Privacy Policy

Sortlumo is a privacy-first personal finance tool. You upload bank or credit-card statement PDFs and we turn them into categorized transactions you can search, slice, and export. This policy explains exactly what data we collect, why we collect it, who else touches it, and what control you have over it.

The short version:we never link to your bank, we never sell or share your spending data, we don't run third-party tracking on your statements, and you can export or delete everything in your account at any time.

We collect only what's necessary to run the service:

• Account data — your email address and, if you sign up with an email and password, a hashed password (we never see your password in plain text). If you sign up or sign in with Google instead, see Sign in with Google below for exactly what we receive from your Google Account.
• Statement PDFs you upload — stored against your account so you can re-open and re-export later.
• Parsed transactions — date, merchant, description, amount, currency, and the category assigned by our parser. Plus any manual re-categorizations you make.
• Account metadata— names and labels you give your accounts (e.g., "Chase Checking", "AmEx Gold"), institution names, and the last 4 digits of an account if you choose to record them.
• Billing data — if you subscribe, Stripe handles your card details on our behalf. We never see or store your full card number; we receive a Stripe customer/subscription ID and basic status (active, canceled, etc.).
• Operational logs — minimal server logs (timestamps, IPs, HTTP status codes) needed to keep the service running and to investigate abuse. These are retained for up to 30 days unless required longer for security or legal reasons.

We do not collect: bank login credentials (we never link to your bank), behavioral analytics on individual transactions, advertising identifiers, or third-party social-graph data.

We use the data above strictly to deliver and improve the service:

• Parse uploaded PDFs into structured transactions and assign categories.
• Show you summaries, recurring-charge detection, and category breakdowns.
• Authenticate you — with your email and password or with Sign in with Google — and protect your account.
• Process payments and manage your subscription (via Stripe).
• Send transactional email (account verification, password reset, billing receipts) — never marketing email unless you explicitly opt in.
• Investigate and stop abuse, fraud, or service-availability problems.

We do not use your transactions to build a profile that we sell, share, or use for targeted advertising.

To keep Sortlumo lean and reliable, we rely on a small set of vetted service providers. Each one only sees the data it strictly needs to do its job:

• Stripe (payments) — handles card processing, subscription billing, and invoicing. We send Stripe your email and Stripe-customer ID; Stripe handles card data under PCI-DSS Level 1 compliance.
• Resend (email) — delivers transactional email (verification, password reset, billing). We send Resend your email address and the message body.
• Anthropic (Claude) or Google (Gemini) (PDF parsing) — when you upload a statement, the extracted text is sent to one of these AI providers via their API for structured parsing and categorization. Both providers contractually do not use API inputs to train their models. We never send your email, name, or any account identifiers along with the text.
• Vercel(hosting) — runs the application servers. Standard request/response logs (no statement contents) flow through Vercel's infrastructure.
• Google (Sign in with Google) — if you choose to sign in or sign up with Google, Google handles authentication and provides us your basic profile (name, email, and email-verified status); we send Google only the sign-in request. See Sign in with Google for the full details.

We do not share your data with advertisers, analytics vendors, data brokers, or any third party that would use it for purposes other than delivering Sortlumo to you.

You can create your account or sign in using Sign in with Googleinstead of an email and password. It's optional — email-and-password sign-in works exactly the same. When you use it, Google authenticates you and shares a limited part of your Google profile with us.

What we receive from Google. Using only the basic openid, email, and profile scopes, we receive:

• your name (the display name on your Google Account);
• your email address; and
• confirmation that Google has verified that email address, so we can safely match it to your Sortlumo account.

What we do not receive. We never receive your Google password, and we do not request access to your Gmail, Google Drive, Contacts, Calendar, photos, or any other Google service. Sign in with Google gives us your basic profile only — nothing more.

How we use it. We use this information solely to create your account, sign you in, and keep your account secure. We do not use it for advertising, we do not sell or share it, and we do not combine it with data from other sources to build a profile of you.

Revoking access. You can disconnect Sortlumo from your Google Account at any time from your Google Account's third-party connections. If Sign in with Google is your only sign-in method, you'll need it to sign in — reach us via the contact form if you need help regaining access.

Sortlumo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Your use of Sign in with Google is also governed by Google's Terms of Service and Privacy Policy.

Your statements and transactions are stored in our database, scoped to your account. Access is gated by an authenticated session, established when you sign in with your email and password or with Google. We use industry-standard encryption in transit (TLS) and at rest.

Internally, only a small number of authorized engineers can access production systems, and access is logged. We do not browse user data except as strictly necessary to investigate a reported issue or to comply with a lawful request.

No service is 100% secure. If we discover a breach that affects your account, we'll notify you promptly with details and recommended actions.

We use only the cookies and local-storage entries that the service genuinely needs. No third-party advertising cookies, no cross-site tracking pixels.

• Session cookie — issued after you sign in, used to keep you signed in. Expires when you sign out.
• CSRF token — protects forms (sign-in, account creation, billing) against cross-site request forgery.
• Theme preference — a small local-storage entry remembers whether you chose light or dark mode.

You always have full control over your data:

• Export — every account can download all categorized transactions as an Excel (.xlsx) file at any time, on every plan.
• Delete a statement — remove a single uploaded statement (and its parsed transactions) from your account in one click.
• Delete your account — message us via the contact form from the email address on your account and we will permanently delete your account and all associated data within 30 days. Backups are purged on a rolling 90-day cycle.
• Access or correct your data— most data is visible and editable inside the dashboard. For anything that isn't, reach us via the contact form.
• Cancel your subscription — manage or cancel from your account settings; access continues to the end of the paid period.

If you're in the EU, UK, California, or another jurisdiction with specific data-protection rights (GDPR, UK GDPR, CCPA/CPRA, etc.), you have the additional rights guaranteed under those laws — including the right to know what we hold, to request correction or deletion, to object to processing, and to lodge a complaint with your local data-protection authority.

We keep your statements and parsed transactions for as long as your account is active, because that's the whole point of the service — you can re-open a statement you uploaded two years ago. If you delete a statement, it's removed from primary storage immediately and from backups within 90 days.

If you delete your account, we purge your data within 30 days. A few things may persist longer for legal or accounting reasons (billing records, fraud investigations) — but these are isolated from the product and not used for anything else.

Sortlumo is not intended for anyone under the age of 16. We do not knowingly collect data from children. If you believe we have, please contact us and we will delete it.

Sortlumo and its service providers operate primarily in the United States and the European Union. By using the service, you consent to your data being processed in those regions. When data crosses borders, we rely on standard contractual clauses and other approved safeguards.

We may update this policy as the service evolves. When we make material changes, we'll bump the "Last updated" date and, for substantial changes, give registered users notice by email before the changes take effect.