Privacy Policy

1. Who we are

BankScan AI ("we", "us") provides an AI-powered tool that converts bank statements and receipts into spreadsheet formats, and (for MTD-enabled accounts) submits quarterly updates and tax returns to HMRC on your behalf. This policy explains what personal data we collect, how we use it, and who we share it with.

Data controller: Mitoba Consulting Ltd, trading as BankScan AI, is the data controller for the personal data described in this policy. We are responsible for protecting that data and for honouring your rights under UK GDPR.

Contact: mitchellagoma@gmail.com for general queries and data subject requests; security@bankscanai.com for security incidents (see our security policy).

Supervisory authority: the Information Commissioner's Office (ICO) regulates data protection in the UK. You have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint if you believe we have mishandled your data.

2. What we collect

• Account data: email address and a hashed password when you sign up.
• Billing data: Stripe customer ID and subscription status (Stripe stores payment details — we never see card numbers).
• File content you upload: bank statements (PDF/CSV) and receipts (PDF/image) you choose to convert.
• HMRC connection data (MTD users only): your National Insurance Number (NINO), HMRC business IDs, and the OAuth access + refresh tokens HMRC issues us on your behalf. All AES-256-GCM encrypted at rest.
• HMRC submission audit trail (MTD users only): a record of every quarterly update, End of Period Statement, and final declaration we submit on your behalf, retained for at least 6 years per HMRC's vendor recognition rules.
• Usage metadata: parse counts, AI token usage, timestamps, and error logs used for billing, quota enforcement, and debugging.

3. How we use it

• To run the parsing service you asked us to run on your file.
• To submit your MTD ITSA quarterly updates, EOPS, and final declarations to HMRC on your explicit instruction (MTD users only).
• To enforce usage quotas, tier limits, and spend caps.
• To bill for subscriptions and pre-purchased AI credit packs.
• To detect and prevent abuse (rate limits, daily ceilings).
• To send transactional emails (signup verification, account alerts, security notifications). We do not send marketing email.

3a. Lawful basis for processing (UK GDPR Article 6)

Under UK GDPR Article 6, every personal-data processing activity needs a lawful basis. Ours, by purpose:

What we do	Lawful basis	Reason
Run your account (email + password)	Contract — Article 6(1)(b)	Necessary to provide the service you signed up for.
Parse uploaded bank statements / receipts	Contract — Article 6(1)(b)	You uploaded the file specifically for us to parse it.
Store HMRC NINO + OAuth tokens	Contract — Article 6(1)(b)	Necessary to make HMRC submissions on your behalf, which is the service you asked us to perform.
Submit to HMRC on your behalf	Contract — Article 6(1)(b)	Each submission is an explicit user action (you click Submit). The processing is necessary to execute that instruction.
Retain HMRC audit trail for 6 years	Legal obligation — Article 6(1)(c)	HMRC's MTD vendor recognition rules require us to keep an audit trail of every submission for at least 6 years.
Process billing (Stripe)	Contract — Article 6(1)(b)	Necessary to take payment for the subscription.
Rate-limit, abuse detection, security logs	Legitimate interests — Article 6(1)(f)	Necessary to keep the service running for all users. Balanced against minimal-data collection.
Transactional email (verification, alerts)	Contract — Article 6(1)(b)	Necessary to operate the account (e.g. confirming your email is valid).

We do not rely on consent (Article 6(1)(a)) for any of the above — which means we are also not collecting any personal data for purposes that would require your opt-in. We do not run marketing email lists, advertising profiles, or third-party analytics.

4. AI processing & sub-processors

BankScan AI uses third-party AI providers to read the content of your uploaded files. Every bank statement and receipt you upload is transmitted to our AI sub-processor to be parsed. We do not run our own computer-vision or OCR models — parsing is performed entirely by the sub-processor listed below.

Sub-processor	Purpose	Data shared	Location
Anthropic PBC (Claude API)	AI parsing of statements & receipts	Full content of uploaded files	United States
Stripe, Inc.	Payment processing & subscription billing	Email, billing details (card data held by Stripe)	United States / Ireland
Turso / SQLite	Account database	Email, hashed password, usage metadata	Configurable region
Vercel / Railway	Application hosting	HTTP traffic, ephemeral temp files during a parse	US / EU region of your deployment

Anthropic's API terms state that API inputs are not used to train their models by default. See Anthropic's Commercial Terms and Privacy Policy for their full data handling commitments.

5. File retention

Uploaded bank statements and receipts are held only for the duration of the parse request. Once your parsed output has been generated and delivered to you, the source file is deleted from our temp storage. Parsed outputs (Excel/CSV) are tracked so we can clean them up on a schedule (typically within 1 hour).

We do not retain a permanent copy of your bank statements or receipts.

6. Account deletion

You can delete your account at any time by contacting support. Deletion removes your user record, email, password hash, and all usage metadata. Stripe billing records are retained by Stripe in accordance with their own retention policies.

7. Your rights (UK GDPR)

If you are in the UK or EU, you have the following rights over your personal data. To exercise any of them, email mitchellagoma@gmail.com. We respond within 30 days (extendable to 90 for complex requests, with notice).

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17): request deletion of your data. Subject to legal retention obligations (HMRC requires we keep your submission audit trail for 6 years; on account closure we anonymise the user link).
• Right to restriction of processing (Art. 18): ask us to stop using your data while a dispute is being resolved.
• Right to data portability (Art. 20): receive your data in a machine-readable format (we export to JSON/CSV).
• Right to object (Art. 21): object to any processing we do under "legitimate interests" (mainly rate-limiting and security logs).
• Right not to be subject to automated decision-making (Art. 22): we don't make any decisions about you using purely automated processing. AI categorisation suggestions are always user-reviewable before submission.
• Right to lodge a complaint with the ICO: if we mishandle your data, complain at ico.org.uk/make-a-complaint or call 0303 123 1113.

7a. Cookies

We use the minimum cookies needed for the service to function:

• bp_auth — your authenticated session, HttpOnly, Secure, SameSite=Lax. Strictly necessary; no consent banner required under PECR.
• bp_csrf — CSRF protection token (double-submit pattern). Strictly necessary.

We do not use third-party analytics cookies, advertising cookies, or any non-essential tracking. There is no cookie banner because nothing we set requires opt-in consent under PECR / UK GDPR.

8. Children

BankScan AI is not intended for users under 16. We do not knowingly collect data from children.

9. Changes to this policy

We will update this page whenever we change sub-processors or materially change how we handle your data. The effective date above will be updated accordingly.

10. Contact

Questions about this policy or your data: please use the contact form on our support page.