Statement files
Files are uploaded to the application server for conversion. The service stores an encrypted private review copy of every accepted upload, including unsuccessful conversions, for 90 days. Copies contain the source document, original filename, account association when signed in, conversion settings, complete extracted transactions, generated output, validation report, engine version, provider/model details when available and error code. Financial documents may include personal and third-party information. Upload only documents you are authorized to share for this processing.
Why documents are retained
Review copies help investigate failed conversions, correct extraction rules and evaluate future engine versions against representative examples. They are not automatically treated as correct training data or sent to a model-training service. Access is restricted to authorized operators; the application provides no public document viewing endpoint.
The upload form displays this storage notice before conversion. Storage is part of this service, not an optional setting hidden behind cloud extraction. If you cannot authorize retention, do not upload the document. The operator must establish the applicable basis and provider arrangements before opening this rebuilt service to customers.
Temporary downloads and review copies
Temporary processing inputs are removed after processing. Download copies expire after 15 minutes or first download. These limits do not delete the separate review archive. Its retention expiry is 90 days from upload; expired records are removed by the cleanup job, which must run daily. Database backups do not contain documents; private archive backups are separate and must have a maximum 30-day rolling lifetime. Deletion removes the live copy; restricted backup copies expire under that backup policy.
Optional Mistral processing
When a paid user explicitly allows cloud extraction and the local reader cannot handle a PDF, page groups are sent to Mistral. This option is disabled when credentials and spending controls are not configured. Provider terms and retention practices are separate from application file expiry.
Account and operational records
We retain account email, password hash, sessions, quotas, subscription references and minimal conversion records to run the service, show history, investigate failures and enforce limits. Conversion records use generic filenames and contain no statement contents or transaction descriptions. Browser previews display extracted transaction data during your session; they are not saved to local storage by the converter.
Payments
Stripe receives the information needed to manage checkout and subscriptions. The application stores payment and subscription identifiers, status, plan and allowance information. It does not store complete card details.
Cookies and analytics
An HttpOnly session cookie is used for sign-in. The rebuilt public pages do not load Google Analytics or send browsing events to a marketing analytics service. Optional operator integrations are disabled by default and must be disclosed before enabling them. Server access infrastructure may record request metadata.
Your requests and retention
You can request access, correction or deletion of retained account data through the operator’s configured support address. The conversion response includes a document receipt and a deletion token, also available when a conversion fails after storage. Save the receipt privately. Use the “Delete stored review copy” button or contact support with the receipt ID. Deletion tokens grant deletion access; do not publish them. A signed-in owner can also request deletion through the authenticated API. Retention periods for account, billing and operational records must be documented by the operator before launch, taking applicable obligations into account. This local preview has no recovered historical customer database.