1. Draft scope
This draft covers visitors, guest sessions, signed-in users, and organizations. Whether the final operator acts as a controller or processor cannot be stated conclusively until the legal entity, customer terms, and production providers are selected.
2. Data currently handled
- Email address and optional display name. For password authentication, an Argon2id password hash is stored; the raw password is never stored.
- Contact-form name, email address, subject, message, and selected interface language when a visitor submits the form. The form does not accept attachments.
- When Google sign-in is enabled and used, the verified Google email, Google subject identifier, and available profile display name. Google sign-in is optional and depends on operator configuration.
- Email-verification, magic-link, and password-reset records contain only a keyed HMAC-SHA256 hash of the one-time token, together with its purpose, associated user or email address, expiration time, and time of use. The plaintext token is not stored.
- A necessary signed-in session cookie; the registration acceptance timestamp and accepted Terms and Privacy versions; and organization membership and role.
- A necessary guest-session cookie and server-side guest session record associate guest conversions, enforce one free full conversion in each 24-hour session, and store the session expiry and selected conversion identifier.
- Client upload link and invitation records, expiration and usage limits, and hashed link tokens; each plaintext link is returned only when it is created.
- Uploaded PDFs, extracted text and normalized transaction rows, confidence and evidence data, masked account identifiers, statement metadata, and generated exports.
- Credit ledger entries, payment status, internal and provider payment identifiers, and limited provider metadata. WayForPay may return a masked card identifier; NOWPayments may handle wallet, network, and blockchain transaction data.
- Payment accounting entries containing gross amount, currency, payment and provider references, product, beneficiary identifier, sale or reversal type, and time. Payment-confirmation delivery records include the recipient email, locale, status, attempts, and timestamps.
- Operational data such as IP address, browser information, non-sensitive internal record identifiers, status changes, timing, and error categories. Self-hosted monitoring records route templates, methods, response status, latency, and host or container resource usage without request bodies or query strings.
- If optional analytics consent is granted, Google Analytics receives the public page path and title, permitted campaign parameters, referrer, and browser, device, network, and approximate-location data generated by the visit. Private account and conversion pages and application user identifiers are not sent.
3. Current uses
- Authenticate users by password, configured Google sign-in, or email link, and maintain signed-in or guest sessions.
- Validate PDFs, extract and review rows, create exports, and provide organization features.
- Reserve page credits at upload, deduct them after successful extraction, return them after failed or empty extraction, and add page credits after verified purchases; verify WayForPay and NOWPayments provider notifications when those payment methods are used.
- Protect and operate the service using redacted technical logs and error categories.
- Prevent contact-form abuse using rate limits, a hidden bot field, and limited content signals. Rejected submissions are not delivered to support and their text is not logged by the application.
- Send email-verification, magic-link, password-reset, and organization-invitation emails through the configured transactional email service.
- Send a service payment confirmation after verified success and create period exports and monthly payment-accounting archives for operator bookkeeping.
- Deliver contact-form submissions to the configured support inbox and private Telegram notification chat.
- Measure public-page traffic and campaign performance with Google Analytics only after optional consent.
4. Statement processing
Text from digital PDFs is extracted locally. Scanned pages use local Tesseract OCR. No external OCR, AI, or language-model provider receives statement documents in the current implementation.
Application logs must not contain raw statement text, transaction descriptions, account numbers, full customer filenames, document paths, or signed URLs. Account identifiers editable in the product must be masked with no more than four visible characters.
6. Current retention
- Guest originals, exports, extracted statement data, and normalized rows: scheduled for purge after the 24-hour guest session expires.
- Signed-in and organization original PDFs: scheduled for deletion after 7 days.
- Generated exports: scheduled for deletion after 7 days.
- Expired guest conversions, originals, and exports: cleanup runs hourly.
- Signed-in and organization normalized rows: retained until the conversion is deleted.
- After guest cleanup or explicit conversion deletion, a minimal operational record remains with deleted status, owner or session association, file and page counts, processing metadata, and timestamps. It contains no statement content, customer filename, or checksum.
- Contact submissions are not stored in the application database. Copies remain in the configured support mailbox and Telegram chat under provider and operator retention settings that must be finalized before public launch.
- Payment records, confirmation-delivery records, accounting entries, and monthly payment-register archives: retained separately for business and statutory recordkeeping; the final period and deletion policy must be approved before paid public launch.
8. Access and deletion
Users can delete individual conversions. Procedures for other privacy requests and account deletion, the responsible operator, and the privacy contact must be finalized before public launch. Rights vary by the governing law and user location.
9. Access controls
Access to conversions, exports, organizations, and source pages is authorized based on the guest session, user account, or organization role. Download access uses backend checks or short-lived links. No statement-processing system can be described as risk-free.
10. Locations and transfers
Production hosting regions, provider locations, and any international-transfer mechanism are not finalized. The final policy must identify them and describe any legally required safeguards.
11. Finalization and changes
This draft must be updated when the operator, contacts, providers, jurisdiction, refund procedure, subscription terms, or product behavior are finalized. Counsel review is required before paid public launch.