Privacy Policy &
Data Protection

1. Information We Collect

We collect only the minimal data strictly necessary to authenticate your account and provision your subscription services:

• Account Credentials: When you register, we store your name, email address, and an encrypted password hash in our database via Supabase. We never have access to plain-text passwords.
• Transaction Identifiers: When you purchase credits or a subscription, we record the payment reference ID, order ID, amount, and activation status received from Razorpay.
• No Document Persistence: When using our Local Region Extractor, we do not collect, view, or retain the contents of your financial PDF statements. Documents reside purely in browser volatile memory (RAM). When using our AI Extractor, extracted text is parsed ephemerally in memory solely to produce your tabular output and is not archived or sold.

2. Razorpay Secure Payment Processing & PCI-DSS Compliance

Payment security is our highest priority. All card transactions, UPI payments, and net banking collections are processed via Razorpay Software Private Limited, an RBI-licensed payment aggregator and certified PCI-DSS Level 1 service provider:

• No Card Storage: StatementConverter servers never see, collect, store, or transmit your credit or debit card numbers, expiration dates, CVV/CVC codes, or banking PINs.
• Encrypted Transmission:All cardholder details entered in the checkout overlay are transmitted over TLS 1.3 encrypted sockets directly to Razorpay's hardened vault infrastructure.
• Tokenization: Transactions are authenticated via 3D-Secure / OTP verification as required by RBI, Visa, Mastercard, and international card schemes. We receive only a cryptographic order confirmation token upon successful payment.

3. Local Decryption of Password-Protected PDFs

Many Indian bank statements (SBI, HDFC, ICICI, Axis, PNB) are password-protected with personal identifiers (such as birth date or account digits). When you input your password into our converter, decryption is executed strictly within your local browser sandbox via WebAssembly. Your password never travels over the network, is never logged on any server, and is destroyed as soon as the file processing completes.

4. Compliance with Indian & International Data Protection Laws

StatementConverter operates in strict adherence to domestic and international privacy legislation:

• Digital Personal Data Protection Act (DPDP Act 2023, India): User data is processed strictly for specified lawful purposes with transparent consent mechanisms and zero non-consensual profiling.
• GDPR & CCPA Alignment: European and global users enjoy comprehensive rights to data rectification, data portability, and right-to-be-forgotten account erasure upon request.
• Zero Data Selling: We never sell, rent, monetize, or trade your personal email, account info, or financial metrics to third-party data brokers or marketing networks.

5. Cancellation & Refund Notice

Users can test our conversion engine using the free client-side Local Region Extractor before purchasing paid packages. Subscriptions can be cancelled at any time through the dashboard. In accordance with our Cancellation & Refund Policy, refunds are executed within 5 to 7 business days back to the original payment source for documented technical failures or duplicate charges reported within 7 calendar days.