Privacy policy

The privacy of your data, and it is your data, not ours, matters here. This policy says what we collect and why, when we share it, and what you can ask us to do with it. We do not sell your personal information. We never have, and the product is not built to.

This policy covers people who visit the site, try the free pages, buy a pack, or email support. Contact is email only: support@statementsquared.com. We do not publish a street address.

What we collect and why

We collect only what the product needs.

The statement. A PDF you upload is read in memory for that request and then discarded. We do not store the file. We do not store the transactions. The CSV and QBO files are built in your browser. A scan with no text layer is rejected. The limit is 8 MB and 40 pages.

The account. The free 5 pages do not need an email. Stripe Checkout collects an email when you buy. We store that email as the account, along with the page balance. Sign-in is a magic link to that email. If you set a password, we store a hash of it, not the password.

The payment. The card number goes to Stripe. It does not pass through our database. We keep the Checkout Session id so the same purchase cannot add pages twice.

This browser. A cookie named ssq_free_used counts free pages used here. It can last up to 400 days. After you sign in, a session cookie keeps you signed in. It is HTTP-only and lasts about a week unless you sign out.

The network address. Cloudflare passes us the visitor IP address. We store it on the sign-in session while that session exists, and we keep a short-lived database row that uses it to limit repeated sign-in attempts.

Mail you send us. If you email support, we keep that correspondence so we can answer you and remember a refund or a deletion you asked for.

A model, only when the built-in parser cannot read the layout

The usual conversion is a parser in our code. It does not send the statement anywhere else. When that parser finds the transactions and the running balance ties, or it finds them and the statement has no balance to check, the text stays here. If an OpenRouter key is set and the parser finds no transactions, the balance does not tie, or it does not recognize the layout, the extracted text can be sent to OpenRouter to map that layout into rows. The text is capped at 80,000 characters. We use the reply for that request and we do not store it. We do not use your statement to train a model of our own. We don’t have one. Only providers that do not collect or retain prompts are used. If none is available, the request stops and the built-in rows are what you get. The balance check still runs in our code, not in the model. With no OpenRouter key, nothing is sent.

Who else handles data

• Stripe processes the payment and collects the checkout email.
• Neon Postgres stores the account, the session, and the page balance.
• Cloudflare hosts the site and runs the conversion.
• OpenRouter receives extracted statement text only when an API key is configured and the built-in parser cannot read the layout, and only through providers that do not collect or retain prompts.

Those companies have their own privacy policies. We don’t run ads, and we don’t pass your email to an ad network. We don’t use a separate analytics product.

No one on our side reads a statement in order to convert it, because we do not keep the file. If you email a statement to support, that is different: it is in the email, and we will use it only to answer you.

Your rights

We offer the same requests to everyone, whether or not a local law already requires them. Email support@statementsquared.com from the address on the account, or tell us that address if you never created one. We may need to confirm it is you before we act.

• Know and access. You can ask what personal information we have about you. This policy is the list. You can also ask for a copy of the account email and the page balance.
• Correct. You can ask us to fix the email on the account if it is wrong.
• Delete. You can ask us to delete the account. There is no delete button in the product. Email us and we will delete the account, the sessions, and the page balance from our database. The PDF was never stored. Stripe keeps its own record of the payment. We may keep the Checkout Session id so that same purchase cannot be credited again.
• Export. You can ask for the email and the page balance in a plain file. The statement rows are already on your screen. Download them before you close the page. We do not have a copy to send later.
• Object or restrict. You can ask us to stop a use that is not required to run the conversion or keep the account. We do not sell personal information, so there is no sale to opt out of.
• No penalty. We will not charge you more or refuse support because you asked for any of this. Deleting the account does mean you can’t sign in to those pages afterward.
• Complain. You can complain to a data-protection authority where you live. If you are in the EU or the UK, that is your local authority. We would rather hear from you first.

We do not make decisions that have a legal effect on you by running an automated score. Spending pages is arithmetic: one page of the PDF spends one page of the pack, and only after a transaction is found.

How long we keep it

Pages never expire, so the balance stays until you ask us to delete the account or we close it for a breach of the terms. The sign-in session, including the IP address stored on it, ends when the session ends. The sign-in limit row lasts only for that limit, an hour at most, and is then removed. The free-page cookie can last up to 400 days in that browser. Support email is kept so we can honor a refund or a deletion we already promised.

Security

The site is served over HTTPS. Passwords are stored as hashes. No method of sending or storing data is perfectly secure, and we do not promise that it is. The companies above protect data under their own practices.

Where the data is processed

Cloudflare, Neon, and Stripe process data for us, and they may do that outside the country you are in. We do not publish a single office or a single region for that processing. If you use the service from the EU or the UK, you can still email us to use the rights above. We do not offer a separate data-processing addendum.

Changes and questions

When this policy changes in a way that matters, we will refresh the date at the top. Questions about your data go to support@statementsquared.com.