Privacy policy

DocFig collects as little as it can. This policy covers docfig.com and the Bank Statement Converter. Last updated 10 October 2026. Questions about privacy: hello@docfig.com.

Statements you convert

Uploaded statements are processed to produce the conversion you asked for and for no other purpose. If a statement is password-protected, the password you type is used once to open it and is not stored. The statements themselves are not stored, not used to train any model, and not looked at by anyone. The full sequence, including masking of account numbers and the role of OpenAI, is on the Security page.

Information that is kept

• Pro waitlist: the email address you enter, the rough page volume if you choose one, and which page you joined from. Used only to send you news about Pro. Kept until Pro launches and for 12 months after, or until you ask for it to be deleted.
• Contact form and email: your name, email address and message, whether sent through the form or to hello@docfig.com, used to reply. Kept for up to 24 months, or until you ask for deletion.
• Usage limit: a count of pages converted today, stored against a keyed hash of your IP address and the date. Deleted after the day ends.
• Daily usage totals: counts of visits and conversions as daily totals, with no IP addresses and no file content, and no cookie needed. Per day: page views per page, unique visitors (counted with a hash under a random value that is replaced daily, then deleted with that day's hashes), uploads, conversions and their outcome by error type, pages converted, processing cost, limit refusals, the referring website's domain name and the country Cloudflare reports. Kept as totals, without any per-person record.
• Returning visitors: a keyed hash of the random df_vid cookie, with the first and last day it was seen. Used only to count new and returning visitors. Deleted after 13 months without a visit, or straight away when you turn visitor counting off.
• Server logs: IP address, time, requested address, status and size for each request, kept for 14 days for security and troubleshooting.

The legal basis is the performance of the service you request (conversions and replies) and legitimate interest in keeping the service secure and within its free limits, and in knowing whether it is used (counts, daily totals and logs). The waitlist is based on your consent, which you can withdraw at any time.

Cookies

Up to three first-party cookies are set. A session cookie holds a random security token that protects forms and uploads from being sent by other websites; it ends when you close the browser. A visitor cookie, df_vid, holds a random ID so DocFig can count how many visitors return on a later day; the server keeps only a keyed hash of it with the first and last day seen, and deletes it after 13 months without a visit. If you turn visitor counting off, a third cookie, df_optout, remembers that choice. There are no advertising cookies.

You can turn off visitor counting at any time: the cookie and its record are deleted and no new ID is set. Global Privacy Control and Do Not Track signals are honoured automatically. The daily totals above keep counting without any cookie. Details are in the cookie notice.

Service providers

• Cloudflare carries traffic to and from the site, protects it from attacks, and forwards email sent to hello@docfig.com.
• Netcup provides the server that runs DocFig.
• OpenAI receives the masked text of uploaded statements through its API to extract the transactions.
• Amazon Web Services sends email from hello@docfig.com, including the notification when a waitlist or contact form is submitted.
• Hostinger hosts the mailbox where messages to hello@docfig.com and form notifications are received.

No information is sold or shared for advertising.

Your rights

You can ask for a copy of what is held about you, ask for it to be corrected or deleted, or object to its use. Email hello@docfig.com from the address concerned. Because uploaded statements are not kept, there is nothing to retrieve or delete for a conversion once it has finished. You may also complain to your local data protection authority.

Changes

If this policy changes, the new version appears here with a new date. A change that affects how statements are handled will appear on the Security page first.