← Back to home

Privacy Policy

Last updated: August 2026

BankXL ("we", "us", "our") respects your privacy. This policy explains what we collect, why we collect it, and how we handle your data when you use our service.

1. What we collect

Account information

  • Email address (required to sign in)
  • Full name (optional, used for invoices)
  • If you sign in with Google: your Google account email and basic profile info

Billing information

Razorpay handles all payments. We never see or store your card or bank details — we keep only your payment reference and subscription status.

Conversion metadata

For each conversion we store:

  • Filename of the uploaded PDF
  • File size in bytes
  • Number of pages and transactions extracted
  • Bank name (auto-detected, optional)
  • Processing duration and status

2. What we do NOT store

We do not store the PDF files you upload. Files are processed entirely in server memory and discarded the moment the conversion completes (success or failure). Nothing is written to disk during conversion.

The one exception is your choice. If a conversion fails because we don't yet support your bank's format, we show a button offering to send us that file so we can add support for it. That file is stored — privately and securely, accessible only to us — only if you explicitly click that button. We use it solely to improve our converter and delete it once support is added. We never store a file you didn't choose to share.

We do not store your transactions unless you switch it on. By default the rows we extract are discarded the moment your file is delivered. If you turn on Keep my transactions in Settings, they are saved against your account so you can re-download a past conversion without re-uploading the PDF — visible only to you, deleted when you turn the setting off. It is off until you choose otherwise.

Your statements are never sent anywhere. Every conversion is done by our own deterministic engine, in memory, on our servers. No AI model, no external extraction API, no third party of any kind ever receives your statement. If our engine cannot read a format, the conversion fails and we ask you to share the file so we can add support — it is never quietly handed to someone else instead.

We do not read your statements. Nothing is logged, and our admin tools show only non-identifying diagnostics — bank name, page count, failure reason. The one exception is a file you explicitly chose to share with us, as described above.

3. Third-party services

Your statement is never sent to a third party — not for processing, not for anything else. The external services involved in running BankXL are:

  • Supabase — authentication and account database (hosted in EU/US). It holds your extracted transactions only if you switched on conversion history, plus any failed sample you explicitly chose to share with us (see section 2), held in private storage only we can access. It never receives the PDF itself.
  • Razorpay — payment processing (PCI-DSS compliant). Does not receive your PDF or transaction data.
  • Vercel — hosting infrastructure. Processes your request but does not persist file contents beyond the request lifecycle.
  • X (Twitter) — advertising measurement only, via the pixel described in section 4. It sees that a browser visited this site, and the price and payment reference of a subscription. It never receives your PDF, your transactions, your email address or your phone number.

4. Cookies and tracking

The cookies we set ourselves are the essential ones that keep you signed in (Supabase session tokens).

We use Vercel Analytics to count page views and product events — which features get used, where conversions fail. It is cookieless and records no personal information and nothing about the contents of your statements.

We run one advertising tracker. X (formerly Twitter) provides a pixel that we use to measure which of our ads lead to a paid subscription. It sets X’s own cookies and can associate your visit to this site with your X account, in the same way it does on any other site carrying it. It records that a browser visited BankXL and, on a paid subscription, the plan price and a payment reference.

What it never receives: your email address, your phone number, your name, your files, or anything at all about the statements you convert. X offers those first three as optional “advanced matching” fields to improve ad targeting; we do not send them.

You can block it with any content blocker, or with your browser’s tracking protection, and everything on this site will continue to work — nothing about converting, verifying or downloading depends on it.

5. Your rights

  • Access — request a copy of all data we have about you
  • Deletion — request permanent deletion of your account and all associated data
  • Correction — update incorrect personal information from your dashboard
  • Export — download your conversion history as JSON

Email support@banlxlai.com for any of these requests. We respond within 7 days.

6. Children

BankXL is not intended for use by individuals under 18.

7. Changes to this policy

We will notify users by email of any material changes at least 14 days before they take effect.

8. Contact

Questions? Email support@banlxlai.com or write to us at our registered address (provided on request).