Privacy Policy — StatementSums
Effective date: November 12, 2026
This Privacy Policy explains how StatementSums ("we," "us," or "our") collects, uses, stores, and shares information when you use our website at statementsums.com and the related service that converts PDF bank statements into Excel or CSV files (the "Service").
If you do not agree with this policy, please do not use the Service.
1. Who we are
The Service is operated by Pengfei Zhang (individual), trading as StatementSums, contact support@statementsums.com, based in mainland China.
For privacy questions or requests, contact: support@statementsums.com.
Payments are processed by our third-party payment provider, which acts as the Merchant of Record for your order. That means the provider, not us, is the seller of record for paid subscriptions, collects payment, and handles applicable sales tax. The provider has its own privacy policy for the payment information you give them.
2. Information we collect
2.1 Account and contact information
To use the Service, you sign in with your email address. We send a one-time magic link to that address (via Resend). We do not use passwords.
We may also collect:
- basic account settings, such as your preferred export format
- your subscription status and conversion usage
We do not collect or store your full payment card number. Card and billing details are collected and processed by our payment provider.
2.2 Statement data (extracted text, not the original PDF)
The original PDF never leaves your device. When you select a statement, your browser extracts text and layout information locally using pdf.js. Only that extracted text (and related layout data needed to parse the statement) is sent to our servers.
We do not upload, receive, or store the original PDF file. We do not use object storage for PDFs.
The extracted text can still contain sensitive financial information (account numbers, balances, transaction details, names, and similar data). We treat it as confidential and process it only as described in this policy. We then generate Excel or CSV results and a reconciliation report on our servers.
2.3 Usage and technical information
When you use the website, we automatically collect limited technical data, such as:
- IP address, browser type, device type, and approximate general location derived from IP
- pages or features you use, timestamps, and error or diagnostic logs
- conversion counts and reconciliation results (for example, whether a conversion was "passed," "failed," or "unable to verify"), which we use to apply your free-trial and subscription allowances
We use only strictly necessary cookies to keep you signed in and secure your session. We do not use advertising or analytics cookies.
2.4 Information you choose to send us
If you email us or submit a support request, we collect the content of that message and any contact details you include.
3. How we use your information
We use the information above to:
- parse extracted statement text into Excel or CSV and run our built-in balance checks
- send magic-link sign-in emails and operate your account
- create and manage your free-trial allowance and subscription
- operate, secure, and debug the Service
- respond to support requests and communicate about the Service (for example, service notices or replies you have asked for)
- enforce our Terms of Service and protect against misuse
- comply with law, or with valid legal requests
We do not use your statement data to train third-party AI models. We do not sell your personal information, and we do not use the contents of your statements for advertising.
4. How we process your statement data (important)
- The PDF stays on your device. Text and layout are extracted in your browser with pdf.js. Only the extracted text is sent to our servers. We never receive the original PDF, and we do not store PDFs in object storage.
- Our infrastructure. Extracted text is parsed on infrastructure we configure: currently Vercel (application hosting and serverless functions) and Neon (Postgres database).
- Deterministic parsing, not third-party AI. We parse supported bank-statement layouts with our own template-based, deterministic software. We do not send your extracted text, layout data, or generated results to third-party AI or large-language-model providers.
- Default short retention. We delete conversion results automatically within 1 hour after conversion completes, whether or not you download the result. We may also keep limited technical logs (for example, that a conversion succeeded or failed, approximate size of the extracted text, bank template detected, and reconciliation status) that do not include the full statement contents.
- Data you opt in to share. Conversion results are still deleted within 1 hour. Data you opt in to share to help improve the service is kept for at most 90 days. We still do not receive or retain the original PDF. You can withdraw this consent by contacting us or, when available, by turning the setting off. Withdrawing consent does not affect processing already completed. We still will not send this data to third-party AI models.
- No use beyond the Service. We do not sell, rent, or otherwise share the contents of your statements with advertisers or data brokers.
5. Who we share information with (subprocessors)
We share information only as needed to run the Service. Our current subprocessors are:
| Subprocessor | Why |
|---|---|
| Vercel | Hosts the website and runs the conversion application. |
| Neon (Neon Postgres) | Stores account data, usage records, and — for a limited time — extracted text and conversion results as described in Section 4. |
| Resend | Sends magic-link sign-in emails and other transactional email we may send you (for example, service notices). |
| our third-party payment provider (Merchant of Record) | Checkout, payment, invoicing, sales tax, cancellations, and refunds. The provider receives the billing information you submit at checkout and related account identifiers (such as your email), and has its own privacy policy for that information. |
We may also share information with professional advisers or authorities if reasonably necessary to obtain legal or accounting advice, or to comply with law, a valid legal process, or to protect rights, safety, or security.
If we later add other processors, we will update this policy.
We do not sell personal information as that term is commonly understood, and we do not share personal information for cross-context behavioral advertising.
6. International transfers
You may use the Service from outside mainland China. Our operator is based in mainland China, and our subprocessors (Vercel, Neon, Resend, and our third-party payment provider (Merchant of Record)) may process data in the United States and other countries. Those countries may have data-protection laws that differ from the laws where you live.
If you are in the European Economic Area, the United Kingdom, or a similar jurisdiction, we rely on the data processing agreements of Vercel, Neon, and Resend (which incorporate the EU Standard Contractual Clauses, SCCs) as safeguards for international transfers. Payment data is processed by our third-party payment provider as Merchant of Record.
7. Retention
- Conversion results: deleted automatically within 1 hour after conversion completes (see Section 4).
- Original PDFs: we do not receive or retain them.
- Opt-in improvement data: data you opt in to share to help improve the service is kept for at most 90 days, then deleted.
- Usage records (conversion counts, quota, reconciliation status): kept while your account is active and deleted within 30 days after you delete your account.
- Feedback you send us: deleted within 90 days.
- Account and subscription records: kept for as long as your account is active, and for a reasonable period afterward as needed for billing records, refunds, dispute handling, tax, and legal compliance. Payment records held by our payment provider are retained under the provider's own policies.
- Support emails and logs: kept only as long as reasonably needed to resolve your request and operate the Service securely.
When we no longer need personal information, we delete it or irreversibly anonymize it, unless a longer period is required by law.
8. Security
We use reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS), access controls, keeping the original PDF on your device, and automatic deletion of extracted text and results as described above.
No internet transmission or storage system is completely secure. Extracted text still contains sensitive financial data while it is in transit and while we temporarily hold it. You should download and store your results in a place you control, then close the session.
9. Your rights (including GDPR and CCPA)
Depending on where you live, you may have some or all of the following rights:
- Access a copy of the personal information we hold about you
- Correct inaccurate personal information
- Delete personal information we hold about you, subject to legal exceptions (for example, we may retain billing records we are required to keep)
- Export (data portability) certain information you provided to us, in a commonly used format
- Withdraw consent where we rely on consent, including any choice to share data to help improve the service
- Object to or restrict certain processing, including objection to processing based on legitimate interests
- Appeal or complain to a data protection authority if you believe we have infringed your rights
If you are a resident of California or another U.S. state with a similar privacy law, you may also have the right to know what personal information we collect, use, and disclose; to request deletion or correction; to opt out of the sale or sharing of personal information (we do not sell or share it for advertising); and not to be discriminated against for exercising these rights. You may use an authorized agent to submit a request, subject to verification.
To exercise these rights, email support@statementsums.com. We may need to verify your identity before fulfilling a request. We will respond within the time required by applicable law.
Because we never receive the original PDF, and because extracted text and results are deleted automatically and quickly by default, we may no longer have the statement data when you contact us. We can still help with account, billing, and any retained records.
10. Children
The Service is intended for adults and for business or personal financial record-keeping by people who can form a legally binding contract. We do not knowingly collect personal information from children under 16 (or under 13 where that is the applicable standard). If you believe a child has provided us personal information, contact us and we will delete it.
11. Do Not Track
We do not track users across sites and do not sell or share personal data, so there is no tracking to opt out of via Do Not Track or Global Privacy Control.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and change the effective date. If a change is material, we will also provide a more prominent notice (for example, by email to the address on your account, or a notice in the Service) where required by law. Continued use of the Service after the updated policy takes effect means you accept the changes, except where the law requires a different standard.
13. Contact
Operator: Pengfei Zhang (individual), trading as StatementSums, contact support@statementsums.com Website: statementsums.com Privacy email: support@statementsums.com
For payment, invoice, tax, or card questions, you may also need to contact our payment provider, the Merchant of Record.
If you are in the EEA or UK, you may also lodge a complaint with your local supervisory authority. EU and UK users can contact us at support@statementsums.com.