Privacy and data handling
Bank statements are sensitive. Here is exactly what happens to yours, in plain words.
What we collect
- The PDF you upload, and the transactions we extract from it.
- If you subscribe: your email address and billing details, which are handled by our payment provider. We never see your card number.
- Cookie-free usage analytics (PostHog): pages viewed, which converter was used, whether a conversion succeeded and roughly how many rows it had. No cookies, no identifiers stored in your browser, no session recording, IP addresses discarded, and never the contents of a file.
- Signing in with Google is optional. If you use it, Google learns that you signed in on our site. The email link works without Google.
- A bot check (Cloudflare Turnstile) runs when you convert a statement. It sees your IP address, which is how it tells browsers from scripts.
How long we keep it
- Uploaded PDFs and converted files are deleted automatically 60 minutes after upload.
- Logs record that a conversion happened (time, page count, success or failure), never the transactions or the file itself.
- Subscribers can switch on a 30-day conversion history, and delete it at any time.
What we never do
- Ask for your online banking login.
- Sell, share or rent your data.
- Use your statements to train AI models.
Security
- All traffic uses TLS. Files are encrypted at rest until they're deleted.
- Processing happens on servers we control; files aren't sent to third-party document services.
- The file converters (CSV, Excel, QBO, QFX, OFX, QIF, IIF) run entirely in your browser. Those files are never uploaded at all.
Your rights
- Under GDPR, UK GDPR, CCPA, PIPEDA and the Australian Privacy Act you can ask what we hold, correct it, or have it deleted. Write to privacy@unclip.online and we'll reply within 5 working days.
Last updated October 2026.