Privacy policy
Your statements are read in your browser first. Only a statement your browser cannot read reaches our server, and we never sell or share your data.
Last updated: 20 October 2026.
In short
- Most statements are converted entirely in your browser: nothing from the file is sent to us.
- A statement your browser cannot read (for example a scan or a photo) is read on our server and deleted after reading.
- If even our server cannot read a statement, we keep it encrypted for up to 14 days so we can add support for that bank, then delete it.
- Our statistics are anonymous and cookie-free. We have no advertising and no third-party tracking.
- You can ask us for your data or its deletion at any time.
1. Who we are
StatementEasy is operated by Morocode LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States (“we”, “us”). We are responsible for the personal data described here. Contact: [email protected].
2. Your bank statements
2.1 Read in your browser
When you choose a file, the converter (software that your browser downloaded with the page) opens it and reads the transactions on your device. For most statements that is all that happens: the file and its contents are not sent to us. The Excel, CSV or other file you download is also created in your browser. The password of a protected PDF is used in your browser and is only sent with the file when our server has to read it.
2.2 Read on our server
A statement is sent to our server in three cases: when your browser could not read it or its balances do not add up (the converter then reads it again on our server — you see this on the screen), when you choose to read a scan or photo on our server, and when you use our API. On the server, the file is placed in a private folder, read, and deleted as soon as it has been read. The recognised text is kept encrypted until your browser collects it — usually within seconds — and deleted then, or after 30 minutes at the latest. We keep a record of each job without any content: time, file type and size, number of pages, how long it took, and a daily-changing hash of your IP address to limit abuse.
2.3 Statements we cannot read yet
When a statement still cannot be read after our server tried, we keep it so we can teach the converter its layout and support your bank. We keep two things:
- the original file, encrypted with AES-256 using a key that only our server holds, so a copy of the files or of the database alone cannot be read;
- an anonymous copy of its layout: where each piece of text sits on the page, the dates, the amounts and the column titles, with names, addresses, descriptions and account or card numbers replaced by placeholders.
Only the StatementEasy team can open them, only for this purpose, and every access to an original file is logged. Both are deleted as soon as that bank works, and after 14 days at most. The file of a statement that converts correctly is never kept (when you are signed in with history on, only its result is saved — see “Saved conversions” below). To have a statement deleted sooner, write to us with the file name and the day you converted it.
3. Accounts and the API
You can use StatementEasy without an account. If you create one, we keep your name, your email address, your password (only as a secure hash), whether your email is verified, when you last signed in, your plan, and the payee and category rules you save. API keys are stored only as a hash. For each API request we log the time, the result, the output format, the size, the number of pages and rows, the duration and the bank detected — never the content of the statement. You can delete your account at any time from your account page; this deletes your data, keys and rules.
Saved conversions
When you are signed in and your history is on, each statement you convert is saved to your account as its result: the table of transactions with your edits, the bank, the period and the totals. It is stored encrypted with a key only our server holds. The statement file itself is never saved with your account. Each saved conversion is deleted automatically on its own date — 24 hours, 7 days (the default), 30 days, or when you delete it, as you choose in your settings — and you can delete one or all of them at any time. You can turn history off in your settings; then nothing is saved. On the Privacy & data page you can download everything we hold about your account.
Signing in with Google
If you choose “Continue with Google”, Google confirms who you are and sends us your name, your email address and your Google account ID — nothing else: no contacts, files or other Google data. We use them only to sign you in and keep them with your account. If an account with the same email already exists, it is linked to your Google account. You can also set a password and sign in without Google.
4. Anonymous usage statistics
To understand how the site is used and which banks work, the site records anonymous events, for example “a 3-page statement was converted, the balances matched, Excel was downloaded”, together with the bank's name when it is recognised. We also record the page visited, the referring site, campaign tags (utm), your country (from your IP address, which is not stored), your device type, browser, operating system and language. Visitors are counted with a hash of your IP address and browser that changes every day, without cookies, so nobody can be followed from one day to the next. These events contain no names, account numbers, amounts, descriptions or file names. They are kept for 13 months.
5. Feedback and messages
When you answer “Was this conversion right?”, we keep your answer, the reader used, the number of rows and your comment, if you write one. When you write to us through the contact form, we keep your message and the email address you give, to answer you. If you choose to attach a statement, it is stored privately and deleted automatically after 30 days.
6. Cookies and browser storage
We only use the cookies the site needs to work: a session cookie and a security (CSRF) cookie, and a sign-in cookie if you use an account. We use no advertising or tracking cookies. Some preferences are saved only in your own browser (its local storage), such as light or dark mode, column fixes you made, your rules and your last settings. They never leave your device unless you are signed in, in which case your rules are saved to your account so they work on all your devices.
7. Who else is involved
We do not sell your data and we do not share it with advertisers. We use these service providers, only to run the site:
- Contabo GmbH — hosts our servers, located in the European Union (France).
- Cloudflare, Inc. — delivers and protects the site (network, DNS, protection against attacks); it processes connection data such as IP addresses.
- Google LLC — only if you choose “Continue with Google”: confirms your identity and shares your name, email address and Google account ID with us.
- jsDelivr — when you read a scan on your own device, your browser downloads the open-source text-recognition engine from this content network, which sees your IP address. No file is sent.
Emails are sent from our own mail server. We may disclose data if the law requires it.
8. Legal bases
Where the GDPR or similar laws apply: we process your statements to provide the conversion you ask for (performance of the service); we keep statements we cannot read, record anonymous statistics and protect the service against abuse on the basis of our legitimate interests in improving support for banks and keeping the service safe; we keep account data to provide your account; and we keep records when the law requires it.
9. International transfers
Our servers are in the European Union. Morocode LLC is a US company and our team may access data from outside the EU; Cloudflare operates worldwide. Where data leaves the EU, we rely on the safeguards these providers offer, such as the European Commission's standard contractual clauses.
10. How long we keep data
| Data | Kept for |
|---|---|
| Statements read in your browser | Never sent to us |
| Statements read on our server | Deleted after reading; recognised text at most 30 minutes |
| Statements we cannot read yet (encrypted) and their anonymous layout copy | Until that bank is supported, 14 days at most |
| Statements attached to a message | 30 days |
| Anonymous usage statistics | 13 months |
| Account, rules and API request log | Until you delete your account |
| Saved conversions (signed in, history on), encrypted | The delay you choose: 24 hours, 7 days (default), 30 days, or until you delete them |
| Messages you send us | As long as needed to answer, then deleted |
11. Your rights
Depending on where you live, you can ask to access, correct or delete your personal data, to receive it in a portable format, to restrict or object to its processing, and to withdraw any consent you gave. Write to [email protected]; we answer within 30 days. You can also complain to your data protection authority — for example the CNIL in France, the CNDP in Morocco or the ICO in the United Kingdom.
12. Security
The site is served only over encrypted connections (HTTPS with HSTS) and with a strict Content Security Policy. Statements kept on our server and text recognised on our server are encrypted at rest, folders holding them are private, access is limited to the StatementEasy team, and access to original files is logged. No system is perfectly secure, but we keep as little as possible for as short a time as possible. See also our security page.
13. Children
StatementEasy is not directed at children under 16, and we do not knowingly collect their data.
14. Changes
We will update this policy when the service changes, and change the date at the top. Important changes will be announced on the site.
15. Contact
Morocode LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States — [email protected].