Privacy policy
Last updated: 25 October 2026
Balanced Statement is run by Krava IT Services LTD, registered in Cyprus under number HE437792, at Inomenon Ethnon 2, Anastasia Court, 4th floor, 6042, Larnaca, Cyprus ("we"). We are the data controller for the information described here. Contact: support@balancedstatement.com.
The short version
- Your statement is processed in memory and discarded. We never write it to disk or to our database.
- We keep only metadata about each conversion: number of pages, file type, our guess of the bank's name, whether the balances matched, how long it took and what it cost us.
- To read your statement we send it to our AI provider, Anthropic. They delete it within 30 days (details below).
- We count visits and conversions without identifying or tracking you: no visitor id, no profile.
- We don't sell your data and we don't use it to train AI models.
Your statement
When you convert a statement, the file is held in our server's memory while it is read and checked, and dropped as soon as it has been read. The result (the transactions) stays in memory so you can download it: results are deleted within minutes after download, or after 15 minutes if never downloaded. You can also delete a result straight away with "Delete this result now". Neither the file nor the transactions are written to disk, logs or our database. Photo metadata (such as location) is removed before the image is sent for reading.
What we store
- Account: your email address and an account id. You need an account to convert statements, including the free one. We also keep a normalised form of your email (without "+tags", and without dots for Gmail) so the free statement can be given once per mailbox.
- Credits and orders: credit purchases and usage, order amounts and Stripe references. We never see or store card details.
- Conversion metadata: date, pages, file type, bank name guess, pass/fail, duration, API cost estimate, and whether a credit was used.
- Usage counts: one record per page view, upload, conversion result, download, checkout and purchase, holding only the time, the page, and the campaign that brought you (utm_source, utm_campaign, referral code). Converter steps also carry the random id of that conversion, which exists only while the result is in memory and isn't linked to you, your browser or your account. There is no visitor id, so we can count how often each step happens, but we can't follow anyone across pages or visits.
We keep account, order and credit records for as long as you have an account and then as long as tax law requires (currently 6 years for invoices and payments). Conversion metadata and usage events are kept for 24 months.
Who processes data for us
| Provider | What for | What they receive |
|---|---|---|
| Anthropic, PBC (USA) | AI that reads the statement | The statement pages, for the duration of the request |
| Supabase, Inc. | Database and login emails | Your email, account, credits, orders, metadata and events. Hosted in the EU (Ireland) |
| Stripe Payments Europe, Ltd. | Payments, receipts, tax | Your email and payment details (entered on Stripe's page) |
| Fly.io, Inc. | Hosting | All traffic passes through servers in Frankfurt, Germany |
What Anthropic keeps
Under Anthropic's commercial terms for its API, Anthropic automatically deletes inputs and outputs within 30 days of receiving or generating them. Exceptions: they may keep data longer when needed to enforce their Usage Policy (content flagged by their safety systems may be kept for up to 2 years), or when required by law. Anthropic does not train its models on data sent through its commercial API. See Anthropic's data retention policy and commercial terms.
Transfers outside the EU (Anthropic, and the US parents of our other providers) rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Cookies
Essential cookies only, unless you opt in:
bs_csrf: protects forms against cross-site attacks.bs_at,bs_rt: keep you logged in. Your results are tied to your account, so only you can see and download them.bs_attr: the campaign that brought you here (utm source/campaign, referral code), for 90 days.bs_consent: your cookie choice.
Legal bases
Converting statements, accounts and payments: performance of our contract with you. Tax records: legal obligation. Security, abuse prevention and usage counts (which contain no identifiers): our legitimate interest in running and improving the service. Google Ads measurement: your consent.
Your rights
You can ask for a copy of your data, correction, deletion, restriction, or to object, and you can take your data elsewhere. Email support@balancedstatement.com. You can also complain to the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or your local authority.