Privacy Policy

1. Who we are

PaperSpend is owned and operated by Galitek LLC, a limited liability company organized under the laws of the Commonwealth of Virginia, United States. For the purposes of the EU and UK General Data Protection Regulation ("GDPR") and similar laws, Galitek LLC is the controller of the personal information described in this policy.

You can reach us about anything in this policy at info@paperspend.com.

2. Information we collect

We collect only what we need to run the Service. We do not ask for, and you should never give us, your online banking username, password or security answers. PaperSpend works only from statement files you choose to upload.

Information you give us

• Account information — your name, email address and a password. We store passwords only as a salted cryptographic hash; we never see or store the password itself.
• Phone number — only if you choose to give it to us, for example in a support request or for account security features.
• Statements and financial content — the PDF files you upload and everything printed on them, which typically includes your name, postal address, the name of your bank or card issuer, partial or full account numbers, statement periods, balances, and transaction dates, amounts and descriptions (including the names of merchants and other people you paid or were paid by).
• Data derived from your statements — the transactions, accounts, merchants, categories and monthly summaries we extract and calculate, plus anything you add or change: corrections, manual entries, account nicknames, custom categories and the merchant rules the Service learns from your corrections.
• Statement passwords — if a statement is password protected, you may enter its password so we can open it. The password is used once, in memory, to read the file and is never stored.
• Communications — the name, email address, subject and message you send through our contact form or by email, and our replies.

Information collected automatically

• IP address and device information — your IP address, browser type and version, and operating system (from your browser's user-agent string). We record these with your sign-in sessions so you and we can spot unfamiliar access, and we use IP addresses to rate-limit sign-in, sign-up and upload attempts and to block abuse.
• Log and diagnostic data — technical records of requests to the Service, timestamps, and error reports. We deliberately keep statement contents, passwords and other sensitive values out of our logs.
• Cookies — a small number of strictly necessary cookies, described in the "Cookies" section below.

Information from third parties

• Google — if you sign in with Google, Google shares your name, email address, profile picture and a Google account identifier with us. We do not receive your Google password or access to your Gmail, Drive or other Google data.
• Stripe — when you subscribe, our payment processor Stripe tells us your subscription status, plan and billing period, and may share limited payment details such as card brand, last four digits, expiry date and billing country. Your full card number is collected and stored by Stripe, never by us.

3. Information about other people

Statements can contain information about people other than you — a joint account holder, someone you sent money to, or a business you paid. We process that information only to provide the Service to you. By uploading a statement you confirm that you are the account holder or are otherwise authorized to upload it and to let us process the information in it as described in this policy.

4. How we use information

We use personal information to:

• Provide the Service — create and secure your account, read your statements, extract and verify transactions, reconcile them against statement balances, detect transfers between your accounts, categorize spending, build your dashboard and produce the exports you request.
• Learn your preferences — remember how you categorize a merchant so future statements are filed the same way. These preferences are yours: they are not used to categorize anyone else's transactions.
• Bill you — process payments, manage subscriptions and enforce plan limits.
• Communicate with you — send sign-in and verification codes, security alerts, receipts, and essential notices about your account or changes to our terms, and answer your questions.
• Keep the Service safe — authenticate you, rate-limit requests, detect and prevent fraud, abuse and security incidents, and debug errors.
• Improve the Service — understand, in aggregate, how features are used and where extraction fails, so we can fix it.
• Meet legal obligations — keep tax and accounting records, respond to lawful requests, and establish, exercise or defend legal claims.

We do not sell your personal information, use your financial data for advertising, build advertising profiles about you, or use the contents of your statements to train our own or anyone else's artificial intelligence models.

5. How we use artificial intelligence

Bank statements come in thousands of layouts, so PaperSpend uses large language models ("AI") provided by third parties, currently including Anthropic and Google, to read them. When you upload a statement, the text of the statement (or, for a scanned statement, images of its pages) is sent to an AI provider to identify transactions; merchant names may be sent to suggest categories.

• We access these providers through their commercial application programming interfaces, under terms that prohibit them from using our customers' data to train their models and that limit how long they may retain it (generally for a short period for abuse monitoring, after which it is deleted).
• AI output is never trusted blindly. Every date, amount and line of text the AI returns is checked in code against the statement itself, and a statement is imported only if its transactions reconcile exactly to its opening and closing balances.
• AI is used only to read and organize your data for you. We do not use it to make decisions that produce legal or similarly significant effects about you, such as credit, employment or insurance decisions.
• Our staff do not read your statements in the ordinary course of business. Authorized personnel may access specific data only where needed to provide support you request, to investigate a security incident or abuse, or to comply with law.

6. Legal bases for processing (EEA, UK and similar laws)

Where the GDPR or a similar law applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you signed up for, including processing your statements and billing you.
• Legitimate interests — to secure the Service, prevent fraud and abuse, fix errors and improve the Service, where those interests are not overridden by your rights.
• Legal obligation — to keep tax and accounting records and respond to lawful requests.
• Consent — where we ask for it, for example for optional marketing emails. You may withdraw consent at any time without affecting processing that took place before.

Transaction descriptions can sometimes reveal sensitive matters (for example, a payment to a clinic, a union or a place of worship). We do not seek to infer or use such information; we process it only as part of the data you ask us to organize, at your direction.

7. How we share information

We share personal information only as described below. We require every service provider to protect it, to use it only to provide services to us, and not to use it for their own purposes.

Service providers (processors)

• Amazon Web Services (AWS) — cloud hosting, databases, encrypted file storage for your statements, and delivery of our transactional emails.
• Anthropic and Google (Gemini), and other AI providers we may engage under equivalent terms — reading statements and suggesting categories, as described above.
• Google — "Sign in with Google", if you choose to use it.
• Stripe — payment processing and subscription management. Stripe's use of your information is also governed by the Stripe Privacy Policy.
• Logging and monitoring providers — collecting error reports and operational metrics so we can keep the Service running. These never receive statement contents.

You can ask us for an up-to-date list of the providers that process your data at info@paperspend.com.

Other disclosures

• Legal requirements — if we believe in good faith that disclosure is required by law, subpoena, court order or other legal process, or is necessary to protect the rights, property or safety of Galitek LLC, our users or the public. Where legally permitted, we will try to notify you first.
• Business transfers — in connection with a merger, acquisition, financing, reorganization or sale of all or part of our business. Any successor will be bound by this policy or will notify you before your information becomes subject to a different one.
• With your direction — for example, when you export your data and share the file yourself.
• Aggregated or de-identified data — statistics that cannot reasonably be linked back to you or any individual.

8. Cookies

We use only cookies that are strictly necessary for the Service to work, so there is nothing to opt in to or out of. The cookie notice only tells you this; once you dismiss it, your browser remembers that and it is not shown again.

• Session cookies — keep you signed in and protect your account against cross-site request forgery. Sign-in sessions expire after a period of inactivity.
• Language preference — remembers the language you chose for the site.
• Security cookies — help detect and limit abusive traffic.

Stripe and Google may set their own cookies on their pages when you check out or sign in with Google; those are governed by their own policies. We do not use advertising cookies or cross-site tracking. If we ever add analytics or other non-essential cookies, we will update this policy and, where the law requires it, ask for your consent first. Where a browser sends a Global Privacy Control signal, we treat it as a valid request to opt out of any sale or sharing of personal information — which, as explained above, we do not do.

You can block or delete cookies in your browser settings, but if you block the session cookie you will not be able to sign in.

9. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy:

• Account, statements and financial data — for as long as your account is open. You can delete an individual statement at any time: its file and the transactions extracted from it are deleted immediately, and only a minimal usage record (with no financial content) is kept so plan limits are counted correctly.
• Statement passwords — not retained at all.
• Verification codes — until they are used or expire, which takes minutes.
• Sign-in session records (including IP address and device information) — until the session ends or expires.
• Logs — for a limited period, generally no longer than 90 days, unless needed longer to investigate a specific security incident.
• Support communications — for as long as needed to resolve your request and for up to 24 months afterwards, so we can follow up on related issues.
• Billing and tax records — for as long as tax and accounting law requires, which is generally up to seven years, even after your account is deleted. These records do not include your statements or transactions.

10. Deleting your account

You can ask us to delete your account at any time from your account settings or by emailing info@paperspend.com from the address on your account. When you do:

• Your account is deactivated straight away and enters a 30-day grace period, during which you can sign in and cancel the deletion. This protects you against accidental or unauthorized deletion. Any active paid subscription is cancelled so you are not billed again.
• At the end of the grace period we permanently delete your account, your uploaded statements, and all transactions, categories, rules and other data derived from them from our production systems.
• Copies in our encrypted backups are overwritten automatically within a further 35 days. Until then they are isolated, not used for any purpose, and restored only in a disaster-recovery event, after which we would re-apply your deletion.
• We keep only what we are legally required to keep, such as billing and tax records, and de-identified data that can no longer be linked to you.

Deletion cannot be undone once the grace period ends. Please export any data you want to keep first.

11. How we protect information

We use administrative, technical and physical safeguards designed for sensitive financial data, including:

• Encryption in transit (HTTPS/TLS) for all connections, and encryption at rest for our databases, file storage and backups.
• Private storage for statement files, which are never exposed at public URLs and can be downloaded only by the account that uploaded them.
• Strict separation of each user's data, enforced in our application and database.
• Hashed passwords, email verification, rate-limited sign-in and automatic sign-out of other sessions after a password reset.
• Least-privilege access for our personnel, and keeping sensitive values out of application logs.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for the security of the devices you use to access the Service. If we become aware of a breach that affects your personal information, we will notify you and the relevant authorities as and when required by law.

12. International data transfers

We and our service providers store and process data on servers in several regions and countries, which currently include the European Union and the United States, and may change as the Service grows. Galitek LLC is based in the United States, and some of our service providers, including our AI, payment and sign-in providers, process data in the United States. As a result, your information may be transferred to and processed in countries other than the one where you live, whose data protection laws may differ from yours. Wherever it is processed, we protect it as described in this policy.

Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision where one exists (including the EU-U.S. Data Privacy Framework and its UK and Swiss extensions for certified recipients) or on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional safeguards where appropriate. You can request a copy of the relevant safeguards at info@paperspend.com.

13. Your privacy rights

Wherever you live, you can use the Service to view, correct, export and delete your data. Depending on where you live, you may also have the legal right to:

• Know what personal information we hold about you and get a copy of it (access).
• Receive your data in a structured, machine-readable format, or have it sent to another provider (portability).
• Correct inaccurate information (rectification).
• Have your information deleted (erasure).
• Restrict or object to certain processing, including processing based on legitimate interests.
• Withdraw consent you have given, at any time.
• Not be subject to decisions based solely on automated processing that significantly affect you — we do not make any.
• Opt out of the sale or sharing of personal information, or of targeted advertising — we do neither.

To exercise a right, email info@paperspend.com from the address on your account. We will verify your identity before acting, which may include asking you to confirm a code sent to that address. You may use an authorized agent where the law allows; we may ask for proof of their authority and confirm the request with you directly. We respond within the time the applicable law requires (for example, one month under the GDPR and 45 days under U.S. state laws, extendable where the law permits).

If we decline your request, you can appeal by replying to our decision with the subject line "Privacy appeal". We will not discriminate against you, or charge you different prices, for exercising your rights.

14. Additional information for the EEA, UK and Switzerland

In addition to the rights above, you have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where you believe an infringement occurred — in the UK, the Information Commissioner's Office. We would, however, appreciate the chance to address your concern first, so please contact us at info@paperspend.com.

15. Additional information for U.S. residents

Residents of California, Virginia, Colorado, Connecticut and other U.S. states with comprehensive privacy laws have the rights described above to the extent those laws apply. For California residents, in the past 12 months we have collected the following categories of personal information, from the sources and for the business purposes described in this policy:

• Identifiers (name, email address, phone number if provided, IP address, account identifiers).
• Customer records and financial information (statement contents, partial account numbers, transaction history, balances, subscription and limited payment details).
• Internet or other electronic network activity (log and device information).
• Inferences limited to the categorization of your own transactions.
• Sensitive personal information, namely account log-in credentials and financial account information, used only to provide the Service you request and for the other purposes permitted by law; we do not use it to infer characteristics about you.

We disclose these categories only to the service providers and in the circumstances described in "How we share information". We have not sold or "shared" (for cross-context behavioral advertising) personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

16. Other regions

If you live in another country — for example Canada, Brazil, Australia, India, Japan or South Africa — you may have rights under local law similar to those described above, and we will honor them as that law requires. Contact us at info@paperspend.com to exercise them.

17. Children

The Service is intended for adults and is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18 (or the age of digital consent where they live, if higher). If you believe a child has given us personal information, contact us and we will delete it.

18. Emails we send

We send service emails, such as verification codes, security alerts, receipts and important account or policy notices, which you cannot opt out of while you have an account. If we send product news or marketing emails, we will do so only where the law allows (with your consent where required), and every such email will include a link to unsubscribe.

19. Third-party websites and services

The Service may link to websites or services we do not operate, such as your bank, Google or Stripe. This policy does not apply to them, and we are not responsible for their privacy practices. Please review their policies before giving them your information.

20. Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version on this page and update the "Last updated" date. If a change is material, we will notify you by email or in the Service before it takes effect, and where the law requires your consent to a change, we will ask for it.

21. Contact us

Questions, requests or complaints about this policy or our handling of your information can be sent to Galitek LLC, attention: Privacy, at info@paperspend.com. You can also use our contact form.