Privacy Policy

Your bank statements are never uploaded. They are read, parsed and converted entirely inside your own browser, and the converted file is produced on your machine. We cannot see your transactions, balances, account numbers or payee names, because they never reach us.

We do collect the small amount of data needed to run accounts, billing, advertising and anonymous usage counting, described in full below.

When you select or drop a CSV, the file is read using the browser’s file API and handed to a Web Worker running in the same tab. Parsing, validation and generating the OFX, QBO or QFX output all happen there. The download is created from an in-memory blob on your device.

No part of the file is transmitted to us or to any third party. Closing the tab discards it. We keep no copy, so there is nothing for us to disclose, retain or lose.

Account. If you sign in, we store your email address so we can identify your account. Authentication uses a one-time link; we never ask for or store a password. Sessions are kept in cookies set on your device. Our authentication and database provider is Supabase.

Billing. Payments are processed by Stripe. We never see or store your card details. We store your Stripe customer and subscription identifiers, the plan you are on, your subscription status and its renewal date, so we know what you are entitled to.

Usage limit checks. When a file exceeds the free row limit, your browser asks our server whether your subscription is active. That request identifies your account. It does not include the file, its contents, its name or its size.

Advertising and analytics. We use Google Ads conversion tracking. When a conversion is recorded, the only thing sent is an event name — no filename, row count, amounts or payee names. Google may set cookies and receive your IP address and page URL, subject to consent below.

Anonymous usage counters. We record that a page was viewed, that a file was loaded, that the checks passed and that an export happened, together with which of our own pages you were on, the output format you chose and a coarse size band such as “51–200 rows”. These rows are keyed to a random identifier generated per browser tab, which is discarded when the tab closes and is never linked to your account. We also store your IP address and two-letter country with these events, so we can count unique visitors and see which countries the service is used from. The table that stores them has no column capable of holding a filename, an amount, a payee or an account number.

IP addresses are personal data. We use them only to count unique visitors and for basic abuse protection, we do not use them to build a profile of you, and every telemetry row — including the IP — is deleted automatically 90 days after it is written.

Server logs. Our hosting provider records standard request logs, which can include IP address, user agent and requested URL.

Cookies strictly needed to keep you signed in are set only once you sign in. Advertising and analytics storage defaults to denied for visitors in the UK, the EEA and Switzerland, and is only enabled if you consent. Elsewhere it is enabled by default. You can clear cookies at any time in your browser.

We do not sell personal data. We share only what is necessary with the providers that operate the service: Supabase (accounts and database), Stripe (payments) and Google (advertising measurement), plus our hosting provider. Your statement contents are shared with none of them, because we never receive them.

Account and subscription records are kept while your account exists and for as long as tax and accounting rules require us to keep billing records. Usage counters, including IP addresses, are deleted after 90 days. Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict its processing.

To exercise any of these, or to delete your account, contact privacy@luventra.co.

The service is intended for business use and is not directed at children.

If we change what we collect, we will update this page and its date. Material changes will be signposted in the product.