Statement Mill converts bank statements into structured data. This policy explains what we process, what we keep, and what we never do. The short version: your statement files are never stored — they are processed in memory and discarded the moment your download is ready.
What we process
When you convert a statement, the file you upload is transmitted over an encrypted connection (TLS) to our conversion function, forwarded to our AI processing provider (Anthropic, our data sub-processor) for text extraction, and the extracted rows are returned to your browser. Your spreadsheet is generated locally in your browser. We do not write your file or its contents to any database or disk.
What we don't do
We do not store your statements. We do not sell or share your data. We do not use your statements to train AI models — our processing provider's API does not train on submitted data. We do not run advertising trackers on this site.
What we keep
Standard technical logs (timestamps, response codes, approximate request sizes) needed to operate and secure the service, retained briefly and containing no statement contents. If you email us, we keep the correspondence.
Legal basis and your rights (GDPR)
Processing occurs at your request to deliver the conversion you asked for (performance of a contract, Art. 6(1)(b) GDPR). Because we retain no personal data from your statements, there is typically nothing to access, correct, or erase after a conversion completes — but you can exercise all GDPR rights by contacting us at hello@statementmill.com. You may lodge a complaint with your supervisory authority.
Sub-processors
We use the following sub-processors. Where a sub-processor is outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses (Art. 46 GDPR) contained in that provider's data processing agreement.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Anthropic PBC | AI extraction of statement text | Statement page content, in transit only | United States — SCCs |
| Netlify, Inc. | Website hosting, serverless execution | Statement page content in transit; IP address | United States — SCCs |
| Supabase, Inc. | Accounts, plan and page counters | Email address, plan, pages used. No statement content. | EU — Frankfurt (eu-central-1) |
| Resend (Plazma Labs, Inc.) | Sign-in emails | Email address | EU — Ireland (eu-west-1) |
| Google Ireland Ltd / Google LLC | Optional "Sign in with Google" | Email address, name (only if you choose Google sign-in) | United States — SCCs |
| Paddle.com Market Ltd | Payments — Paddle is the merchant of record and an independent controller for payment data | Billing details. No statement content. | United Kingdom — adequacy decision |
Where processing happens
Statement Mill is operated from the European Union and account data is stored in the EU (Frankfurt). However, the extraction step itself runs on Anthropic's API and on Netlify's serverless infrastructure, both of which process in the United States. Your statement is therefore transmitted to the United States for the seconds it takes to extract the rows, under Standard Contractual Clauses, and is not retained by us afterwards. We would rather tell you this plainly than imply an EU-only pipeline we do not currently operate.
International transfers
Transfers to sub-processors outside the EEA rely on the European Commission's Standard Contractual Clauses. You can request details of the safeguards in place by emailing hello@statementmill.com.
Data processing agreement
If you are an accountant, bookkeeper or business processing your clients' statements, you are the controller and we are your processor. We provide a Data Processing Agreement free of charge on any plan, including the free one.
Contact
Questions about this policy: hello@statementmill.com.