Privacy policy

1. Overview

PivotBank (“we”, “us”, or “our”) operates this website, the PivotBank app for Android and associated services. We are committed to protecting your privacy. This policy explains what information we collect, how we use it, and your rights regarding your data. PivotBank is operated by Muhammad Gulraize Bilal Ltd, a company registered in England and Wales under company number 15584684, whose registered office is 8 Beechfield Street, Manchester, M8 0SG, United Kingdom. That company is the data controller for the purposes of this policy.

The core principle: On the website, your PDF is opened and read on your device, and the file itself is never uploaded. The transaction lines are sent to be read by an AI model, and your name, postal address, account number, IBAN and sort code are removed before they reach it. Our own rules read every statement first, and where their reading proves out against the statement’s own balances it is the one you get, but the lines are sent either way. The Android app differs in one step: a phone has no PDF reader the app can use, so the app uploads the file to our server, which takes the text out of it and keeps no copy of the file. Section 3 sets out exactly what is sent, from the website and from the app.

What we keep: the rows read from a statement (never the PDF itself) are kept on our servers for 7 days so you can come back to them, and are then deleted, unless you unlock the statement or convert it with Pro. An unlocked statement is kept so you can download it again, and you can permanently delete a saved statement at any time from your account.

2. Information We Collect

2.1 Account Information

If you create an account, we collect your name and email address. You may sign in via Google OAuth or with an email and password. We do not store plain-text passwords, credentials are hashed using industry-standard algorithms.

2.2 Usage Data

We record the number of pages converted, with a timestamp, to understand usage and to prevent abuse. We store only a page count and a timestamp, never the content of your statements.

2.3 Anonymous Session Identifiers

For unauthenticated users we generate a short-lived anonymous session ID stored in your browser’s local storage. This is used solely to attribute conversions to one browser and to prevent abuse, and is not linked to any personally identifiable information.

2.4 Cookies & Analytics

We use essential cookies for authentication and session management. With your consent, we also use Google Analytics (with IP anonymisation enabled) to understand how visitors use PivotBank. Analytics cookies are only loaded after you click “Accept All” on the cookie banner. If you choose “Essential Only”, no analytics data is collected. See our Cookie Policy for full details.

2.5 Statements you convert

When a statement is read, we store what was read from it: the transactions (dates, descriptions, amounts and balances) and details found on it, such as the file name, the bank name, the account number and the statement period. That is what lets us show you the first rows and open the rest when you unlock it. We never store the original PDF file. A statement that is not unlocked is deleted 7 days after it was read. An unlocked statement, or one converted with Pro, is kept so you can download it again, and you can permanently delete a saved statement at any time, which removes it from our database. This data is encrypted at rest.

2.6 Emails

We send the emails your account needs, such as verifying your address and receipts. We send product tips and the occasional offer only if you ticked the box when you signed up or turned it on in your account, and we record when you did. You can turn it off at any time on your account page, and we stop straight away.

3. Your Bank Statement Data

On the website, when you drop a PDF into PivotBank, the file is opened and read by your browser’s local JavaScript engine. Text extraction and spreadsheet generation happen on your device, and the PDF file itself is never uploaded to us or to anyone else. A scanned page is the exception: it has no text to extract, so it is rendered as an image on your device and that image is sent to be read, under the same rules as the transaction lines in section 3. Where a bank prints a description as a small picture rather than as text, as FNB does for some of its fees, only those pictures are cut out on your device and sent, never the rest of the page. And where a page’s rows do not add up after reading, that page may be drawn on your device, cut down to its table of transactions (nothing above or below it), and that picture read the same way, so the figures can be checked against the page. Where our own rules can read the statement and prove the result against its own balances, that reading is the one used, even though the lines were also sent. Where they cannot, the model’s reading is used instead. That reading is checked against the statement’s own balances before it is used, and where the check fails the lines are sent again to a second, more careful model, so a statement may reach more than one provider.

What is sent is the transaction table only: dates, descriptions, amounts and balances. Your name, postal address, account number, IBAN, BIC and any card numbers are stripped out first, and everything above the transaction table on every page is removed with them. Every request that carries statement content goes out with an instruction about what may be kept of it, and that instruction is zero data retention: the request goes only to a provider that states it keeps neither the prompt nor the response and trains on neither, and where no such provider serves the model the request fails rather than being handed to one that retains it. The separate step that labels transactions with a category is held to the same rule. We keep no copy of the request itself, but the rows read from your statement are kept on our servers for 7 days, or until you delete them if you unlock the statement, as section 2.5 sets out.

In the Android app

The app reads a statement the same way, with one extra step at the start. A phone has no PDF reader the app can use, so the app uploads the PDF over HTTPS to our server. The server takes the text out of each page in memory, with the same reader the website uses, and sends that text back to the phone. The file is not written to disk, stored or logged, and nothing of it is kept once the text has been sent back. From there the app sends the page text to be read exactly as the website does, and the identifying details listed in this section are removed before anything reaches an AI model.

A page with no text, such as a scan, is turned into an image on the phone, and that image is sent to be read, as on the website.

If you use the app without an account, it keeps the list of statements you have converted, and the key that opens each one, on your phone, and it knows you by a random ID that it makes once and keeps on the phone. That ID is not linked to your name or email. If you sign in later, those statements can be moved into your account.

The app shows no advertising, does not use your device’s advertising ID, and contains no analytics or crash-reporting tools. Google Analytics, which the website uses only with your consent (section 2.4), is not part of the app.

4. Third-Party Services

4.1 Stripe

Payments on the website (statement unlocks, the Pro subscription and page packs) are processed through Stripe. Your payment details are collected and stored by Stripe directly; we never see or store your card number. Stripe’s privacy policy is available at stripe.com/privacy. Purchases in the Android app go through Google Play instead, as section 4.4 describes.

4.2 Google OAuth

If you choose to sign in with Google, we receive your name and email address from Google’s OAuth service. We do not receive access to your Google Drive, Gmail, or any other Google service data. In the Android app, signing in with Google goes through Android’s Credential Manager to the same Google sign-in, and we receive the same name and email address.

4.3 The models that read statements

Statements that cannot be read on your device are read by an AI model. Only the transaction table is sent, with the identifying details listed in section 3 removed first, and every request carries an instruction about what may be kept of it. The reading is provided through OpenRouter, Inc., which is a processor for this purpose and which routes the request to the provider that serves the model performing it, currently Microsoft Azure for OpenAI’s models and Google Cloud for Google’s Gemini models. We mark every request for zero data retention, which sends it only to a provider that keeps neither the prompt nor the response and trains on neither, and where no such provider serves the model the request is refused rather than routed to one that retains it. OpenRouter states that it stores only metadata about each request, such as the model, the token count and the cost, and not its content unless the account holder turns on prompt logging, which we have not; its privacy policy is at openrouter.ai/privacy. Where no model will read a statement, the reading falls back to our own rules, which run on our server and send nothing further. The step that labels transactions with a category is held to the same rule as the reading itself. We cannot independently verify how long any provider keeps a request, which is why we send as little as we can rather than rely on it. The full list of processors, and the country each is in, is on our sub-processors page at /sub-processors.

4.4 Google Play

Purchases in the Android app (the Pro subscription, a statement unlock and page packs) are made through Google Play Billing. Google Play takes the payment itself, under its own terms and privacy policy, and we never see your card or other payment details. Nobody stands between Google Play and us: our server asks Google Play directly what was bought. To do that, the app attaches our internal ID for your account to the purchase (nothing is attached if you buy as a guest), and Google Play gives us the purchase and subscription record, such as the product, the dates and the order ID. We do not send Google Play your name, your email address or anything from your statements for this. A subscription bought in the app is managed and cancelled in Google Play.

4.5 ChatGPT and other connected apps

You can connect PivotBank to ChatGPT, or another app that supports it, to convert a statement there. You sign in on pivotbank.app and approve the app, which never sees your password. When you ask it to, the app sends us the statement file you shared with it, and we read it exactly as on our website and keep it under the same rules as in section 2.5. We send the app what you asked for: the transactions, the balance check or a spending summary, and a link to the statement on PivotBank. What happens to that answer inside the app is covered by the app provider’s own privacy policy (for ChatGPT, OpenAI’s). The app holds a sign-in token for your account that expires after one hour and is renewed with a refresh token that lasts up to 90 days. You can disconnect an app at any time on your account page, which deletes its tokens immediately.

5. Data Retention

Account data (name, email, unlock history) is retained for as long as your account is active. Conversion count records (page counts and timestamps, no content) are retained for 30 days for limit-enforcement purposes.

You may delete your account at any time from the Account Settings page. Upon deletion, all your personal data is permanently removed from our systems within 30 days.

In the Android app you can delete your account yourself: open the account screen and tap Delete account. It is the same deletion as on the website: your account and every statement saved to it are deleted. Deleting your account does not cancel a subscription bought through Google Play, so cancel that in Google Play as well.

6. Data Security

We use industry-standard security measures including HTTPS encryption for all data in transit and encrypted storage for data at rest. Access to production databases is restricted to authorised personnel only.

7. Your Rights

Depending on your jurisdiction you may have rights including: access to your personal data, correction of inaccurate data, deletion of your data, portability of your data, and the right to object to certain processing.

To exercise any of these rights, contact us at [email protected].

8. Children’s Privacy

PivotBank is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected such information, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of PivotBank after changes constitutes acceptance of the updated policy.

10. Contact

If you have any questions about this Privacy Policy, please contact us:

• Email: [email protected]
• Contact form: /contact