Privacy Policy

Effective Date: July 31, 2026 · Version 2026-07-31

1. Introduction

StatementPro.ai ("Company," "we," "us," or "our"), operated by Mocsy Inc., is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, store, and protect information when you use the StatementPro.ai website, platform, and related services (the "Service").

Bank statements and financial documents contain some of the most sensitive information there is, and our practices reflect that. This Privacy Policy is incorporated into and subject to our Terms of Service. By using the Service you agree to the collection and use of information as described here.

2. Information We Collect

2.1 Information You Provide

• Account Information: your email address. We use passwordless sign-in (a one-time code sent to your email), so we do not collect or store a password. We do not require your name.
• Uploaded Documents: the bank statements and financial documents you upload for conversion, and the data extracted from them.
• Payment Information: when you purchase credits or a paid plan, billing details are collected and processed by our third-party payment processor (Stripe). We do not store full payment-card numbers.
• Communications: information you provide when you contact us or submit feedback.

2.2 Information Collected Automatically

• Usage Data: how you interact with the Service, including conversions performed and timestamps.
• Device and Log Data: IP address, browser/user-agent, access times, and error/server logs.
• Location Data: approximate geographic location derived from your IP address.

3. How We Use Your Information

• Service Delivery: to process your document conversions and deliver your results.
• Account Management: to create and manage your account, process payments, and provide support.
• Service Improvement: to understand usage, monitor extraction accuracy, and improve the Service. Where this involves the content of your documents, it is limited as described immediately below.
• Communication: to send transactional emails (verification codes, conversion results, receipts) and respond to inquiries.
• Security & Legal: to detect and prevent fraud and abuse, and to comply with applicable law.

Important: We do not sell or share the content of your uploaded financial documents, and we do not use it for advertising, marketing profiling, or to build general-purpose AI models.

How our extraction system learns. Our extraction system improves over time from corrections that users make to extracted data. What it learns from is the structure of a document — where fields sit on the page, how they are labelled, and which label corresponds to which kind of value — not the information those fields contain.

Before any correction is used to improve the system, the underlying content is removed. We do not retain or use your account numbers, transaction descriptions, amounts, dates, or names for this purpose, in any form. The result is that our extraction system gets better at reading documents like yours without our retaining anything about you or the transactions on your statement.

The machine-learning models hosted for us by Amazon Web Services are not trained on your data by AWS. We do not use this process to build a profile of you, to infer anything about you, or to make decisions about you.

4. Data Processing and Retention

4.1 Document Processing

To perform a conversion, your uploaded document is processed on our own extraction platform, operated by Mocsy Inc. Extraction uses machine-learning models hosted for us by Amazon Web Services in its US East region, which means the content of your document is transmitted to and processed on infrastructure located in the United States. AWS does not use your data to train its own models and does not retain your document content for its own purposes.

Processing otherwise takes place on encrypted infrastructure operated for us by the providers listed in Section 6, in Canada and the United States. Documents and data are encrypted in transit (TLS) and at rest (AES-256) and are logically separated from other customers' data. Your converted results are delivered to you by email; where we provide a download link, it remains valid for 30 days.

4.2 Retention Periods

• Uploaded Documents & Extracted Data: retained until you request deletion. We do not currently delete them automatically. You may request deletion at any time (see Section 8.3).
• Converted Output Files: where we provide a download link, the file backing that link is retained for up to 30 days and then deleted.
• Account Information: retained while your account is active and for a reasonable period afterward to meet legal obligations and resolve disputes.
• Usage and Log Data: retained for up to 24 months, then anonymized or deleted.
• Payment Records: retained as required by tax and financial regulations (typically 7 years).

4.3 Data Deletion

You may request deletion of your personal data at any time by emailing hello@statementpro.ai. We action verified requests within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, financial record-keeping).

5. Data Security

• Encryption: data is encrypted in transit (TLS) and at rest (AES-256).
• Access Controls: role-based access limits employee access to data on a need-to-know basis.
• Infrastructure: hosted on enterprise-grade cloud platforms that maintain SOC 2 compliance. StatementPro.ai's own SOC 2 certification is in progress and not yet complete.
• Monitoring & Response: access is logged and monitored, and we maintain an incident-response plan.

No method of electronic transmission or storage is 100% secure, but we are committed to notifying affected users of a data breach as required by law. See our Security page for more. Where your results are delivered by email, the security of that delivery depends in part on your own email provider and the transport between our systems and it, which is outside our control.

6. Our Platform, Sub-processors, and Third-Party Services

We do not sell, rent, or trade your personal information.

6.1 Our own platform

Conversion is performed on our own extraction platform, operated by Mocsy Inc. That processing is internal to us and is not a transfer to a third party. The infrastructure and hosted models that platform runs on are provided by the third parties listed below.

6.2 Third parties we rely on

• Amazon Web Services (AWS): cloud infrastructure, storage, processing, and hosting of the machine-learning models used for extraction (Canada, and United States including the US East region).
• Stripe: PCI-compliant payment processing (United States).
• Cloudflare: content delivery, security, and bot protection (United States).
• HubSpot: customer relationship management and email (United States).
• Google (Analytics / Tag Manager): website analytics, subject to Section 7.

Business customers can review our Data Processing Agreement or request a signed copy at hello@statementpro.ai.

7. Cookies and Tracking Technologies

7.1 Cookies We Use

• Essential: required for the Service to function, including session/authentication and our Cloudflare Turnstile bot-protection challenge. These cannot be disabled.
• Preference: for example, a cookie that remembers your email to prefill the upload form.
• Analytics: we use Google Analytics (via Google Tag Manager) to understand usage and improve the Service.

7.2 Managing Cookies

You can control cookies through your browser settings and opt out of Google Analytics using Google's opt-out browser add-on. Disabling essential cookies may prevent the Service from working.

8. Your Rights

Depending on your location, you may have rights to access, correct, delete, port, restrict, or object to the processing of your personal data, and to withdraw consent. We do not discriminate against you for exercising these rights.

8.1 California Residents (CCPA/CPRA)

Do Not Sell or Share. StatementPro.ai does not sell, rent, or share your personal information for monetary or other valuable consideration, or for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. No opt-out is required; to delete your data, use the process in Section 8.3.

Privacy Notice for California Residents. You have the right to know, delete, correct, opt out of sale/sharing, limit the use of sensitive personal information, and not be discriminated against for exercising these rights.

• Categories collected: identifiers (email); financial information in uploaded documents (account numbers, transactions); internet/network activity (usage); approximate geolocation (IP); device/browser information.
• Purposes: service delivery, security and fraud prevention, and analytics.
• Disclosure: only to the third parties listed in Section 6.2. We do not sell or share personal information.
• Retention: as described in Section 4.2.
• Exercise rights: email hello@statementpro.ai. We respond within 45 days and may extend once by a further 45 days where permitted, notifying you if we do.

Sensitive Personal Information (CPRA). Bank statements contain financial-account information, which is sensitive personal information under the CPRA. We collect and use it solely to perform the conversion you requested and for related security and fraud-prevention purposes — both purposes the CCPA/CPRA permits. It is not used to improve our extraction system: as described in Section 3, only de-identified structural information is used for that. We never use it to infer characteristics about you, and never for profiling, advertising, or building AI models. Because our use of sensitive personal information is limited to those permitted purposes, we are not required to offer, and do not display, a "Limit the Use of My Sensitive Personal Information" link.

8.2 European Economic Area, United Kingdom, and Switzerland

The Service is not offered or directed to, and is not intended for use by, individuals located in the European Economic Area, the United Kingdom, or Switzerland. We do not target these regions and take steps to restrict access from them. If you are located in one of these regions, please do not use the Service.

8.3 Exercising Your Rights

To request deletion or a copy of your data, email hello@statementpro.ai (subject: "Data Deletion Request" or "Data Export Request"). We respond within 30 days, or within 45 days for requests made under the CCPA/CPRA, and may verify your identity by confirming the request comes from the email address on file. Where processing relies on consent, you may withdraw it by submitting a deletion request.

8.4 Canadian Residents (PIPEDA)

StatementPro.ai is operated from Canada by Mocsy Inc. If you are in Canada, we handle your personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. You may request access to or correction of your personal information and may raise unresolved concerns with the Office of the Privacy Commissioner of Canada.

8.5 Quebec Residents (Law 25)

If you are in Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, applies to our handling of your personal information. In addition to the rights described above:

• Person responsible for the protection of personal information. Our Privacy Officer oversees our compliance and handles complaints, and can be reached at hello@statementpro.ai or at Mocsy Inc., 111 Peter Street, Suite 780, Toronto, Ontario M5V 2H1, Canada.
• Consent. Because bank statements contain sensitive personal information, we seek your express consent — separately from your acceptance of our Terms — to process your documents for conversion. No separate consent is sought for improving our extraction system, because that uses only de-identified structural information and not your personal information.
• De-indexing, portability, and correction. You may request that we cease disseminating your personal information, de-index it, correct it, or provide it to you in a structured, commonly used technological format, by contacting us as described in Section 8.3.
• Automated processing. Our extraction technology processes the content of your documents; we do not use it to make decisions about you based exclusively on automated processing.
• Communication outside Quebec. Your information may be processed in Canada and the United States (see Sections 4.1 and 10), with contractual protections in place with recipients.
• Incidents. We maintain a register of confidentiality incidents and will notify you and the Commission d'accès à l'information where an incident presents a risk of serious injury.

9. Children's Privacy

The Service is not directed to individuals under 18 (or the age of majority in their jurisdiction). We do not knowingly collect personal information from children and will delete it if discovered. Contact hello@statementpro.ai with concerns.

10. International Data Transfers

Your information may be processed in Canada and the United States, where our systems and service providers are located. Where personal data is transferred between these countries, we rely on appropriate contractual and organizational safeguards, together with data processing agreements with the relevant service providers.

11. Changes to This Privacy Policy

We may update this Privacy Policy. For material changes we will update the Effective Date above and provide notice through the Service or by email before they take effect. Continued use after changes take effect constitutes acceptance.

12. Contact Us

• Data Controller: Mocsy Inc., 111 Peter Street, Suite 780, Toronto, Ontario M5V 2H1, Canada
• Privacy & Data Requests: hello@statementpro.ai
• Website: https://statementpro.ai