Privacy Policy
Version 1.2.2 · published 8 October 2026
1. Who are we?
StatementBridge is a service provided by FIDURO B.V., located at Stephensonweg 6, 4207 HB Gorinchem, the Netherlands. Chamber of Commerce (KvK) number: 78200695. VAT number: NL861300221B01.
For questions about this privacy policy or your personal data, please contact us at statementbridge@fiduro.nl.
2. What personal data do we process?
We process the following categories of personal data:
2.1 Account data
- Email address: for signing in, account management and service emails.
- Password: stored as a bcrypt hash (not readable). If you register via a login link, we set a random, unknown password.
- Display name: optional.
- Preferences: language, theme, date format, default accounting package, enabled formats and chosen AI provider and model.
- Account and usage data: plan, credits and the credit ledger (every credit and debit of your allowance), trial conversions and monthly counters, email verification, last login, failed login attempts and temporary lockout, opt-out from tip and offer emails and when service, tip and offer emails were sent.
- Origin and invitations: the page through which you registered, your invitation code and, where applicable, who invited you.
2.2 Conversion data
The source file is deleted no later than 1 hour(s) after upload; if an interruption leaves it behind, automatic clean-up removes it, usually within 25 hours. Export files contain transaction data and can be downloaded for up to 24 hours; they are removed at the next clean-up after that. Conversion metadata and account details you save are retained. Files you e-mail to us yourself, for example with a support question, stay in our support mailbox until we delete them; please do not attach complete statements. Connections use HTTPS; the application and database run in Frankfurt. An AI scan sends the PDF content to the AI provider.
Conversion logs contain formats, counts, status, error diagnostics and settings, including a masked account number. Free-text feedback and error messages may contain personal data. Saved profiles and the address book contain your account details; IBANs in these records are stored encrypted.
For every upload the server issues an upload ID with a fingerprint (hash) of the source file, without its content; for a conversion we additionally keep, for a short time, a fingerprint of the money movements (dates, amounts, debit/credit). These let you re-export the same file with the same amounts free of charge within 24 hours. The periods are listed in §3a.
If you give feedback, we store whether the import succeeded, any comment, the source and target package, the language and whether we may contact you; without an account also the email address you provide. Messages sent through the contact form reach us by email; they are not stored in the application.
2.3 Technical data
- IP addresses and user agents are recorded, including with acceptance of the terms; IP addresses also help limit abuse of free conversions. These stored IP addresses are not anonymised.
- User agent: recorded when you accept (a new version of) the terms.
- Session information: sign-in status and the wizard step (without transaction data).
2.4 Payment data
Stripe customer ID, subscription ID, subscription status and end date, and a record of your payments (amount, VAT, time, Stripe reference). Stripe creates a customer record (with your email address and name) as soon as you start a payment. You enter billing details such as address and VAT number at Stripe. Card and iDEAL details are processed exclusively by Stripe; we do not store payment details.
2.5 Own AI key (optional, Pro)
Stored encrypted (Fernet: AES-128 with HMAC) and used only for AI extraction that you start yourself.
3. What do we use your data for?
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account | Contract (Art. 6(1)(b)) |
| Converting files, including AI extraction after your confirmation, and the free re-export of the same file | Contract (Art. 6(1)(b)) |
| Payments, subscriptions and invoices | Contract (Art. 6(1)(b)) and statutory retention (Art. 6(1)(c)) |
| Recording which version of the terms you accepted | Legitimate interest in being able to prove this (Art. 6(1)(f)) |
| Security and abuse prevention (rate limits, login lockout, IP check for free conversions) | Legitimate interest (Art. 6(1)(f)) |
| Service emails about your account and tips, reminders and offers about using the Service (direct marketing to existing customers) | Legitimate interest (Art. 6(1)(f)); you can object to tips, reminders and offers at any time (Art. 21(2)) via the unsubscribe link or your account settings |
| Service quality and statistics (conversion metadata, feedback) | Legitimate interest (Art. 6(1)(f)) |
| Website statistics and campaign measurement (Google Analytics) | Consent (Art. 6(1)(a)), revocable |
| Answering contact requests | Legitimate interest (Art. 6(1)(f)) |
The retention periods per data category are listed in §3a.
3a. Retention periods
- Uploaded source files: deleted after processing (normally within the same request). If a file is left behind because processing was interrupted (for example by a restart), it is deleted after at least 1 hour at the next clean-up (daily, or earlier at a subsequent processing run).
- Export files: downloadable for up to 24 hours and only by the account that created them; then physically deleted at the daily clean-up.
- Upload identity (a server-issued upload ID with a fingerprint of the source file, without its content): 24 hours; the fingerprint of a conversion's money movements (dates, amounts, debit/credit): 48 hours. They enable a free re-export of the same file. Identifiers of AI scan jobs are kept for 48 hours.
- Wizard state on the server (without transaction data): valid for 24 hours; then deleted at the daily clean-up.
- Account, preferences, profiles, address book, plan, credits and the credit ledger (the financial audit trail of your allowance), counters and email send times: until you delete your account.
- Conversion metadata (format, counts, status, time, settings with a masked account number, error diagnostics): as long as your account exists, with technical error details erased after 90 days and the error message and settings after 365 days. On account deletion they are unlinked from your account and only statistical fields (format, counts, status, time) are kept. Error diagnostics of uploads without an account are kept without an account link.
- Feedback: your comment is erased after 730 days, the rating is kept until you delete your account; the contact address given with feedback without an account is erased after 180 days.
- Acceptance of the terms (version and time): until you delete your account. The IP address and user agent recorded with it, and the IP address used to limit abuse of free conversions, are erased after 180 days.
- Invoices and payment records (at Stripe and in our administration): as long as statutory retention applies (generally 7 years), also after account deletion.
- Sent emails at the email provider: according to that provider's retention period.
- Server and error logs at the hosting provider: according to the hosting provider's log retention.
- Database backups: deleted data may remain in the hosting provider's (Render) database backups for at most 7 days; after that those backups have been overwritten. After a restore from a backup we re-apply the deletions made after the backup moment.
- Contact messages: in our mailbox for as long as needed to handle them.
4. Two processing flows
StatementBridge has two processing flows with different risk profiles:
4.1 Deterministic conversion (default)
Without AI, the application processes files in Frankfurt. Parsers recognise and normalise data; for CSV and Excel you select the column mapping where necessary. Check amounts, dates, currencies and balances before import. This conversion sends no transaction content to an AI provider.
4.2 AI PDF extraction (optional)
- Text PDFs are first processed without AI. If that is not reliable, you can choose AI extraction; AI only starts after confirmation.
- Credit-based AI scan: before the scan the Service shows the number of credits it costs and asks for confirmation. The credits are deducted at the start and refunded automatically if extraction fails (at the latest within 24 hours); if a malfunction prevents this, FIDURO restores them after notification. The same PDF can be re-scanned free of charge up to 2 times within 24 hours if the result was lost. This scan uses Mistral AI as FIDURO's sub-processor.
- Own API key (Pro): you can use your own Anthropic, OpenAI, Google, Mistral or xAI key. Processing by that provider is governed by the agreement between you and that provider; you pay the provider directly.
- AI extraction sends text or page images from the PDF, including any personal data, to the provider concerned. AI extraction supports up to 50 pages per file. Exporting the result counts separately as a conversion.
- AI results may contain errors; you check all extracted transactions before use.
5. Third parties and sub-processors
| Party | Purpose | Location |
|---|---|---|
| Render (Render Services, Inc., USA) | Hosting of the application, database, temporary files and server logs | Hosting region Frankfurt (EU) |
| Cloudflare (Cloudflare, Inc., USA) | Network and DDoS protection of all web traffic (TLS), including uploaded and exported files; engaged through the hosting provider or directly (the contractual chain is being confirmed) | Global network; processing may take place outside the EEA |
| Stripe | Payments, subscriptions, invoices and VAT; Stripe receives your email address, name, billing and payment details | EU and USA |
| Resend (Resend, Inc., USA) | Sending service and account emails (verification, login links, password reset, notifications, tips and offers) | According to the account's sending region |
| Mistral AI (Mistral AI SAS, France) | AI extraction for a credit-based AI scan, only after your confirmation: text or page images from the PDF | According to FIDURO's agreement and account settings with Mistral AI |
| Google (Google Ireland Limited; Google LLC, USA) | Visitor statistics and measurement of our own advertising campaigns (Google Analytics). The Google tag script is only loaded after you give consent via the cookie banner; without consent Google receives nothing. | EU and USA |
Own API key (Pro): if you use your own Anthropic, OpenAI, Google, Mistral or xAI key, we send the PDF content to that provider at your request. That provider is not a sub-processor of FIDURO; the processing is governed by your own agreement with the provider, including location, retention and training use.
For the formal data processing agreement, see our Data Processing Agreement.
6. Your rights
Under the GDPR, you have the following rights:
- Right of access and portability (Arts. 15 and 20): in the account settings you can download a JSON export of the data we hold about you, including: account data and preferences, plan, credits and credit ledger, saved profiles and address book, feedback and your contact preference, conversion metadata (without amounts), accepted terms, upload identifiers, AI scan jobs, the origin of your sign-up and the status of service, tip and offer emails. We provide other data we hold about you on request.
- Right to rectification (Art. 16): you may have incorrect data corrected through your account settings.
- Right to erasure (Art. 17): you can delete your account in the account settings after re-authentication: with your password or, if you never set a password, via a fresh login link we email you. An active subscription is stopped. What is still kept afterwards is listed in §3a.
- Right to restriction of processing (Art. 18): you may request that we restrict the processing of your data.
- Right to object (Art. 21): you may object to processing based on legitimate interest.
- Right to object to direct marketing (Art. 21(2)): you can opt out of tips, reminders and offers via the unsubscribe link at the bottom of every email with such content or via the “Receive tips & onboarding emails” toggle in your account settings. Necessary service emails (password reset, login links, payment confirmation, account notifications) will still reach you.
To exercise these rights, please contact us at statementbridge@fiduro.nl. We respond to your request within one month.
7. Security
We take appropriate technical and organisational measures to protect your personal data:
- Encrypted transport — all communication runs over HTTPS (TLS).
- Password hashing — passwords are stored as bcrypt hashes and never in readable form.
- Encryption at rest of secrets — API keys and IBANs in saved profiles and the address book are encrypted when stored (Fernet: AES-128 with HMAC).
- Limited retention — source files are deleted after processing and export files are downloadable for up to 24 hours; see the retention periods in the privacy policy.
- Cookies — the session cookie is HttpOnly, Secure and SameSite=Strict; the sign-in cookie is HttpOnly and the server checks its age itself.
- Rate limits — on signing in, login links, password reset, uploads, exports and the API, among others, and a temporary lockout after repeated failed sign-ins.
- Access control — downloads are bound to the account that created the conversion and to a per-file token; users can only reach their own data; administrative functions are limited to designated FIDURO administrators.
- Content Security Policy — limits which scripts the site may load; fonts are served from our own server.
- Updates — We update software and dependencies when security updates become available.
- Logging — server and error logs may contain personal data such as IP address, user ID and parts of error messages; email addresses are not logged in full, and IBANs and amounts are masked in stored error diagnostics.
8. Cookies and local storage
StatementBridge uses the following cookies:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| session | Essential | Sign-in status and application functionality | Until you close the browser (content valid for up to 24 hours) |
| remember_token | Essential | Staying signed in on this device | 30 days or until you sign out; the server checks the age of this cookie itself |
| session_token | Essential | Recognising your browser session (free conversions, wizard progress) | 30 days |
| csrf_token | Essential | Protection against cross-site request forgery (CSRF) | 24 hours |
| cookie_consent | Essential | Remembering your cookie choice (also in your browser's local storage) | 1 year |
| _ga, _ga_* | Statistics (only after consent) | Pseudonymised visitor statistics (client ID) and measurement of our own ad campaigns (Google Analytics) | Up to 2 years |
| _gcl_* | Ad measurement (only after consent) | Only if Google Ads conversion measurement is active: measuring which of our own ads led to a visit or sign-up | Up to 90 days |
In addition, the app stores in your browser's local storage: language and theme preference, the wizard step (without transaction data), your cookie choice, whether you turned off the feedback prompt and an invitation code from an invitation link (30 days). The page you arrived from is kept in session storage until you close the tab.
Statistics and ad-measurement cookies (Google Analytics) are only set after you give consent via the cookie banner. Without consent the Google tag script is not even loaded and the site sends no measurement data to Google; fonts are served from our own server, so no page requests anything from Google before you choose. We use the measurement for pseudonymised visitor statistics (a client ID in a cookie, not your name) and to measure the effectiveness of our own advertising campaigns. We show no third-party ads and build no advertising profiles (personalised advertising signals remain disabled). You can change or withdraw your choice at any time via "Cookie settings" at the bottom of every page; when you withdraw, we delete the Google Analytics cookies from your browser and the site stops sending measurement data. Google processes this data under the Google Analytics terms; see Google's privacy policy.
9. Complaints
If you have a complaint about the processing of your personal data, please contact us at statementbridge@fiduro.nl. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl).
10. Data breaches
In the event of a security incident involving personal data, FIDURO will report this to the Dutch Data Protection Authority within 72 hours if the incident poses a risk to the rights and freedoms of data subjects (Art. 33 GDPR). Data subjects will be informed if the incident poses a high risk (Art. 34 GDPR). You can report security incidents to statementbridge@fiduro.nl.
11. Changes
This privacy policy has a version number; the change log is at the bottom of this page. For important changes we show a notice in the application and ask you to confirm the current version at your next export.
Change log
Version 1.2.2 — published 8 October 2026
- Version 1.2.2 contains no change to the privacy notice or the Data Processing Agreement; only the version number has been aligned with the terms and conditions.
Version 1.2.1 — published 29 September 2026, applied until 8 October 2026
- Retention periods clarified: database backups are kept for at most 7 days; deleted data can therefore persist in a backup for at most 7 days. After a restore from a backup, deletions are re-applied.
Version 1.2 — published 29 September 2026, applied until 29 September 2026
- Versioning: version number, publication date and this change log; at your next export we ask you to confirm the new version.
- AI extraction: credit-based AI scan via Mistral AI without a subscription or own key; the number of credits is shown before the scan and refunded if it fails; the same PDF can be re-scanned free of charge up to 2 times within 24 hours. With Pro you use your own Anthropic, OpenAI, Google, Mistral or xAI key under your own agreement with that provider.
- Third parties and sub-processors updated: Cloudflare, Resend, Mistral AI and Google Analytics are now listed; Render is a US company with hosting region Frankfurt. The earlier statements about Mistral (EU servers, no training, 30-day retention, concluded data processing agreement) are withdrawn until FIDURO can substantiate them with the agreement. You can object to a sub-processor within 30 days of publication (Article 7 of the Data Processing Agreement).
- Retention periods per data category and what remains after account deletion (unlinked conversion statistics, invoices kept by law, backups and logs). Source files are deleted after processing and export files are downloadable for up to 24 hours by the account that created them; the earlier wording about immediate deletion was too absolute. New: an upload identity enables a free re-export of the same file with the same amounts within 24 hours.
- Security and cookies described factually: logs may contain personal data; the sign-in cookie (30 days) and local storage have been added; fonts are served from our own server and the Google tag script only after consent; you can withdraw cookie consent via "Cookie settings" at the bottom of every page.
- Data subject rights: the JSON export in the account settings covers the data we hold about you; account deletion requires re-authentication (password or a fresh login link). Articles 5, 6.7, 11 and 12 of the Data Processing Agreement have been adjusted accordingly.
Version 1.1 — applied until 29 September 2026. The text of this version is available on request from statementbridge@fiduro.nl.