Privacy policy

This policy explains what personal data Rowkeel (rowkeel.com) processes, why, and what rights you have. In short: the statement files you convert are processed on your device and are not uploaded to our servers. The limited data we do process is listed below, together with how long we keep it.

Who we are

The controller of your personal data is Individual Entrepreneur Roman Pastushenko, an individual entrepreneur registered in Georgia, registration number 306388361, address 3 Fonichala settlement, building 5, entrance 2, floor 4, Tbilisi, Georgia.

Contact for anything about privacy: support@rowkeel.com. We answer requests within one month.

Your statement files

The PDF statements you convert are processed in your browser on your device. The file, its password, its text, the transactions, amounts and balances are not sent to our servers, and we do not store them. The security page explains how you can check this in your browser.

What we process and why

Purpose	Data	Legal basis (GDPR Art. 6)	How long
Free conversion limit and plan check	page count; a pseudonymous hash of your IP address made with a salt that changes every calendar month; when you are signed in, or for Pass and Pro, your account token (linked to your account)	legitimate interests (fair access to the free plan); contract for paid plans	until the end of the calendar month (UTC)
Abuse protection	request counts per hashed IP address	legitimate interests (keeping the service available and secure)	up to 2 days
Diagnostic reports	the fields listed under “Diagnostic reports”; country code; a daily pseudonym	consent in the EEA and Switzerland; elsewhere legitimate interests (finding and fixing conversion errors)	90 days
“This row is wrong”	bank layout, layout version, reason, app version	legitimate interests (improving accuracy)	90 days
“Send page layout”	masked page layout; bank name, country and email only if you type them	consent (you send it with an explicit click)	90 days
Usage statistics	anonymous events, no user id, no cookies	consent in the EEA and Switzerland; elsewhere legitimate interests (understanding how the product is used)	90 days
Page-view statistics	page address, referrer, browser type and country, collected by a cookieless analytics service of our hosting provider, which necessarily sees your IP address to deliver it	consent in the EEA and Switzerland; elsewhere legitimate interests (understanding which pages are used)	per the provider’s retention for this service
Account and paid plan	account id, email address (held by our authentication provider), plan, subscription status, payment and subscription ids, monthly page count for fair use	contract; legal obligation for records we must keep	while your account exists
Conversion history (Pro)	file name (can be turned off), date, bank, pages, balance-check status, format	contract	12 months, or until you clear it
Support	your emails and our replies	legitimate interests (answering you); contract for paid plans	up to 24 months after the conversation ends
Keeping a deleted account deleted	a one-way hash of the deleted account id and the deletion date	legitimate interests (making deletion stick)	kept indefinitely; it does not identify you without your account id
Refund checks after deletion	monthly page counts, stored under the one-way hash of the deleted account id	legitimate interests (checking refund and withdrawal requests)	13 months

Where we rely on legitimate interests, we have weighed them against your interests: the data is limited, does not include your statement, and the hashed or anonymous records do not identify you on their own. Account, plan, history and any email you type do identify you; we use them only for the purposes above. You can object at any time (see “Your rights”). Where we rely on consent, you can withdraw it at any time.

Providing data is not required by law. Account and payment data are needed to sell you a paid plan; without them we cannot provide it. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Free conversion limit and IP hashing

Without an account you can convert 5 statements per calendar month (UTC); signed in with a free account, 15. A file over 30 pages counts as one statement for every 30 pages or part of them. To count them without an account, our server turns your IP address into a one-way hash combined with a random value (a “salt”) created each calendar month. We store the hash and the count, not the IP address. When you are signed in, the count is kept under a hash of your account ID made with the same monthly salt. The salt and the counters are deleted after the month ends, which is designed to stop a hash from being linked to another month or turned back into an IP address.

What the page sends for this:

• pages: number of pages in the file
• authorization: your account token, only if you are signed in or bought Pass or Pro

Diagnostic reports

When telemetry is on (see “Telemetry settings”) and a conversion fails or is only partly successful, and for a random 2% of successful conversions, your browser sends us an automatic diagnostic summary. It tells us which step had trouble with which layout, so we can fix it without seeing your statement. It is built in your browser from a fixed list of allowed fields, and our server rejects anything outside that list. It contains only:

• schemaV: format version of the fingerprint
• engineVersion: parser version
• appVersion: website version
• bankId: bank layout id from our public list (or "generic")
• profileVersion: version of that bank layout
• outcome: ok, degraded or failed
• recon: balance check result: verified, mismatch or unverifiable
• codes: up to 16 failure codes from a closed list, with small counters (capped at 999), page rotation, export format and number shapes
• pages: page count as a range: 1, 2–5, 6–20 or 21+
• pageSize: A4, Letter, Legal or other
• rotation: page rotation: 0, 90, 180 or 270
• itemsPerPage: how many pages fall into each text-density range
• fontsCount: number of fonts, as a range
• headerWords: column header words, only words from our public header dictionary (such as Date, Description, Balance)
• columnCount: number of columns
• columnX: column positions as a share of page width, rounded to 0.05
• dateShapes: date formats such as DD.MM.YYYY, from a closed list
• moneyShapes: amount formats with every digit replaced by 9, for example -9.9 or 9,999.99
• decimalsHist: how many amounts have 0 to 4 decimals, as ranges
• currencies: up to 4 currency codes from a closed list
• rowsFound: number of rows found, as a range
• datedLines: number of dated lines, as a range
• skipped: number of skipped rows, as a range
• lowConfidence: number of low-confidence rows, as a range
• hypothesis: which parser path was used: bank layout, generic, or bank layout then generic
• detectScore: bank detection score (two decimals)
• secondScore: score of the second-best bank match (two decimals)
• order: whether rows run oldest-first or newest-first
• breakRowIndex: row number where the running balance first breaks (capped at 999)
• breakCount: number of balance breaks (capped at 999)
• deltaClass: type of balance difference: sign, missing row, digit or total only
• deltaBucket: order of magnitude of the difference, for example 10–99
• sampled: true when this was a random sample of a successful conversion

It does not contain:

• the PDF file or any part of its text
• amounts and balances
• names, addresses and transaction descriptions
• account, card or IBAN numbers, even masked
• file names and PDF passwords
• error messages and stack traces

To see how many different people hit the same problem on a given day, we store with each report a short hash of your IP address and that day’s salt (reporter_day). The salt is deleted after one day; after that we cannot link this pseudonym across days or turn it back into an IP address. We also store a two-letter country code derived from your connection. Reports are kept for 90 days. Until the salt is deleted, the data is pseudonymous. In the European Economic Area and Switzerland our legal basis is your consent. Elsewhere it is our legitimate interest in the quality and security of the service. See “Telemetry settings”.

Feedback and layout reports

• “This row is wrong”. Sends only the bank layout id, its version, one reason from a fixed list and the app version. No row number, text, date or amount.
• “Send page layout”. Only after you click the button, see a preview of what will be sent and click Send again. Letters in the layout are replaced by a or A and digits by 9, except common column header words and the bank name. Please check the preview before sending. You may add a bank name, a country and an email address so we can tell you when your bank is supported. The email is used only for that message.

Fields of a row flag:

• bankId: bank layout id
• profileVersion: version of that bank layout
• issue: one reason from a fixed list: wrong amount, wrong date, wrong sign, not a transaction, split row
• appVersion: website version

Fields of a layout report:

• skeleton: the masked page layout you saw in the preview (first 3 pages at most): positions and sizes of text pieces, every letter replaced by a or A and every digit by 9, except header dictionary words and the bank name
• code: which screen the report came from (for example "not a statement")
• appVersion: website version
• bankName: bank name, only if you typed it
• country: country, only if you typed it
• email: email address, only if you typed it, so we can tell you when the bank is supported
• markup: beta banks only: for each line of the masked layout, its line number and whether you ticked it as a transaction (no text)
• issue: beta banks only: one problem type from a fixed list: missing rows, wrong amounts, wrong dates, wrong sign
• bankId: beta banks only: bank layout id
• profileVersion: beta banks only: version of that bank layout

Both are kept for 90 days and then deleted automatically.

Usage statistics

We count anonymous product events. They are sent without cookies or sign-in credentials and contain no user id, IP address, amounts, file names or statement text. They are kept for 90 days. Each event holds at most:

• ts_hour: date and hour (no minutes or seconds)
• event: event name, such as file_dropped, parse_ok, export or pricing_view
• page_type: type of page (home, bank, format)
• bank_id: bank layout id
• pages_bucket: page count as a range
• status: balance check result or error code
• format: export format
• plan: free, pass or pro
• reason: failure code from the closed list
• product: product chosen at checkout
• disabled: whether an option was turned off
• locale: site language
• country: country code derived from the connection (two letters, not the IP address)

We also measure page views with a cookieless analytics service provided by our hosting provider. Its script loads only while telemetry is on.

Telemetry settings

Telemetry means three things: product events (usage statistics), automatic diagnostic reports, and the page-view analytics script. None of it contains your statement, amounts, names, account numbers or file names. Diagnostic reports carry a daily pseudonym, described above.

Whether telemetry is on depends on where you are, which our server works out from your connection’s country. We do not store the country for this.

• European Economic Area and Switzerland: off until you turn it on with “Help improve Rowkeel” under the upload area. If we cannot tell where you are, we treat you as being in this region.
• United Kingdom and everywhere else: on, and you can turn it off with the same switch.
• Do Not Track or Global Privacy Control: if your browser sends either, telemetry is off in every region unless you turn it on with the switch.

Nothing is sent before your region is known. Your choice is kept in this site’s localStorage as sc_telemetry (on or off). Storing it is strictly necessary to respect your choice, and it is never sent to us. You can change it at any time; turning it off stops further sends; page-view analytics stops from the next page you open. We cannot delete data already sent, because we cannot tell which records came from you; it is deleted after the periods above.

The converter works the same with telemetry off. The free conversion limit check and anything you choose to send (a row flag or a page layout) are not telemetry and still work.

Accounts and payments

You need an account only to buy Pass or Pro. Accounts are managed on a separate site, app.rowkeel.com.

• Sign-in. Our authentication provider processes your email address and sign-in details on our behalf.
• Payments. Our payment provider is the merchant of record: it sells the plan to you, charges you, issues invoices, handles tax and issues refunds. It acts as an independent controller of your payment and billing data under its own privacy policy. We do not receive your card number. We receive customer, subscription and payment ids and the payment status.
• What we store. Your account id, plan, subscription status and period, payment provider ids, monthly page count for fair use, your file-name setting and, for Pro, the conversion history:

• user_id: your account id from our sign-in provider
• created_at: date and time of the conversion
• file_name: file name (you can turn this off in account settings)
• bank_id: bank layout id
• pages: number of pages
• status: balance check result
• format: export format

You can turn off file names, clear the history or delete your account in your account settings. Deleting the account cancels any subscription, then deletes our account records and your sign-in account. We keep a one-way hash of the deleted account id so that a late payment notification cannot recreate it, and your monthly page counts under that hash for 13 months so that we can check refund and withdrawal requests. The payment provider keeps its own transaction records as the law requires.

Cookies and local storage

The converter pages set no cookies. If you sign in, our authentication provider sets cookies on the account site that are strictly necessary for signing in and keeping you signed in. Because these are strictly necessary and we use no advertising or analytics cookies, we do not show a cookie consent banner. Your browser may also send these cookies to the main site; we do not read or log them there.

The converter stores a few values in your browser’s localStorage. They stay on your device except where noted:

• sc.quota: free statements used this month, so the limit works offline
• sc.entitlement: your Pass or Pro token, if you bought one
• sc.lastFormat: the export format you used last
• sc.csv: your CSV settings (separator, decimal mark)
• sc.signedIn: whether you are signed in, so Pricing links straight to checkout
• sc.plan: your current plan (Pass or Pro), so Pricing does not offer what you already have
• sc.returnTo: the page you left to buy a plan, so you come back to it (kept for one hour)
• sc.activated: a one-time note that your new plan is active
• sc_telemetry: your choice on the "Help improve" switch ("on" or "off"); strictly necessary to respect it, never sent

The plan token is sent with the free-limit check so the server can apply your plan. sessionStorage is not used. For offline use, the site keeps copies of its own pages, scripts and fonts in your browser’s cache, not your files or results. You can delete all of this by clearing site data in your browser.

Processors and international transfers

We share personal data only with these categories of recipients, each bound by data processing terms or acting as an independent controller:

Recipient	Role	Purpose
Hosting, content delivery and email forwarding provider	processor	running the site and database, security, page-view statistics, forwarding support email
Authentication provider	processor	sign-in and accounts
Payment provider	independent controller (merchant of record)	selling plans, payments, invoices, tax, refunds
Authorities or professional advisers	independent controllers	only where required by law or to establish or defend legal claims

Some of these recipients are based in, or process data in, the United States and other countries outside the EU, UK and Georgia. Where a country has no adequacy decision, transfers rely on the Standard Contractual Clauses (with the UK addendum) in the provider’s data processing terms or, where the provider is certified, on the EU-US Data Privacy Framework and its UK extension. You can ask us for the names of the providers and a copy of the relevant safeguards at support@rowkeel.com.

Retention

• Free-limit counters and their monthly salt: until the end of the calendar month (UTC), then deleted automatically.
• Abuse-protection counters: today and yesterday only.
• Diagnostic reports, row flags and layout reports, including any email you typed: 90 days.
• Usage events: 90 days.
• Conversion history: 12 months, or until you clear it.
• Account, plan and payment ids: until you delete your account.
• Monthly page counts: 13 months; after account deletion they are kept under the one-way hash of the account id.
• Payment and invoice records: kept by the payment provider as required by tax law.
• Backups of our database may hold deleted data for a limited period until they are replaced.

Your rights

Under the GDPR and the UK GDPR you have the right to access your data, to correct it, to have it deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Write to support@rowkeel.com, preferably from your account email. We may ask you to confirm your identity. We answer within one month; for complex requests this can be extended by up to two further months, and we will tell you if so.

Much of what we hold is not linked to you. We do not store IP addresses or names in our database. Our hosting provider processes IP addresses in its network to deliver and protect the site. For hashed or anonymous data we may not be able to identify “your” records; we will tell you if so.

Complaints

You have the right to complain to a data protection supervisory authority: in the EU, the authority of the country where you live or work; in the UK, the Information Commissioner’s Office (ICO); in Georgia, the Personal Data Protection Service. We would appreciate the chance to sort it out first at support@rowkeel.com.

EU and UK representative

We have not appointed a representative in the EU or the UK. You can contact us directly about any privacy question at support@rowkeel.com.

Georgian law

As an operator registered in Georgia, we also process personal data in line with the Law of Georgia on Personal Data Protection. The supervisory authority in Georgia is the Personal Data Protection Service.

US residents

We do not sell or share personal information, as those terms are defined in US state privacy laws, and we do not use it for targeted advertising. We process the categories of personal information described above (identifiers such as email and account ids, commercial information about your plan, and internet activity such as anonymous usage events) for the purposes described above. Depending on your state, you may have the right to know, access, correct and delete your personal information, and not to be discriminated against for using these rights. Write to support@rowkeel.com; an authorized agent may contact us for you with proof of authorization. We treat Global Privacy Control as described in “Telemetry settings”.

Google Sheets add-on

The Google Sheets add-on is not available yet. Before it launches, this section will list the permissions it asks for and the data it touches.

Children

The service is a business tool for adults. It is not meant for anyone under 18, and we do not knowingly process children’s data. If you believe a child has given us personal data, contact us and we will delete it.

Changes

If we change this policy, we update the date at the top. If a change matters for how we use your data, we will say so on the site and, if you have an account, by email before it takes effect.

Contact

support@rowkeel.com