DRAFT, not yet reviewed by counsel. Last updated: October 21, 2026.

Privacy Policy

Statement2CSV ("we", "us") is operated by AgentStack Media. This policy explains what happens to your information when you use Statement2CSV (the "Service").

1. Your statements never leave your device

The Service converts PDF bank statements to CSV entirely inside your web browser. When you choose a file, your browser reads it into local memory and our JavaScript parses it on your device. We do not receive, upload, transmit, store, or have access to your statement files, their contents, or the converted CSV. No AI, OCR, or third-party processing service is used. The page's Content Security Policy restricts network connections to our own site, and the converter makes no network requests with file data.

2. Zero retention

Because file contents never reach our servers, we retain nothing. Data held in your browser tab is discarded when you close or reload the tab. The CSV you download is saved only where you choose on your device.

3. Information we do process

• Payments. Paid downloads are handled by our payment processor, Stripe, on Stripe's own pages. Stripe collects your payment details and email under Stripe's Privacy Policy. We receive transaction records (for example, amount, date, email, and subscription status) but never your full card number. We never send statement data to Stripe.
• Hosting logs. Our static web host may automatically log standard request data (IP address, browser type, pages requested, time) for security and reliability. These logs contain no statement data. We keep them no longer than [30] days.
• No tracking. We do not use advertising cookies, analytics trackers, or sell or share personal information.
• Support email. If you email us, we keep your message to answer it. Please don't send us statements.

4. Security

The site is served only over HTTPS (encryption in transit). Payment data is handled by Stripe, which is PCI-DSS certified. Since we hold no statement data, there is no statement data at rest on our systems to encrypt or breach.

5. Your rights

Depending on where you live (for example, under the CCPA/CPRA in California or the GDPR in the EU/UK), you may have rights to know, access, correct, delete, or port the personal information we hold (limited to payment records and support emails), and to opt out of its sale or sharing. We do not sell or share it. To make a request, email [privacy@your-domain]. We will respond within the time the law requires and will not discriminate against you for using your rights.

6. Children

The Service is not directed to children under 16.

7. Changes

We will post any changes here and update the date above.

8. Contact

AgentStack Media, [postal address], [privacy@your-domain].