Bankora

Privacy

Privacy notice

Last updated 11 November 2026.

What we collect

  • Account email address, password hash, and verification status.
  • The PDF you upload, extracted transactions, and generated CSV/XLSX files.
  • Conversion metadata: file size, page count, validation results, timestamps.
  • Payment metadata from Stripe: amount, currency, status, and Stripe identifiers. We never store card numbers.
  • Security and operational logs limited to identifiers and outcome codes.

How documents are handled

Uploads are stored privately. There is no public URL for a document. Processing happens in a separate worker; the web request that accepts the upload does not parse it. Document text, transaction descriptions, balances, signed URLs, and access tokens are excluded from logs and analytics. No session-replay or advertising trackers run on authenticated pages, and uploaded documents are not used to train models.

Retention

The original PDF, extracted transactions, and generated exports are deleted 24 hours after upload unless you delete them sooner. You can delete a conversion at any time; access is blocked immediately and physical deletion is retried until it succeeds. Worker temporary files are removed as soon as processing ends.

Payment and minimal audit records are kept separately from document content because accounting, tax, and dispute handling require them. They do not include statement text or transaction descriptions.

Bankora does not take its own backups of uploaded statements or generated exports. The managed database keeps a short operational recovery history; a record removed by retention ages out of it rather than being restored.

Processors

  • Stripe — payments. Card details are entered at Stripe and never reach Bankora.
  • Vercel — application hosting and the private file store holding uploads and exports (United States, iad1).
  • Neon — managed Postgres holding accounts, conversion metadata and payment records (AWS us-east-1).
  • Resend — delivery of verification and password reset email (United States).

Each processor receives only what its role requires. No advertising, analytics or session-replay processor runs on authenticated pages.

Contact

Questions or deletion requests: contact.bankora@gmail.com.