Privacy policy

Who we are

This bank statement converter (statements.tanod.dev) is part of Tanod ("we", "us"). Tanod's privacy policy at https://tanod.dev/privacy/ covers tanod.dev and its subdomains. This page adds what applies to the converter and the statements you upload; where the two differ for the converter (its one cookie, its log retention, no analytics), this page applies. For anything about your data, email [email protected].

When you upload a statement, you decide what is in it and why it is converted, and we process it only to provide the conversion you asked for. If you are a business converting statements of your clients, we act as your processor; email us if you need a data processing agreement.

What we collect and why

The files you upload

Bank statements contain personal and financial data. We use your file only to convert it. The PDF is written to a private temporary folder for the conversion and removed as soon as it finishes, normally within seconds. The results (the Excel and CSV files and a summary with the transactions of the first page for the preview) are stored on our server for 1 hour so you can download them, and are then deleted automatically. We do not copy file contents into logs.

Payment and purchase data

When you pay, Polar collects your payment details, email address and billing country on its own checkout page, under its own privacy policy. Polar tells us the order, the product, and your email address. We keep the email address with a credit pack so we can send you your code and help you if you lose it, and we keep order records as long as the law requires for accounting.

Technical data

• Web server logs. To keep the service secure and stop abuse, our web server logs each request: the time, your IP address, the page address, the request headers your browser sends (such as its user agent, language and referrer), and the response status and size. Conversion ids and download links in page addresses are masked, and cookies, the PDF password and payment headers are removed before anything is written. These logs are kept for up to 14 days.
• Application log. The converter itself logs only the method, the kind of page, the status and the time each request took: never your IP address, a file name, anything from your statement, an email address or a conversion id.
• IP address. To apply the free-file limit, the converter keeps a keyed hash of your IP address (not the address itself) for up to 2 days. Rate limits count your recent requests per IP address in the converter's memory only; this is never written to disk.
• Metadata. A small database on our server holds conversion ids, page and row counts, hashed IP addresses, the cookie value, and checkout and credit records. It never holds the contents of your statement.
• One cookie. A cookie named bid holds a random number, used only to apply the one-free-file-a-day limit. It contains nothing about you and is not used for tracking or advertising.
• Your browser's storage. If you choose to save a credit code, it is stored in your own browser's local storage, not on our server.

How long we keep it

Data	Kept for
Uploaded PDF	Until the conversion finishes (seconds)
Converted files and preview	1 hour after conversion
Hashed IP address and cookie value for the free-file limit	2 days
Conversion record (id, page and row counts, hashed IP address, cookie value)	1 hour after conversion, with the files
Web server logs	Up to 14 days
Credit pack record (email, code hash, balance)	Until the credits expire (12 months), plus 30 days
Order records	As long as tax and accounting law requires

Who else processes data

• Polar (polar.sh), our merchant of record, for checkout, payments, taxes and receipts. Polar uses Stripe to process cards.
• Cloudflare, which serves and protects the site. Every request, including your upload, passes through its network on the way to our server.
• Our hosting provider, which runs the server the service runs on.
• An email delivery provider, to send your credit code, if you buy a pack.

We do not sell your data and do not share it with anyone else, unless the law requires it.

International transfers

Our server and our providers may be located outside your country. Where the law requires it, transfers are covered by appropriate safeguards such as standard contractual clauses.

Your rights

Depending on where you live, you can ask to access, correct or delete your data, object to or restrict its use, and receive a copy. Uploaded files are deleted within 1 hour anyway; for anything else, email [email protected]. You can also complain to your data protection authority.

Security

The site is served over HTTPS only. Each file is read by an isolated process with strict resource limits. Files are stored only for the retention times above, in a folder only the service can read. No system is perfectly secure, which is one reason we keep so little for so short a time.

Children

The service is not intended for anyone under 16.

Changes

If we change this policy, we will update the date at the top of this page. Significant changes will be announced on the site.