Plainly, because you are uploading client bank statements and you deserve a straight answer.
The file is held in memory while it is read, then discarded. It is never written to disk and never saved in our database. If you came back tomorrow and asked us to re-send your original PDF, we could not — we do not have it.
The extracted rows — date, description, amount, the category assigned and its confidence — plus the file name, page count, and the institution and statement period if they appeared on the document. That is what makes your review page work when you reload it. Your email is kept to hold your page credits.
Extraction uses a commercial AI model reached through OpenRouter, so the pages are transmitted to that provider to be read. We do not train anything on your data and we do not sell or share it. If sending client documents to a third-party model provider is not acceptable under your engagement terms, this tool is not right for that client — that is a straight answer rather than a sales one.
Review pages live at long unguessable URLs and are not listed or indexed, so anyone holding the link can open that conversion. Treat the link like the statement itself. If you need a conversion deleted, ask and we will remove it.
This is a new product run by one person. There is no SOC 2 report and it would be dishonest to imply otherwise. If you need a signed data processing agreement before uploading client data, ask and we will talk about it rather than pretend the paperwork already exists.