Privacy Policy

Last updated 2026-10-27

This policy explains what BankXL (Zijian Xiao, China) collects and why.

What we collect

• Account: your email address and a scrambled (hashed) version of your password. We cannot read your password.
• What you add:
  • Uploaded PDFs, extracted tables and corrections: produce your private preview and exports; automatically deleted within 24 hours
• Account usage: when you signed up and, if this product records it, when you first converted your first PDF into a reviewable result. We use these times to understand whether the product is helpful.
• Payments: handled by Creem, our merchant of record. We never see your card details; we receive your email, what you bought, and the payment status.
• Payment identifiers: Creem order, subscription and transaction IDs and their internal account association, used for accounting. These are pseudonymous identifiers that can be linked to a person.
• Technical: your IP address, used briefly to stop abuse (for example too many sign-in attempts).

Cookies

We use only first-party cookies: one keeps you signed in, one protects forms, one remembers which link first brought you here, and a random browser cookie lasts up to 90 days to count returning browsers once per UTC day. Daily browser digests change each day. We filter known robots and exclude configured test accounts. Page views and daily browser counts do not store your IP address. No advertising cookies and no tracking across other sites.

Who processes data for us

• Creem (payments and invoices)
• Our email provider (account and service emails)
• Our hosting provider (where the service runs)

We do not sell your data.

The operator's internal root sync process receives daily counts and payment records with raw payment identifiers for reconciliation. The operator's Radar business dashboard receives daily counts and payment records with hashed identifiers for business reporting. Both receive payment records without email addresses or the content you add. Hashing these identifiers does not make them anonymous.

How long we keep it

Uploaded PDFs, extracted text, previews, corrections and results are processed on this server and automatically deleted within 24 hours. We do not send this content to third-party conversion or AI services. Scheduled cleanup runs every minute; access expires sooner than 24 hours. Edits and full-file upgrades do not reset expiry. You can delete a conversion immediately from its preview. Keep your own download.

Account and payment records follow the separate retention rules below. Do not include uploaded content in service logs or backups.

Creem and the operator retain accounting records, including payment identifiers and the internal account association, for as long as required by law, even after account deletion. These account-data and accounting retention periods also apply to the operator's internal sync process and Radar dashboard, including raw or hashed payment identifiers.

Your rights

You can see, change or delete your data from your account, or ask us at m4ra7h0n@gmail.com.