Privacy Policy
Last updated 2026-10-29
Bank statements are some of the most sensitive documents people have. This policy explains, in plain English, what StatementCheap collects, what it doesn't, who helps us run the service, and the choices you have.
Who we are
StatementCheap is operated by Creative Current LLC, a New Mexico limited liability company in the United States. For data protection law, we are the "controller" of the personal data described here. You can reach us through the contact form.
The short version
- Your statement files are processed in memory and not stored by StatementCheap. The converted rows are sent back to your browser and not kept on our servers.
- We keep only metadata about each conversion: the page count, the date and whether it reconciled. We use it for billing and to prevent abuse.
- Statements are read by AI models running on Cloudflare Workers AI, on the same Cloudflare network that hosts the site. Under Cloudflare's Workers AI data-usage commitments, inputs and outputs are not retained after the response is delivered, and your content is not used to train AI models. No third-party AI company, such as OpenAI or Google, sees your files.
- We don't run ads, we don't use analytics or advertising trackers, and we don't sell your data.
What we collect and why
Statement files you upload
When you convert a statement, your PDF is sent to our servers over an encrypted (HTTPS) connection, and processed in memory. The transactions are extracted by open AI models that Cloudflare hosts on Workers AI, on the same network that runs the site. The result comes back to your browser. StatementCheap does not save the file or the converted rows. Once your download is ready, we have no copy we could show you or anyone else.
Statements contain personal data, such as names, partial account numbers and transaction details, and sometimes data about other people. We use it only to perform the conversion you asked for.
Conversion metadata
For each conversion we record the number of pages, the date, and whether the result reconciled with the statement's balances. This is linked to your account, or to your device cookie if you aren't signed in. We use it to count your pages, keep billing records, enforce the free daily allowance and detect abuse.
Account information
If you create an account, we keep your email address. We use it to send you one-time login codes, receipts and important notices about your account or these policies.
Purchase records
When you buy a pack or a plan, Stripe handles the payment. We never see or store your full card number. We keep a record of what you bought, when, the amount, and the payment references Stripe gives us, so we can manage your plan, issue refunds and keep accounting and tax records.
Messages you send us
If you use the contact form, we receive what you write and the email address you give, and use them to reply and help you.
Technical data
Like any website, our hosting provider, Cloudflare, processes your IP address and basic request details in order to deliver pages and protect the site from attacks.
Cookies
We use two cookies, and both are needed for the site to work:
- Session cookie: keeps you signed in after you enter a login code.
- Device cookie: counts the free pages used on your device so we can offer 5 free pages per day without requiring sign-up.
We don't use advertising, analytics or social media cookies. When you pay, Stripe's checkout may set its own cookies, which are covered by Stripe's privacy policy.
Who processes data for us
We use a small number of service providers. They process data on our behalf to run StatementCheap.
| Provider | What they do | What they receive |
|---|---|---|
| Stripe | Payments, subscriptions and the billing portal | Your payment details, email address and purchase information |
| Resend | Sending login codes and receipts by email | Your email address and the content of those emails |
| Cloudflare | Hosting, network delivery and AI extraction (Workers AI) | All traffic to the site, including IP addresses and the statements you upload. Per Cloudflare's Workers AI data-usage commitments, statement content is not retained after the extraction response is delivered and is not used to train models. |
We may also disclose information if the law requires it, to protect our rights or users from fraud or abuse, or to a buyer if the business is sold, in which case this policy continues to apply to your data.
What we don't do
- We don't sell your personal information, and we don't share it for cross-context behavioral advertising.
- We don't show ads or use third-party tracking.
- We don't use your statements to train AI models.
- We don't connect to your bank or ask for your banking login.
Legal bases (EEA and UK users)
Where the GDPR or UK GDPR applies, we rely on:
- Contract: to convert your statements, run your account and process your purchases.
- Legitimate interests: to keep the service secure, enforce the free allowance and prevent fraud and abuse.
- Legal obligation: to keep purchase records for tax and accounting.
How long we keep data
- Statement files and converted rows: not stored by StatementCheap. Cloudflare Workers AI does not retain inference inputs or outputs after the response is delivered.
- Conversion metadata: kept for as long as we need it for billing records and abuse prevention.
- Account email: kept for as long as your account exists.
- Purchase records: kept for as long as your account exists and for as long as tax and accounting law requires, which can be longer.
- Messages to us: kept for as long as needed to handle your request.
Security
All traffic to StatementCheap is encrypted in transit with HTTPS. The most important protection is that we don't keep your statements at all: a file that isn't stored can't leak from our servers later. No system is perfectly secure, so we also keep the data we do hold to a minimum.
International transfers
We are based in the United States, and our providers process data in the US and other countries where they operate. If you use StatementCheap from outside the US, your data will be processed there. Where the law requires it, we rely on the transfer safeguards our providers offer, such as standard contractual clauses.
Your rights
Everyone
You can ask us what personal data we hold about you, ask us to correct it, or ask us to delete your account and its data. Send your request through the contact form using the email address on your account, so we can confirm it's you.
EEA and UK (GDPR)
You have the right to access, correct and delete your personal data, to restrict or object to our processing, and to data portability. You also have the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office). We will respond within one month.
California (CCPA)
California residents have the right to know what personal information we collect and how we use it, to access it, to correct it, and to have it deleted. You also have the right to opt out of the sale or sharing of personal information, but we don't sell or share it. We won't treat you differently for using any of these rights. We will respond within 45 days.
What we can and can't provide
Because we don't store your statement files or converted rows, we can't return or delete them; they are already gone. When we delete an account, we remove the email address and conversion metadata, except purchase records we must keep for tax and accounting.
Children
StatementCheap is not meant for children. We don't knowingly collect personal data from anyone under 16 (under 13 in the US). If you believe a child has given us personal data, tell us through the contact form and we will delete it.
Changes to this policy
If we change how we handle data, we will update this page and the date at the top. If a change is significant, we will also tell account holders by email before it takes effect.
Contact
Questions or requests about privacy? Use the contact form.