Privacy Policy

1. Who is responsible for your data

StatementClear is operated by RemitClear Ltd (company number 17244638, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom). We are the controller of the personal data described in this policy. You can contact us about privacy at hello@statementclear.com.

We act as a controller for the personal data of our account holders, waitlist members, website visitors and prospects. Bank and platform statements that customers upload may contain other people's personal data (for example the names of people who paid you). For that content the customer is the controller and we act as a processor on their behalf, using it only to produce the customer's bank feed.

2. The personal data we collect

• Waitlist data: your email address and, if you choose to share them, your role, how many Xero organisations you manage, and your country.
• Account data: email address and password (stored hashed by our authentication provider).
• Uploaded statements: the bank and platform statements you upload, which may include transaction descriptions, payer and payee names, references and amounts.
• Xero connection data: your Xero organisation and bank account names, and the OAuth tokens that authorise the connection. We never see or store your Xero password, and we never ask for your online banking credentials.
• Usage and device data: log data, IP address and pages visited, used to operate and secure the service.
• Communications: messages you send us and support correspondence.

3. How we use personal data, and our legal bases

• To provide the service and our contract with you (performance of a contract): creating accounts, extracting statement lines, posting your bank feed to Xero, support and billing.
• To contact waitlist members (legitimate interests): if you join the waitlist we use your email to tell you about beta access, launch and pricing. Every email includes a way to opt out, and you can ask us to delete your waitlist entry at any time.
• To run and improve our business (legitimate interests): securing the service, preventing abuse, analytics and product improvement.
• To meet legal obligations (legal obligation): tax, accounting and responding to lawful requests.

Where we rely on consent, you can withdraw it at any time.

4. Who we share data with

We share personal data with service providers who help us run StatementClear, under contracts that require them to protect it: our database, authentication and storage provider (Supabase), our web hosting provider (Vercel), our email delivery provider (Resend), and our AI document extraction provider (Google), which receives statement content solely to extract transaction lines under business terms that do not permit the content to be used to train general-purpose models. Lines you approve are posted to your own Xero organisation through Xero's Bank Feeds API. When paid plans launch, a payment provider will process card details; we will not store full card numbers. We may also share data with professional advisers, where required by law, or in connection with a sale or reorganisation of our business. We do not sell personal data.

5. International transfers

Some of our providers are located outside the UK, including in the United States. Where we transfer personal data internationally, we use an appropriate safeguard, such as the UK International Data Transfer Agreement or Addendum, the European Commission's Standard Contractual Clauses, or transfers to countries with recognised adequacy. You can ask us for more information at hello@statementclear.com.

6. How long we keep data

We keep waitlist data until you ask us to remove it or the waitlist is wound down. We keep account and billing data for as long as your account is active and for a reasonable period afterwards to meet legal, tax and accounting obligations. Uploaded statements are kept only as long as needed to operate your feed: you can ask us to delete them at any time, and they are deleted within 30 days of the end of the relevant subscription except where we must retain limited records by law. We keep web and usage logs for a limited period for security and troubleshooting.

7. How we protect data

We use technical and organisational measures appropriate to the risk, including encryption in transit, encryption at rest, per-account data isolation enforced with row-level security, and least-privilege access for our team. See our Security page for more.

8. Analytics and cookies

We deliberately run the StatementClear website without advertising or cross-site tracking cookies. Our product analytics (PostHog, hosted in the EU) runs in memory only and sets no cookies, and our events contain no personal data. The site keeps a single short-lived entry in your browser's session storage to remember which page you arrived from; it expires when you close the tab. The signed-in application stores a session token in your browser, which is strictly necessary to keep you logged in.

9. Your rights (UK and EU)

Under UK GDPR (and EU GDPR where it applies) you have rights to access, correct, delete or restrict your personal data, to object to certain processing, to data portability, and to withdraw consent. To exercise any of these, contact hello@statementclear.com. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, though we would welcome the chance to resolve any concern first.

10. Australian privacy

Where we handle personal information of individuals in Australia, we comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth): we collect personal information only as reasonably necessary, individuals may request access and correction by contacting hello@statementclear.com, we take reasonable steps to ensure overseas recipients handle information consistently with the APPs, and we comply with the Notifiable Data Breaches scheme. Australian individuals may complain to us, or to the OAIC at oaic.gov.au.

11. Children

The service is for business use and is not directed at children. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. The current version and effective date are shown at the top of this page, and we will give notice of material changes.

13. Contact

For any privacy question or request, contact hello@statementclear.com or write to us at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.