Privacy policy

Last updated September 18, 2026.

This policy explains what Domfly LLC (“StatementBatch”, “we”) does with information when you use statementbatch.com. The short version: we don’t store your statements, and we don’t sell anything about you.

Your statement

When you upload a PDF, our server holds it in memory for that one request, sends it to Anthropic to be read, and returns the transactions to your browser. We don’t save the file, the account details or the transactions anywhere — there is no database of statements. The CSV, Excel and QuickBooks files you download are built in your own browser from that result.

If you haven’t paid (or don’t yet have pages left on a plan), the full result is sent to your browser only as encrypted data it cannot read — the key is only handed back once Stripe confirms payment, and your browser decrypts it there. We never store that encrypted data either; your browser keeps it only in this tab’s session storage while you check out, and clears it once you’ve unlocked, cancelled checkout or closed the tab.

Who else handles data, and why

• Anthropic (maker of Claude) reads your statement to extract the transactions. It is the only service that sees statement contents. Under Anthropic’s policy for API customers, it deletes inputs and outputs within 30 days, may keep them for up to 2 years if they are flagged for a violation of its usage policy, and does not use them to train its models by default.
• Cloudflare hosts the service. Your request passes through its network, which processes your IP address and standard request information to deliver and protect the site.
• Sentry receives error reports when something breaks on our servers: the type of error and where in the code it happened. Reports are scrubbed of personal information such as IP addresses, emails and payment links, and never include statement contents.
• Stripe processes payments for the statement pack and the monthly plans. Stripe collects your payment details directly; we never see or store your card number.

What we keep

• Usage counts: how many conversions happened each day, whether each succeeded or failed and why (a category such as “timeout” or “page limit”), and which download formats were chosen. These counts contain no statement contents and aren’t linked to you.
• Page views: which page was viewed, where you arrived from (the referring site and any campaign parameters in the link), and a coarse screen-size band such as “small” or “large”. These are sent to our own analytics service at analytics.lad.is, run by Domfly LLC — the same company that runs this site, not an outside advertising or tracking company. A random id is stored in your browser’s local storage so repeat visits can be counted once rather than twice; it is not linked to your name, your email or your account, and clearing site data removes it. No part of a statement is ever included — not a filename, not a transaction, not an account number.
• Free-plan limits: to enforce the daily free allowance we keep a daily counter tied to a one-way hash of your IP address and to an anonymous cookie id. Counters are only used to enforce the limit and are deleted after the day ends.
• Your email, only if you give it to us (for example to buy a statement pack or subscribe to a monthly plan). We use it to contact you about that plan and your account, and nothing else.
• Account information, if you create an optional account: your name, email address, a cryptographic password hash, verification or password-reset tokens, account role and verification status. We use Mailgun to send transactional verification and password-reset email. We do not store your password in readable form or connect an account to statement contents.
• Entitlements, if you buy a statement pack or subscribe to a monthly plan: your email, which plan you have, how many pages you have left, a dated record of how many pages each conversion used, and the Stripe identifiers (customer, subscription, payment) needed to keep your account and Stripe’s records in sync. This is never your statement content — no filename, no transaction, no account number is ever stored here.

Cookies

We set one first-party cookie with an anonymous id so the free daily limit works, and — only once you buy a pack or subscribe — a second first-party cookie that identifies your entitlement, so your paid pages follow you between conversions. If you sign in, we also set a separate secure, httpOnly session cookie. We don’t use advertising cookies, and no outside advertising or tracking company receives anything from this site. Our own page-view measurement (described under “What we keep”) stores a random id in your browser’s local storage rather than in a cookie.

We don’t sell or share personal information

We don’t sell personal information or share it for advertising, and we don’t use your statements for anything except converting them for you.

Your choices and rights

You can ask us to tell you what personal information we hold about you, including your email, name, account metadata and payment entitlement records; to correct it; or to delete your optional account. Depending on where you live, including California, you may have these rights by law; we honour them for everyone. Email support@domfly.com and we’ll respond within 30 days. We won’t treat you differently for asking.

Security

Connections are encrypted, statements are never written to storage, and access to our systems is limited. No system is perfectly secure, but not keeping statements is the strongest protection we can offer.

Children

StatementBatch is for adults and businesses, and isn’t intended for anyone under 18.

Changes

If we change how we handle data, we’ll update this page and the date above, and email customers about significant changes before they take effect.

Contact

Privacy questions or requests: support@domfly.com.