Privacy Notice

Who controls your data

The service operator identified above is the data controller for DocStructa account, billing, website, support and product-operation data. Formal privacy requests may be submitted through the Contact page or the operator contact details above.

What the converter does with bank statements

PDF, JPG and PNG statement files are read and processed locally in your browser using local PDF and OCR components. The source statement file is not uploaded to DocStructa for conversion. When you complete an export, structured results may be retained in your DocStructa History if History is enabled. Those results can include transaction dates, descriptions, references, amounts, balances, currencies, categories, statement metadata and review warnings.

Other information we process

We may process your account identity and email address, billing and subscription identifiers, conversion-job metadata, optional structured History output, support or partnership enquiries, security and audit records and limited product analytics where you have allowed optional analytics. Payment-card and wallet credentials are processed by Stripe and are not stored by DocStructa.

Why we process it

We process data where necessary to provide and secure the service, perform our contract with you, administer subscriptions and credits, respond to requests, prevent abuse, maintain accounting and legal records and pursue legitimate interests in service reliability and fraud prevention. Optional analytics are used only after the relevant consent choice.

History and retention

History retention is configurable in your account. Retained structured statement results are assigned a deletion deadline based on your chosen setting and plan limit. An automated sweep runs every six hours, and account access also checks for expired History. Expired structured results, warnings, source filenames and processing error text are removed. Account controls also allow individual History items to be deleted and allow DocStructa-owned account data to be erased, subject to records we must retain for legal or accounting reasons.

Support and abuse prevention

Contact and partnership forms collect only the information you submit. To prevent automated abuse, DocStructa applies short-lived rate limiting using a one-way hash derived from request and email information rather than retaining the raw network address for that control.

Processors and transfers

Base44 provides application hosting, authentication, database and backend infrastructure and acts as a service provider or processor for relevant data. Stripe provides payment, billing and fraud-prevention services. These providers may process data outside the United Kingdom. Where required, transfers are governed by the provider's contractual safeguards and applicable transfer mechanisms.

When a business uses DocStructa for somebody else's statement

If an accountant, bookkeeper, employer or other organisation processes a statement on behalf of its own client or customer, that organisation is responsible for having a lawful basis and appropriate authority for that processing. Where DocStructa acts as its processor, the Data Processing Terms form part of the service agreement.

Your rights

Subject to applicable law, you may ask for access, correction, deletion, restriction, objection or portability and may withdraw consent where consent is the legal basis. You may also complain to the UK Information Commissioner's Office or another competent supervisory authority. DocStructa does not sell personal data and does not use statement contents for behavioural advertising.

Security

Controls include authenticated access, row-level ownership restrictions, server-side billing and credit operations, local document extraction, retention limits, signed payment webhooks, audit controls and restricted administrator functions. No online service can guarantee absolute security.

Children

DocStructa is intended for adults and business users and is not directed to children.

Contact

Use the DocStructa Contact page for privacy and data-rights requests. Do not send bank statements, passwords or full payment-card details through the contact form.