Privacy Policy
Last updated: October 2026 · Effective from: October 2026
1. Who We Are
StmtSnap (“we”, “our”, “us”) is a bank statement parsing service operated by StmtSnap Technologies. We are a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act). You, the user, are the Data Principal.
Contact: privacy_stmtsnap@aptibot.com
2. What We Collect
Account data
Email address and display name (provided during signup via Google OAuth or email/password).
Extracted transaction data (signed-in users)
When you are signed in and parse a statement, we store the extracted transaction records (date, narration, debit/credit amounts, balance) so you can re-download them. We do not store your account number. This data is retained according to the table in section 4 and then deleted automatically. When you are signed out, nothing from the statement is stored.
Usage logs
Pages consumed per parse request, extraction method, confidence score, and a one-way hash of your IP address (for anonymous users). These logs are used for free-tier enforcement and service analytics.
Payment data
Billing is handled entirely by Razorpay (INR payments) or Dodo Payments (USD payments). StmtSnap does not store card numbers, UPI IDs, or any payment credentials. We receive only a subscription ID and plan identifier from the payment provider.
3. What We Do NOT Collect
- Your PDF files are never stored. The upload is processed in memory (and, for scanned PDFs, in a temporary file) and discarded as soon as parsing finishes. It is never kept in a database or cloud storage.
- Bank account numbers
- PDF passwords, PINs, or bank credentials (a PDF password is used only to unlock that one file and is never stored)
- Any data from anonymous (signed-out) users beyond a hashed IP address for rate limiting
4. Data Retention — Tier-Based
Raw PDFs are never retained on any plan. Extracted transaction data from signed-in users is retained for the duration below, then permanently deleted from our database automatically. The default on every plan is 24 hours; on paid plans you can raise it in Settings up to the plan's limit:
| Plan | Retention | User control |
|---|---|---|
| Signed out | Not stored | — |
| Free | 24 hours | Fixed; not shown in History |
| Starter | Up to 30 days | Choose 1–30 days in Settings |
| Pro | Up to 1 year | Choose 1–365 days in Settings |
| Enterprise | As agreed in writing | Set with us during onboarding |
Deletions run automatically each night at 03:00 UTC. You can also delete individual records immediately from your History page.
5. How We Use Your Data
- To provide the parsing and export service
- To enforce free-tier page limits
- To manage your subscription and billing
- To display your parse history (paid plans)
- To understand how the site is used (PostHog and Google Analytics; see section 8)
- To send account-related emails (password reset, email confirmation)
- To generate aggregate, anonymised usage analytics (no individual identification)
We do not sell, rent, or share your personal data with any third party for marketing or advertising purposes.
6. Third-Party Data Processors
We use the following sub-processors to deliver the service:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database & authentication | US-East (AWS) |
| Razorpay | INR payment processing | India |
| Dodo Payments | USD payment processing | United States |
| Google OAuth | Sign-in with Google | United States |
| Google Gemini | AI extraction of scanned PDFs (see below) | United States |
| PostHog | Product analytics | United States |
| Google Analytics | Website analytics | United States |
| Sentry | Error monitoring | United States |
| Resend | Transactional email | United States |
| Railway | API server hosting | United States |
| Vercel | Web frontend hosting | Global CDN |
Google Gemini and scanned PDFs. If your PDF has no selectable text (a scan or photo), we send the PDF to Google's Gemini API to read the transactions. Text-based PDFs are not sent to Google. We use Gemini's free tier, under which Google may use submitted content to improve its products and human reviewers may read it. We delete the file from Google's servers as soon as extraction finishes. If you do not want a statement sent to Google, do not upload scanned PDFs.
7. Data Residency
Our primary database is hosted on Supabase in the US-East region (AWS us-east-1). Your data may be stored outside India. By using StmtSnap, you consent to this cross-border transfer. If you require India-only data residency, please contact us at privacy_stmtsnap@aptibot.com to discuss Enterprise options.
8. Cookies & Local Storage
We use a Supabase session cookie to keep you signed in. We also use analytics cookies and local storage from PostHog and Google Analytics to understand how visitors use the site (pages viewed, uploads started and completed). We do not use advertising cookies.
9. Security
- All data in transit is encrypted via TLS 1.2+
- Authentication uses industry-standard JWT tokens (HS256 / RS256)
- Webhook endpoints protected with HMAC-SHA256 signature verification
- Service role database credentials are never exposed to the frontend
- Row-Level Security (RLS) ensures users can only access their own data
10. Your Rights
Subject to the law that applies to you (including India's DPDP Act 2023), you have the right to:
- Access: Request a copy of the personal data we hold about you
- Correction: Update inaccurate data in your profile and settings
- Erasure: Request deletion of your account and all associated data. We will complete this within 24 hours of a verified request.
- Withdraw consent: Stop using the service and request data deletion at any time
- Data portability: Request your parse history exported as JSON
- Grievance redressal: Lodge a complaint with our Data Protection Officer
To exercise any right, email privacy_stmtsnap@aptibot.com from your registered email address. We will respond within 72 hours.
11. Account & Data Deletion
You may delete your account from Settings → Data & Privacy → Delete Account. Upon deletion:
- Your authentication account is deleted immediately
- All parsed statement history is deleted within 24 hours
- Usage logs are purged within 30 days
- Subscription records are retained for 7 years for tax/regulatory compliance
12. Children
StmtSnap is not directed at children under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us immediately.
13. Changes to This Policy
We may update this policy. For material changes, we will notify you by email at least 30 days before the change takes effect. Continued use after the effective date constitutes acceptance. The “Last updated” date at the top reflects the most recent revision.
14. Contact & Grievance Officer
Data Protection Officer / Grievance Officer:
Email: privacy_stmtsnap@aptibot.com
Response time: Within 72 hours of receipt