Privacy

Last updated: September 2026. This page explains, in plain language, what happens to a statement you upload to stmtai. stmtai is operated by Reinvent Global, the data controller responsible for your data.

What we do with your file

• Your file is uploaded over an encrypted connection to a private storage bucket in Amazon Web Services (AWS).
• It is read once by an automated process running inside our AWS account, which uses Amazon Bedrock to extract the transactions.
• We attempt to delete the original file as soon as processing finishes. If that immediate deletion fails, the storage lifecycle rule removes it automatically.
• The extracted transactions (the result you see on screen) become eligible for automatic deletion after 7 days if you are signed in, or 1 day if you are not. AWS may complete lifecycle deletion later. You do not have to wait: every results page has a Delete now button, and signed-in users can delete any conversion from their account page.
• Your data is never used to train any model, by us or by AWS. Amazon Bedrock does not retain or train on customer inputs.

What we store about you

• If you create an account: your email address, your plan, and how many pages you have used.
• If you sign in with Google, Google gives us your email address and confirms it is yours. We take nothing else from your Google account, and we cannot see or touch anything in it.
• If you buy something: payment is handled by Dodo Payments, who act as merchant of record. We receive a customer id and the product you bought; we never see your card number.
• Anonymous visitors: a random identifier issued by AWS Cognito, used to count free pages. Our usage record for it expires after 30 days.
• Standard server logs (timestamps, error messages) kept for 30 days to fix problems. Logs never contain the contents of your statements.
• Feedback or support messages you send us may be retained so we can respond and diagnose recurring problems.
• If you arrive from one of our advertisements, the link carries the name of the ad campaign (a utm_source tag). Your browser keeps that name in its own storage for 30 days and attaches it to your first conversion or sign-up, so we can count which advertisement worked. It names the advertisement, not you, and we count totals per campaign only.

What we don't do

• No advertising or analytics trackers. No cookies other than the one that keeps you signed in. The campaign tag above is the whole of our ad measurement.
• We do not sell, share, or look at your financial data except when you explicitly email us a file for support.

Where data lives

All processing and storage happens in Amazon Web Services data centers in the United States. If you use the service from outside the United States, your data is transferred to and processed in the United States. Sub-processors: Amazon Web Services (hosting, storage, and AI via Amazon Bedrock) and Dodo Payments (payments).

Your rights

You can delete your account profile, conversion files and history, API keys, team links, and login yourself from the bottom of your account page after paid access ends. Feedback or support correspondence is not part of the automated deletion. For an export of what we hold about you, or anything else, email support@stmtai.com. We respond within 5 business days.