Claude model returns the transactions in a structured form, and we check the result against the balances printed on your statement before showing it to you.
We don't keep your file. It is held in the memory of the single request that converts it. It is never written to disk, never queued and never copied into a bucket or a database, and it goes when that request ends, whether the conversion succeeded or failed. The same applies to the page images we prepare from it and to the transactions extracted from it. We do not write your statement, its pages or its contents to a log. A conversion takes minutes at most, and nothing survives an hour under any circumstance. The hosting platform keeps its own operational request logs, which record what a request was and how it ended, never what was in it; they are in the retention table in section 7.
Anthropic, PBC, the AI provider we use, is located in the United States. It is bound by a data processing agreement and standard contractual clauses, its commercial terms prohibit it from using your data to train its models, and it deletes the inputs it receives from us within 30 days. The one exception is a request its automated safety systems flag under its usage policy, which it may keep for longer. It receives only the document you uploaded, not your email address, your account or your payment details.
The service is fully automated. Nobody at StatementTable reads your statement.
3. What we process, and on what legal basis
Article references are to the UK GDPR and the EU GDPR, which use the same numbering. Where we rely on legitimate interests, the interest is stated in the row and is the ordinary operation of a paid service: delivering the conversion, keeping the free tier from being consumed by automated abuse, answering the person who wrote to us, keeping accurate service statistics, and knowing whether an advertisement we paid for led to a sale.
| Data | Why we process it | Legal basis |
|---|---|---|
| The statement you upload and the transactions extracted from it | To perform the conversion you asked for | Performance of a contract, Article 6(1)(b) |
| A salted hash of your IP address and the number of pages converted today | To enforce the free tier and stop automated abuse | Legitimate interests, Article 6(1)(f) |
Usage records of each conversion, download and upload: page count, document type, native or scanned, the upload's size and number of files, the most transactions on one page, success, refusal or failure with a fixed reason code, whether the balance check passed, and processing cost. A random reference links a conversion to the review workbook downloaded from it, and the review workbook carries a second random reference in its document properties (StatementTableRef), so we can count how many workbooks come back to Step 3. A record without an account identifier is also kept when an account is created, signs in or is deleted. None of these records holds a file name, a bank name, an account number or anything from inside a statement. | Service statistics, capacity planning, and finding where the service fails people | Legitimate interests, Article 6(1)(f) |
| Visit statistics, collected without cookies and without storing anything in your browser: the page path, the referring site's hostname, a campaign tag when the link carries one, your country and your network's number (ASN) as Cloudflare's network reports them for the connection, a coarse device class (phone, tablet or computer), your browser family, and a daily visitor key. The daily visitor key is a one-way hash of your IP address and your browser's user-agent string together with a random value that exists for one report day and is then deleted. We never store the IP address or the user-agent string themselves. The same facts are recorded on the usage records above. | To count how many different visitors came on a day, where they came from, and how many of them reached each step (a visit, a conversion, a download, a purchase), and to leave automated traffic and our own test account out of those numbers | Legitimate interests, Article 6(1)(f) |
The Google click id, if you arrived by clicking one of our advertisements on Google Search: the gclid value the ad link carries, or its gbraid and wbraid variants. It is stored against the same daily visitor key as the visit statistics above, so that an order can be matched back to the ad click that started it. We advertise only in the United States and Canada, so no other visitor has one. | To tell Google which paid orders came from which ad click, and so to know which advertisements are worth paying for | Legitimate interests, Article 6(1)(f) |
| Error codes from the converter page: a fixed code saying which error you were shown or which request failed, and for a script crash the script's file name and line number. Never the text of the error message, which could quote a statement. | To find and fix faults in the converter | Legitimate interests, Article 6(1)(f) |
| Your email address, if you create an account | To create your account, send you a sign-in code, hold your credit balance and send receipts | Performance of a contract, Article 6(1)(b) |
| Sign-in codes: a hash of the six-digit code, its expiry and the number of attempts | To sign you in, and to stop code guessing | Contract and legitimate interests, Articles 6(1)(b) and 6(1)(f) |
| Your credit balance and the ledger behind it: purchases, deductions, refunds, subscription renewals | To show what you have and to honor refunds | Performance of a contract, Article 6(1)(b) |
| Your conversion history: date, page count, document type, whether the balance check passed. We do not record file names, bank names, account numbers or anything from inside your statement. | To show you what you have used, and to support you | Performance of a contract, Article 6(1)(b) |
| Name, email, billing country and purchase details | Selling you credits and plans, issuing invoices, collecting VAT and sales tax | Contract and legal obligation, Articles 6(1)(b) and 6(1)(c). Collected by Polar as merchant of record. |
| From each order notification Polar sends us: the amounts, currency, billing country, the plan bought, whether it is a first purchase or a renewal, and keyed one-way hashes of Polar's customer and checkout references. No name, email address or postal address. | Revenue statistics, and matching a checkout that was started to the payment that completed it | Legitimate interests, Article 6(1)(f) |
| Messages you send through the contact form or by email | To answer you | Legitimate interests, Article 6(1)(f) |
We process no special-category data deliberately. A bank statement can incidentally reveal, for example, a payment to a hospital or a political party; we neither look for that nor derive anything from it, and the file is deleted when the conversion ends.
Whether you have to give us anything. Nothing here is a statutory requirement. Uploading a statement is what the conversion is made of, so without a file there is nothing to convert. An email address is needed to hold a credit balance and to send a receipt, so an account cannot exist without one. Everything else is optional, and leaving it out costs you nothing but a reply.
Automated decision-making. Extraction and the balance check are automated, but they produce a spreadsheet for you to review. We take no decision about you by automated means that produces a legal effect or similarly significantly affects you, within the meaning of Article 22. We do not profile you. Within one report day, the daily visitor key links the steps one browser took on this site, so that we can count how many visitors reached each step; that link ends when the day's random value is deleted. The records carry no account identifier or email address, and we do not combine them with your account or join one day's visits to another's. One limit is worth stating plainly: the record of a sign-in or of a started checkout carries the time it happened, and a started checkout is matched to its completed order by a keyed hash, so for a day on which you signed in or bought, we could in principle connect that day's steps to your account or order. We do not.
Global Privacy Control and Do Not Track. If your browser sends the Global Privacy Control signal, we compute no visitor key for its requests and Google's advertising tag is never sent to it. The visit and the conversion are still counted, but not as a visitor. A Do Not Track header has the same effect on the advertising tag. Page views reported by browsers that identify themselves as crawlers are counted only as a total and not recorded as visits, and a browser that declares itself automated sends no page-view report at all.
4. Recipients and sub-processors
We keep the supply chain deliberately small. These are the recipients of personal data, in full:
| Recipient | What they do | Where |
|---|---|---|
| Anthropic, PBC (Claude API) | Its Claude model reads the uploaded document and returns structured transaction data. Barred by its commercial terms from training on it; deletes inputs within 30 days, except a request its safety systems flag. | United States, under a data processing agreement and standard contractual clauses |
| Cloudflare, Inc. | Serves the website, terminates TLS, blocks automated abuse, runs the code that performs the conversion, routes email. | Global edge network; company established in the United States |
| Polar Software Inc. | Merchant of record: sells you credits and plans, takes payment, issues your invoice, handles VAT and sales tax. An independent controller for your billing data under its own privacy policy. | United States |
| Resend, Inc. | Outbound transactional email: sign-in codes, purchase receipts and replies to your support messages. Receives your email address and the content of the message we send you. | United States |
| Google Ireland Ltd and Google LLC (advertising measurement) | We advertise on Google Search in the United States and Canada. For visitors whose request reaches us from those two countries, Google's advertising tag loads on our pages, sets the cookie described in section 5, and tells Google that someone who clicked one of our advertisements later paid. It receives the page you are on and the fact of a purchase, never anything from a statement, your email address or your account. Not loaded at all for a visitor anywhere else, or for a browser sending Global Privacy Control or Do Not Track. | Ireland and the United States |
This is the complete list. We use no analytics provider, no session recording, no CRM and no data broker, and Google's advertising tag is the only third-party script on this site. We do not sell personal data and nobody pays us for it. If your browser sends Global Privacy Control, the advertising tag is never loaded, which is the opt-out signal California law asks us to honor. If this list changes, it changes here first and the "last updated" date moves; account holders are told by email before a new sub-processor starts work, as set out in the data processing agreement.
Every provider is named above. Email support@statementtable.com and we will send you a copy of the transfer safeguards we rely on. Anthropic publishes its own data retention and training commitments at privacy.claude.com and its security certifications at trust.anthropic.com.
We disclose personal data to a public authority only where the law of a jurisdiction that binds us requires it, and we tell the affected account holder unless we are legally barred from doing so.
5. Cookies and local storage
What is stored depends on where you are. There is no third-party analytics script on this site, no session recording and no cross-site tracker. There is one advertising cookie, and only for visitors whose request reaches us from the United States or Canada, because those are the two countries we advertise in. If your request reaches us from the EEA, the United Kingdom, Switzerland or anywhere else, the tag that would set it is never sent to your browser and no advertising cookie exists for you. That is why there is still no cookie banner here.
Three things can be stored in your browser. This is the complete list.
| Cookie | Set by | What it does | How long it lasts |
|---|---|---|---|
__Host-st_session | Us | Keeps you signed in. It is HttpOnly, Secure and SameSite=Lax, it carries a random value that means nothing outside our database, and it is set only if you create an account and sign in. Browse the site or use the free tier without signing in and it is never set. | 30 days, or until you sign out |
cf_chl_*, Cloudflare's challenge cookies | Cloudflare, on the converter and the sign-in page | We use Cloudflare Turnstile there to tell a person from a script. If it has to show you a challenge, Cloudflare stores a short-lived value so you are not asked again on the next page. Nothing in it identifies you to us, and we cannot read it. | About an hour, set only when a challenge appears |
_gcl_au, and any other value Google's tag stores | Google's advertising tag (gtag.js, conversion id AW-18456229770), loaded on every page for visitors in the United States and Canada only | We advertise on Google Search in those two countries, and this is how we find out whether an advertisement we paid for led to a sale. It is a first party cookie, set on our own domain, and it carries an identifier for the ad click that brought you here so that Google can match a purchase back to it. What the tag sends is the address of the page you are on and, at the end of a checkout, the fact that a purchase happened and what it was worth. It does not read what is on the page, and it holds nothing from your statement, your account or your payment. We use it for one thing: knowing which advertisements are worth paying for. We run no remarketing and no audience targeting. It is not sent to you at all outside the United States and Canada, or if your browser sends Global Privacy Control or Do Not Track. What the tag stores is Google's, we do not read it, and we put nothing of our own in it. | About 90 days |
The first two need no consent, because both are strictly necessary for the service you asked for within the meaning of Article 5(3) of the ePrivacy Directive and regulation 6(4) of PECR: the first delivers the sign-in you requested, and the second is how the free tier survives contact with automated traffic. Cloudflare classifies its challenge cookies the same way. Neither is used for advertising, neither builds a profile of you, and neither is shared with anyone.
The third is not set in the EEA or the United Kingdom at all. Article 5(3) of the ePrivacy Directive and regulation 6(4) of PECR require consent for a cookie that is not strictly necessary, and an advertising cookie is not. Rather than ask you to dismiss a banner, we do not send the tag: a request that reaches us from an EEA country, the United Kingdom or Switzerland is served the page without it, so there is nothing to consent to and nothing to refuse. Where it is sent, in the United States and Canada, our basis is the legitimate interest named in section 3, Article 6(1)(f): knowing whether an advertisement we paid for led to a sale. The weighing is short, and it is why we drew the line at those two countries. The cookie records an ad click, not a profile we build. It carries nothing from your statement, your account or your payment. A browser that asks not to be tracked, through Global Privacy Control or Do Not Track, never receives the tag wherever it is.
Nothing of ours is stored in your browser beyond the first two: no local storage, no session storage, and outside the United States and Canada no cookie at all on the pages you can use without an account. We do not fingerprint your device: our pages run no canvas, font, screen or hardware checks to tell one device from another. The converter draws the photos you choose on a canvas only to shrink them, in your browser, before they are sent. The one thing we derive from a request is the daily visitor key described in section 3, made from the IP address and the user-agent string that every request carries anyway, and its random ingredient is deleted when the report day ends.
The review workbook you download carries a random reference in its document properties. It is in the file, not in your browser, it identifies the workbook and not you, and you can remove it in your spreadsheet's document properties without affecting anything else.
6. International transfers
StatementTable is operated from Türkiye. Our providers process data in the United States and on a global edge network. Personal data is therefore transferred outside the UK, the EEA, Australia and Canada. Google, the advertising measurement recipient in section 4, processes in Ireland and the United States, and receives nothing from a visitor in the EEA or the United Kingdom, because its tag is never sent to one.
Where we transfer personal data out of the UK or the EEA to a provider in the United States, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum, or on the provider's certification under the EU-US Data Privacy Framework where it holds one. We carry out a transfer risk assessment for each provider and apply supplementary measures: encryption in transit for every hop, no statement contents in logs, and a contractual bar on training. You can request a copy of the safeguards that apply to a given transfer at support@statementtable.com.
- Customers in Australia: we are likely to disclose personal information to overseas recipients located in the United States and Türkiye.
- Customers in Canada: your information may be processed outside Canada, including in the United States, and while it is there it may be accessible to the courts, law enforcement and national security authorities of that country under that country's laws.
- Customers in Türkiye: transfers abroad are made on the basis of Article 9 of Law No. 6698 (KVKK), relying on appropriate safeguards or on your explicit consent, as applicable.
7. How long we keep things
This is the complete retention schedule.
| What | How long | Set by |
|---|---|---|
| Your uploaded statement and the transactions extracted from it | Not retained. Held in the memory of the request that converts it and gone when that request ends. Nothing survives an hour. | Us |
| The copy held by Anthropic, our AI provider | Deleted within 30 days, and never used for training | Anthropic, under its commercial terms with us |
| Salted IP hash and today's free-tier page count | 48 hours | Us |
| The random value that makes a report day's visitor keys (a report day is the 24 hours ending at 20:00 Istanbul time) | Deleted once its report day has ended: normally within the hour, and at the latest at the next daily cleanup. Our database provider's point-in-time recovery can still hold it for up to 30 days, until that backup window has passed. | Us |
| Usage records, visit statistics and error codes, including daily visitor keys, country, network number, device class, browser family and workbook references | Kept indefinitely. They hold no IP address, email address, file name or statement content. Once a day's random value is deleted, that day's visitor keys cannot be recomputed from an IP address or from anything else. For a day on which you signed in or bought, the limit described in section 3 applies. | Us |
| The Google click id recorded from an ad link, with the daily visitor key it is stored against | 90 days, then deleted | Us |
| Google's advertising cookie in your browser, for visitors in the United States and Canada | About 90 days. Clearing your browser's cookies for this site removes it, and a browser sending Global Privacy Control or Do Not Track never receives it. | |
| Order records from Polar's notifications: amounts, currency, billing country, plan, and keyed hashes of Polar's references | Kept indefinitely as revenue statistics. They hold no name, email address or postal address. | Us |
| Your email address, credit ledger and recent conversion history | Until you delete your account. Your email address goes, and the ledger entries are pseudonymized: the identifier on them is replaced with a short code that carries no name and no email address, and they are then kept only as accounting records. | You, at any time |
| Sign-in codes | 10 minutes, then deleted | Us |
| Purchase and invoice records | Kept for the period required by tax and accounting law | Polar, as merchant of record |
| Support and contact-form messages | 12 months, then deleted | Us |
| Operational request logs kept by the hosting platform: time, path, response status, error type and page counts, with nothing from inside a statement in them | Cloudflare's own retention period for platform logs. We neither extend it nor copy the logs anywhere else. | Cloudflare |
8. Your account
Accounts are optional. If you create one, we store your email address, your credit ledger and a short conversion history: counts and dates, never file contents. You sign in with a single-use six-digit code sent to your email; there is no password. You can delete your account yourself from your account page, or by emailing us. Deletion is immediate and permanent: your email address is removed, and the identifier on your ledger entries is replaced with a short code that carries no name and no email address, so the accounting record survives without you in it. Unused credits end with the account, so if a pack is still eligible for a refund, request it first.
9. Your rights
Depending on where you live, you have the right to ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent where we rely on it. Where we process on the basis of legitimate interests, you can object at any time and we will stop unless we have compelling grounds that override yours. You also have the right to be told the identity of the recipients of your personal data: ask, and we will name them.
Because we do not retain statement contents, there is usually nothing to delete from a conversion. Deletion requests concern your account, which you can delete yourself, immediately and permanently, from your account page; your support emails; and the purchase records held by Polar as merchant of record. We pass purchase-record requests on to Polar and tell you what happens.
Email support@statementtable.com. The person who operates the service is the privacy contact accountable for these requests, including under Canadian law. We reply within 30 days, usually within one business day, and we do not charge for these requests. We will never treat you differently for exercising a right.
Complain to us first if you want to. Email support@statementtable.com, or use the contact form and pick "Privacy, security or a data request". We acknowledge a complaint about how we handle personal data within 30 days of receiving it, usually the same day, then look into it and tell you what we find and what we do about it. You can also use the form to ask for a copy of your data, to correct it, or to have it deleted.
Complaints. You can complain to a supervisory authority, in the country where you live, where you work, or where the matter arose. That is the ICO in the United Kingdom, your national data protection authority in the EU and the EEA, the OAIC in Australia, the OPC in Canada, and the Kişisel Verileri Koruma Kurumu in Türkiye. You do not have to come to us first, though we would rather fix it.
10. Security
All traffic is encrypted in transit with TLS, both between you and us and between us and every provider above. Statement contents are never written to logs. Access to production infrastructure requires two-factor authentication. Secrets are held in the platform's encrypted secret store, never in source code. Sign-in uses a single-use emailed code, so there is no password database to lose. Card numbers never reach our systems.
The controls we operate, the path a file takes and the companies involved at each step are set out in full on the security page. The contractual form of the same controls is in the data processing agreement.
If a personal data breach occurs, we notify the supervisory authority within 72 hours where Article 33 requires it, and we notify affected account holders by email without undue delay.
11. Data processing agreement
If your firm needs a written processor agreement before it can upload client statements, our data processing agreement is on this site in full. It takes effect when you use the service, so you can file it and move on. It covers subject matter and duration, the categories of data and data subjects, confidentiality, security measures, sub-processors and change notification, transfers, assistance with data subject requests, breach notification, audit rights, and deletion at the end.
12. Children
The service is intended for adults and businesses. We do not knowingly process the data of children under 16.
13. Changes to this policy
We post changes on this page with a new "last updated" date. Material changes to what we collect or who receives it are announced by email to account holders before they take effect.
14. Related documents
Data Processing Agreement · Terms of Service · Refund Policy · Security and data flow