Privacy Policy

Version 1.1 · Last updated: July 12, 2026 · StatementExcel · statementexcel.net

StatementExcel ("we", "us", "our") respects and protects your privacy. This policy explains how we collect, use, store and share your personal information when you use StatementExcel (the "Service"), and the rights you have. We may update this policy from time to time; material changes will be announced by email or in-product notice at least 15 days in advance.

1. Data Controller

• Company: CCC STUDIO
• Privacy contact: privacy@statementexcel.net
• Data Protection Officer: not currently appointed

2. Information We Collect

2.1 Information you provide:

• Account information: name (optional), email address, password (stored hashed).
• Uploaded documents: PDF bank statements you submit for conversion, and the transaction data extracted from them. These are the most sensitive data we handle — see Sections 6 and 7 for how they are protected and deleted within 24 hours.
• Payment information: transaction amount and payment status only. We never store full card numbers — card data is handled by our payment processor (see Section 5).
• Communications: emails and support requests you send us.

2.2 Information collected automatically (first-party server logs only):

• Device and network: IP address, browser type, operating system, time zone.
• Usage: pages visited, features used, conversion counts, session length.
• Logs: request timestamps, error logs, performance data.

3. How We Use Your Information

• Providing and maintaining the Service — contract performance.
• Billing and payment processing — contract performance.
• Customer support — contract performance / legitimate interest.
• Service notices (billing, security, policy updates) — legitimate interest.
• Security, quota enforcement and fraud prevention — legitimate interest.
• Service improvement using first-party, aggregated usage and error logs (no third-party analytics products) — legitimate interest.
• Legal compliance — legal obligation.
• Marketing emails (optional) — your consent, with easy opt-out (Section 9).

We may aggregate or de-identify data for statistics; such data can no longer identify you. We do not use your uploaded statements or extracted data to train AI models.

4. Cookies & Tracking

• Strictly necessary (cannot be disabled): session/login cookies, anonymous quota cookie.
• Functional (optional): language and interface preferences.

We do not currently use third-party analytics or advertising cookies (for example Google Analytics, Mixpanel, or similar products). We may collect limited first-party technical logs (such as IP address, browser type, pages requested, and error data) on our own servers solely to operate, secure, and improve the Service. If we later introduce a third-party analytics tool, we will update this section with the tool's name and a link to its privacy policy before enabling it.

You can manage cookies via your browser settings.

5. Sharing & Disclosure

We do not sell your personal information, including as "selling" is defined under the CCPA. We share information only with:

• Service providers under confidentiality obligations: cloud hosting, AI extraction processing (US-hosted infrastructure), and customer support tooling. Payment card data is handled exclusively by our PCI-DSS-compliant payment processor, Waffo Pancake, and is never stored on our servers.
• Legal and regulatory authorities where required by law, court order, or lawful request.
• A successor entity in a merger or acquisition, with prior notice and continuation of protection obligations.
• Other parties only with your explicit prior consent.

6. Data Security

• Encryption in transit: TLS 1.2+ / HTTPS for all traffic.
• Encryption at rest: stored data encrypted (AES-256); passwords hashed with bcrypt.
• Access control: least-privilege access; staff bound by confidentiality agreements.
• Uploaded files and extraction results are automatically and permanently deleted within 24 hours.
• Regular security reviews and dependency patching.

If a security incident affects your rights, we will notify you and the relevant regulator within 72 hours of discovery, as required by law. Please keep your account credentials confidential.

7. Retention Periods

• Uploaded statement files & extraction results: deleted within 24 hours of conversion.
• Account information: for the life of the account; deleted or anonymized 90 days after cancellation.
• Billing/transaction records: 7 years, as required by tax and accounting law, then deleted or archived.
• Support correspondence: 2 years, then securely deleted.
• Security and audit logs: 12 months, then securely deleted.

8. Your Rights

Subject to applicable law (including GDPR and CCPA), you have the right to know, access, correct, delete, restrict or object to the processing of your personal information, the right to data portability, and the right to withdraw consent. To exercise any right, contact privacy@statementexcel.net; we respond within 30 calendar days. You may also lodge a complaint with your local data protection authority.

9. Marketing & Opt-Out

With your consent, we may send product updates and offers by email. You can opt out at any time via the "unsubscribe" link in any marketing email or in account settings. Opting out does not affect essential service notices (billing, security).

10. International Data Transfers

Our servers and processors are located primarily in the United States. Where personal data is transferred across borders, we use safeguards such as data processing agreements incorporating the EU Standard Contractual Clauses (SCCs) and transfer only to recipients providing an equivalent level of protection.

11. Children

The Service is intended for users aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it promptly.

12. Third-Party Links

The Service may contain links to or integrations with third-party services. This policy covers only information we collect directly; please review third parties' own policies before use.

13. Changes to This Policy

For material changes we will give at least 15 days' notice via email or platform announcement and update the "Last updated" date above. Continued use after the effective date constitutes acceptance.

14. Contact Us

• Privacy: privacy@statementexcel.net
• Support: support@statementexcel.net
• Company: CCC STUDIO