Privacy Policy

How mybankstatementanalysis collects, uses, and protects your personal and financial data.

Last updated: October 13, 2026

Our privacy commitment in plain English

  • We never keep your uploaded PDF or image files — they are deleted as soon as your analysis is done.
  • We never sell, share, or monetize your financial data — our only revenue is subscriptions.
  • We never store your raw IP address — only a one-way SHA-256 hash for rate limiting.
  • Anonymous analyses are automatically deleted after 7 days. Free account data after 30 days.
  • You can delete your data at any time — instantly, no questions asked.
  • PostHog measures product usage and conversion. Input values are masked, and replay is disabled on sensitive app pages.

1. Introduction

mybankstatementanalysis ("we", "our", "us") operates the mybankstatementanalysis.com website and bank statement analysis service. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service.

2. What We Collect

Account information (if you sign up): Your email address and name. Payment information is collected and processed entirely by Polar — we never see or store your card number, CVC, or billing details.

Bank statement data: When you upload a PDF, we extract transaction data (dates, descriptions, amounts) to generate your analysis. The uploaded file itself is deleted right after analysis — we don't keep it. Only the structured, categorized transaction data is saved to our database so you can view your results.

IP address: We hash your IP address using SHA-256 with a private salt for rate limiting purposes. The raw IP address is never stored in our database — only the irreversible hash.

Usage data: We use PostHog to understand traffic, product usage, conversion, and reliability. We do not send bank-statement contents, transaction descriptions, amounts, feedback text, or payment-card details to PostHog. Input values are masked in session replay, and replay is disabled on results, dashboard, settings, and claim pages.

3. How We Use Your Data

  • To generate your spending analysis, categorization, and visualizations
  • To manage your subscription and process payments (via Polar)
  • To enforce fair usage limits
  • To send essential service communications (e.g., billing confirmations)
  • If you have an account, to send occasional reminders, follow-ups and offers about your own reports and plan (for example, a free report that is about to be deleted, or pages left unused on your plan)
  • If you enter your email on a report without an account (“Email me this report”), to send you the link to that report, keep it for 30 days instead of 7, and send a few reminders and offers about that report (for example, before it is deleted). The address is stored with that report and deleted with it.

Every reminder and offer email has a one-click unsubscribe link, and the same switch is in Settings. Sign-in links, receipts and billing notices still arrive after you unsubscribe.

We do not use your financial data for advertising, profiling, credit scoring, or any purpose other than providing you with your analysis results.

4. Third-Party Services

We use the following third-party services. Your data is sent to them only as needed to operate the service:

  • Google Gemini AI — Transaction descriptions are sent to the Gemini API for categorization; for scanned or photographed statements, the page images are sent so Gemini can read them. Google processes this data under their API Terms of Service, which state that API data is not used to train their models.
  • Polar — Billing provider for subscriptions and one-time purchases. We never handle your card details directly. See Polar's Privacy Policy.
  • Cloudflare — Application hosting (Workers), database (D1) and temporary file staging (R2). Transaction and account data is stored in a Cloudflare D1 database in Western Europe, encrypted in transit (TLS) and at rest. See Cloudflare's Privacy Policy.
  • PostHog — Product and web analytics, attribution, funnel measurement, and privacy-protected session replay. Input values are masked and replay is disabled on sensitive app pages.

We do not use any advertising networks, social media trackers, or data brokers.

For the current operational list, see our subprocessors page and trust center.

5. Data Security

We take reasonable measures to protect your data:

  • All data is encrypted in transit using TLS (HTTPS)
  • Uploaded files are deleted right after analysis and never kept
  • IP addresses are stored as irreversible SHA-256 hashes — the original IP cannot be recovered
  • Passwords are hashed using bcrypt before storage
  • Payment data is handled by Polar through PCI-compliant checkout flows

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security — but we do our best and are transparent about our practices.

6. Data Retention & Automatic Deletion

Uploaded files: Your PDF or image file is not kept. Small files are processed in server memory. Larger uploads are staged in encrypted Cloudflare R2 storage (Western Europe) only while they are processed, deleted right after, and removed automatically after one day if a request fails.

Transaction data retention:

  • Anonymous users (no account): Analysis results are automatically deleted after 7 days.
  • Free plan accounts: Analysis results are automatically deleted after 30 days, unless the report was unlocked through a one-time payment, in which case it is kept for 1 year.
  • Paid plans: Analysis results are retained until you delete them or close your account. You can set a custom auto-delete timer (24 hours, 7 days, 30 days) on any individual analysis.

Automatic deletion is enforced by a daily cleanup process that permanently removes expired data from our database. This is not a soft delete — the data is gone.

Usage-limit data: IP hashes and usage counters are retained as needed to enforce the one-time free upload allowance. Paid-plan page usage is stored by billing cycle, while free mini-tool usage is stored in daily buckets.

7. Your Rights

You have the right to:

  • Delete your data — delete any individual analysis from your dashboard, or request full account deletion
  • Export your data — download your transaction data in CSV, Excel, QIF, OFX, QBO, or IIF format
  • Access your data — view all data we hold about you from your dashboard
  • Set retention — choose how long we keep each analysis (24 hours to forever)

To exercise any of these rights, use your dashboard or contact us at the email below. We respond to all requests within 48 hours.

8. Cookies

We use only essential cookies:

  • Session cookie — keeps you logged in (httpOnly, secure)
  • Usage cookie — tracks free usage for anonymous users (httpOnly)

PostHog may use cookies or similar identifiers to connect visits and product events into sessions and conversion funnels. We honor browser Do Not Track settings.

We do not use advertising cookies, social media pixels, or ad-network trackers.

9. Children's Privacy

Our service is not intended for individuals under the age of 18. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on our website. Your continued use of the service after changes constitutes acceptance.

11. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:

Email: contact@mybankstatementanalysis.com

Operator: DPmedia, Poland (EU)