Privacy policy

Ledgerbatch · https://ledgerbatch.com · Last updated: 2026-11-09

This policy explains what ledgerbatch.com (the “service”) stores, why, and how you can remove it. The service cleans up digital bank-statement PDFs and produces a reviewable export. It is operated by an individual developer, not a company.

1. What we store

• Account data: your email address, a password hash (scrypt), and the time you registered and verified your email.
• Statement data you upload: the PDF files, extracted transactions, account identifiers (masked), balances, review corrections, and generated CSV/report exports.
• Session data: an opaque session cookie and its expiry, so you stay signed in.
• Technical logs: IP address and request metadata recorded by our hosting provider and by Cloudflare, used for security and abuse prevention.

2. Why we process it

Only to provide the service you asked for: authenticating you, parsing your statements, keeping your review decisions, and producing exports. We do not sell data, use it for advertising, or use it to train models.

3. Who can see it

Your data is isolated per account: other users cannot list, open, or download your jobs, documents, transactions, or exports. Service operators can access the server and its backups for maintenance and support. Sub-processors involved in delivering the service:

• Cloudflare — CDN, DNS, and network security in front of the site.
• VPS hosting provider — stores the application database, uploads, exports, and backups.
• Email provider — delivers verification and password-reset messages.

4. How long we keep it

Jobs that have not been touched for 90 days are deleted automatically, including their uploads and exports. You can delete a job or your entire account at any time from the app; account deletion removes jobs, files, sessions, and export folders. Encrypted backups may retain deleted data for up to 14 days before they rotate out.

5. Security

Traffic is encrypted with TLS. Passwords are hashed with scrypt, sessions use opaque random tokens (only a hash is stored), and state-changing requests are checked for cross-site origin. No system is perfectly secure; keep your password private and tell us about suspected compromise.

6. Cookies

One essential cookie named bsc_session keeps you signed in. It is HttpOnly, SameSite=Lax, and Secure. No analytics or advertising cookies are used.

7. Your choices

• Access and portability: download your export files from each job.
• Deletion: delete individual jobs, or your whole account, from the app.
• Correction: fix extracted rows in the review screen.
• Contact: [email protected]

8. Children

The service is not intended for people under 18 and we do not knowingly collect their data.

9. Changes

If this policy changes materially we will update this page and, where appropriate, notify you by email. Continued use after a change means you accept the updated policy.

See also the terms of service and refund policy.