1. The short version
You upload bank statements; we convert them and give you the results. To read each statement we send the whole PDF to our AI provider, Anthropic, which does not train on it and normally deletes it within 30 days. Our own copy of the PDF is deleted the moment processing finishes, and extracted data is deleted on the schedule your team chooses, from 30 minutes to 30 days. We never sell your data and use no advertising trackers.
2. Who is responsible for your data
NoRekey is the controller for your account, billing and service data. You can reach us at support@norekey.com.
When a business, such as a bookkeeper or accountant, uploads statements, NoRekey processes those statements and the data extracted from them on that business's behalf. For that data the business is the controller and NoRekey is its processor, under our Data Processing Agreement. If your statements were uploaded by someone you work with, contact them first about that data.
3. What we collect
- Account data — your name, email address and password (hashed), plus team names and membership.
- Documents — the statement PDFs you upload and the transaction data extracted from them.
- Billing data — handled by Stripe. We store your plan, invoice metadata and your card's brand and last four digits, never the full number.
- Operational data — page counts, conversion status, server logs and error reports used to run and secure the service.
- Referral data — aggregate article readership and visits to the converter. A conversion may record the last article read in that session and the original referral source (such as a search-engine hostname or campaign tag). This never includes statement transactions.
4. Why we use it
- Providing the service — your account, converting statements, your history and exports, billing, and account emails such as verification, receipts and usage summaries. Lawful basis: performing our contract with you.
- Keeping the service secure and working — server logs, error monitoring and abuse prevention. Lawful basis: our legitimate interest in a secure, reliable service.
- Understanding how people find us — referral and readership data. Lawful basis: our legitimate interest in improving the site.
- Keeping invoices and accounting records — Lawful basis: our legal obligations under UK tax law.
We make no automated decisions about you that have legal or similarly significant effects.
5. How documents are processed
When you upload a statement it is stored encrypted, and the whole PDF is sent to our AI provider, Anthropic, solely to read and structure the transactions. Password-protected PDFs are decrypted first with the password you supply; the password itself is never stored.
Anthropic does not use your statements to train its models. It deletes the PDF, and the transactions it returns, within 30 days. If its safety systems flag a request as breaking its usage policy, it may keep that request for up to 2 years, and it may keep data for longer where the law requires.
Our own copy of the uploaded PDF is deleted from storage as soon as processing reaches a final state, successful or not, on every plan.
6. How long we keep it
- Source PDFs — deleted from our storage immediately after processing. Anthropic's copy is kept as described in section 5.
- Extracted rows and exports — deleted on your team's retention setting: 30 minutes, 1 hour (default), 24 hours, 7 days or 30 days. Guest conversions expire within 24 hours.
- History metadata — after the rows expire, the file name, date, page count, status and referral source remain until you delete the conversion, the team or your account.
- Account data — kept while your account exists and deleted when you delete it, except invoices and accounting records, which we keep for as long as UK tax law requires (normally six years).
- Server logs — kept for up to 7 days. Error and performance reports are kept by Laravel Nightwatch for up to 90 days.
- Emails — Postmark, which delivers our emails, keeps their content and delivery records for 45 days.
- Backups — database backups are kept for 7 days, so deleted data can remain in a backup for up to 7 days before it is overwritten.
7. Who we share data with
We share data only with the processors needed to run NoRekey, under data processing agreements:
- Laravel Cloud — application hosting and databases, in London.
- DigitalOcean — encrypted file storage, in London.
- Cloudflare — network security and delivery in front of our servers.
- Anthropic — transaction extraction. It receives the whole PDF, does not train on it, and keeps it as described in section 5.
- Laravel Nightwatch — error and performance monitoring.
- Postmark — account and service emails.
- Stripe — payments and invoicing.
- Google Fonts — typeface delivery on our web pages.
We never sell personal data and never share it for advertising.
8. International transfers
Our servers and file storage are in London. Anthropic, Cloudflare, Laravel Nightwatch, Postmark, Stripe and Google may process data outside the UK, including in the United States. These transfers are protected by the safeguards in each provider's data processing terms: the UK–US data bridge where the provider is certified, or the UK International Data Transfer Addendum to the EU standard contractual clauses.
9. Cookies
We only use cookies needed to run the site: session, authentication and security (CSRF) cookies. Referral information is stored on our server against your existing session, not in a separate cookie, and expires with it. We use no third-party analytics or advertising cookies, so we don't ask for cookie consent.
10. Your rights
Under UK GDPR you can ask for a copy of your personal data, have it corrected or deleted, restrict or object to how we use it, and take your data elsewhere. Some rights have limits: for example, we must keep invoices for tax purposes even if you ask us to delete them. Much of this you can do directly in the app: retention is under your control, and you can delete conversions, teams and your account yourself. For anything else email support@norekey.com and we'll respond within one month. If your statements were uploaded by a business acting as controller, we'll pass your request to them. You can also complain to the Information Commissioner's Office (ico.org.uk).
11. Security
Data is encrypted in transit and at rest. Access to production systems is restricted and audited, passwords are hashed, and two-factor authentication is available on every account.
12. Changes and contact
If we change this policy in a way that matters, we'll tell you by email or in the app first. Reach us any time at support@norekey.com.