Privacy Policy

1. Information We Collect

a. Personal Information

• Name and email address (provided during registration, communication, or support).
• Payment details (processed securely by third-party providers such as Stripe).

b. Non-Personal Information

• Usage data (e.g., number of pages processed, plan details, and feature usage).
• Browser, device, and log information.
• Uploaded documents (bank statements, PDFs, images) — processed securely and deleted according to our data retention policy.

2. How We Use Your Information

For Service Delivery

• To process, convert, and deliver your uploaded financial documents.

For Communication and Support

• To respond to inquiries, provide account updates, or send important service notifications.

For Improvement

• To analyze usage data and feedback in order to enhance Statement Flow, improve accuracy, and introduce new features.

Compliance with Legal Obligations

• To meet regulatory requirements, enforce our Terms of Service, and protect our users and platform.

3. Sharing Your Information

Third-Party Service Providers

• We use trusted providers (e.g., Stripe for payments, cloud hosting platforms) who process your data securely and only for the intended purpose.

Legal Disclosures

• We may share information if required by law or when necessary to protect our rights, safety, or the rights of others.

4. Data Security

Our Security Practices

• Payment transactions are encrypted and handled exclusively by PCI-compliant third-party platforms.
• Uploaded documents and generated outputs are encrypted in transit and at rest.
• Documents are automatically deleted after 24 hours unless you configure extended retention.
• Access to data is restricted to authorized personnel only.

While we take strong measures to protect your information, no system is completely secure. We encourage users to exercise caution when sharing sensitive data online.

5. Your Privacy Rights

Access and Correction

• You may request access to the personal data we hold and correct any inaccuracies.

Data Deletion

• You may request deletion of your personal data and uploaded documents. We will comply unless we are legally required to retain the information.

For privacy-related requests, contact us at: support@statementflow.co

6. ChatGPT Integration

Statement Flow offers an optional integration that lets a ChatGPT Custom GPT access your Statement Flow account on your behalf. The integration is off unless you connect it yourself.

How the connection works

• You sign in to Statement Flow and approve the specific permissions requested. Access tokens represent only your own account.
• We store a hashed reference to each token, its permissions and expiry — never a copy of your Statement Flow password.
• You can disconnect at any time, and a Statement Flow administrator can disable the integration entirely.

What data can be shared with ChatGPT

• Account profile (name, email, plan) and page usage for the current cycle.
• Bank statement metadata: filename, upload date, processing status, page and transaction counts.
• Balance validation results, including opening/closing balances, variance and review flags.
• Extracted transaction rows (date, description, reference, amount) — only when you grant that permission and only for the statement requested.
• Whether your QuickBooks, Xero or Google connections are active.

What is never shared

• Your uploaded source files, or any storage links to them.
• Your QuickBooks, Xero or Google credentials and OAuth tokens.
• Statement Flow system secrets, payment credentials, or any other user's data.

Exports

• ChatGPT can request an export, but it cannot write to your accounting system on its own — you confirm and run every export inside Statement Flow.

Anything you send to ChatGPT is also handled by OpenAI under their own privacy terms, which we do not control. Every request the integration makes is logged for security review; the logs record the operation, resource and result, never token values.