Statements AI

Privacy Policy

<!-- Canonical source for build-time rendering. -->

Effective Date: September 30, 2026

1. Data Storage & Privacy

Selected PDFs are encrypted in the browser's local queue before sign-in. When you process a statement while signed in, a copy is staged in private Supabase Storage under your account prefix and retained until you delete that statement (or clear your cloud audit data). During extraction, a temporary copy may also be sent to Google Gemini (AI Studio File API and/or Vertex AI). Temporary provider copies are deleted after the job finishes or fails when those cleanup APIs succeed; deletion may not be instantaneous if a provider or cleanup request is unavailable.

For signed-in users, extracted transactions are stored in our Postgres database (Supabase) with row-level security so only you can access your rows. Signing out does not delete your cloud statements or transactions. Anonymous / pre-sign-in history may still live only in this browser's IndexedDB and can be cleared by signing out of a local session, clearing site data, or importing that history into your account once.

2. AI Processing & Categorization

To extract and suggest categories, statements are transferred through authenticated HTTPS requests for temporary processing with our API/worker and Google Gemini (AI Studio File API and/or Vertex AI). Gemini returns transaction fields for human review. Temporary provider file copies are cleaned up after success or failure when possible. Staged statement PDFs in private Supabase Storage are kept until you delete them. Temporary job status and extracted-result caches in Redis expire after 1 hour.

3. Information We Collect

  • Account Info: Email address and name provided during sign-up.
  • Transaction Data: Extracted transaction details and AI-generated categories required to display your dashboard.
  • Usage Metrics: Number of pages processed to manage tier limits.
  • Analytics: Anonymous technical data collected via Vercel Analytics and Sentry.

4. Data Security

We use industry-standard SSL/TLS encryption for all data transport. Access to account metadata is restricted and protected via Supabase Auth.