Privacy Policy

This Privacy Policy applies to the RasterLift website, account area, document-processing workspace, and related support communications (collectively, the "Service"). RasterLift is a software service for converting bank and credit-card statements into review-ready transaction tables and CSV or Excel exports.

RasterLift is responsible for the personal information it decides to collect and use through the Service. Questions or requests can be sent to support@rasterlift.com. This policy does not replace the separate privacy notices of payment, authentication, OCR, or other providers when you interact directly with them.

Depending on how you use RasterLift, we collect:

• Account information: email address, authentication identifiers, session information, account status, plan, and preferences.
• Uploaded document data: the files you choose to upload, their display names, file type and size, page count, and private storage reference.
• Extracted and edited data:OCR output used during processing; normalized transaction dates, descriptions, amounts, balances, confidence values, statement summaries, review flags, and corrections you make.
• Usage and operational data:processing status, page usage, export actions, error codes, request identifiers, rate-limit records, and security or diagnostic logs.
• Billing data: plan and subscription status, billing period, product, checkout, customer, subscription, invoice, and event references received from Creem. RasterLift does not store complete payment-card details.
• Communications: information you send to support or voluntarily enter into live chat. Do not send bank statements, account numbers, passwords, or transaction data through support email or live chat.
• Optional marketing-page data:if you accept optional cookies, page URL, page title, device and browser information, approximate location derived from IP address, interaction data, session recordings, and chat identifiers on eligible public pages.

RasterLift uses information to:

• create and secure accounts and authenticate sessions;
• upload, validate, process, review, correct, and export statement data at your request;
• measure page usage, enforce plan limits, operate subscriptions, prevent duplicate charges, and maintain billing records;
• provide support and send authentication, service, billing, or security communications;
• detect abuse, investigate errors, protect users, and maintain the availability and integrity of the Service;
• understand public-site performance and support conversations when you consent to optional cookies; and
• comply with legal obligations and enforce our agreements.

Where applicable law requires a legal basis, processing is based on performance of our contract with you, our legitimate interests in operating and securing the Service, your consent for optional cookies, and compliance with legal obligations. You may withdraw cookie consent without affecting earlier lawful processing.

Uploaded originals are stored in a private Supabase Storage bucket and accessed only through authenticated, user-scoped workflows or trusted server processes. RasterLift sends document content to Mistral AI's OCR service solely to extract text needed for the requested conversion. RasterLift is an independent product and is not affiliated with, endorsed by, or sponsored by Mistral AI. RasterLift does not use or authorize the use of uploaded documents, OCR text, normalized transactions, or exports to train AI models.

Raw OCR source text is used transiently to produce normalized rows and is not retained after those rows are saved. Normalized transaction data, summaries, review flags, and user corrections stay available in your private workspace until you delete the document or request deletion. CSV and Excel files are normally generated in your browser for direct download rather than stored as a separate server-side copy.

Analytics and live-chat tools are not loaded in upload, processing, review, dashboard, history, billing, settings, or other private document workflows. RasterLift does not intentionally send those tools document contents, OCR text, bank names, account numbers, transaction descriptions, amounts, balances, or export data.

Creem acts as merchant of record and processes checkout, payment methods, invoices, taxes, refunds, and subscription administration. Payment information you provide at checkout is submitted directly to Creem and its payment partners under their own terms and privacy notices. RasterLift receives limited billing information needed to activate the correct plan, reconcile events, display subscription status, and provide support.

Billing and transaction records may be retained for accounting, fraud prevention, dispute handling, and legal compliance even after a subscription or account ends.

RasterLift uses service providers only for functions needed to operate the Service. The current provider categories include:

• Supabase for authentication, database, private file storage, and authentication email delivery;
• Vercel for application hosting, network delivery, and operational logs;
• Mistral AI for OCR processing;
• Creem as merchant of record for checkout, tax, payment, refund, and subscription operations;
• Resend for service and transactional email when enabled; and
• Microsoft Clarity, Google Analytics 4, and tawk.to for consent-based public-page analytics and live chat.

Providers may process information only for the contracted service and under their own data-protection obligations. Information may also be disclosed when required by law, to protect rights or safety, to investigate fraud or abuse, or as part of a merger, financing, acquisition, or sale of assets with appropriate safeguards. RasterLift does not sell personal information or document data and does not share it for cross-context behavioral advertising.

Essential browser storage supports authentication, security, and your saved cookie choice. Optional integrations load only after you select Accept cookies. Choosing Essential only keeps Microsoft Clarity, Google Analytics 4, and tawk.to disabled.

Optional integrations are restricted to the homepage, Pricing, Security, and Blog pages. Google Analytics is configured without ad personalization or Google signals and with IP anonymization enabled. Clarity may provide interaction heatmaps and session recordings of eligible public pages. tawk.to provides live-chat functionality.

You can reopen Cookie settingsfrom the site footer and change your choice at any time. Declining optional cookies does not prevent you from creating an account, processing documents, or purchasing a plan.

• Original uploaded files: each original receives a deletion deadline no later than 24 hours after upload and is normally removed by the next scheduled daily cleanup.
• Raw OCR source text: not retained after normalized transaction rows are stored.
• Document records and extracted data:retained in your private account until you delete the document or ask us to delete the associated account data.
• Account, security, email, and billing records:retained while needed to operate the account, document consent and delivery, resolve disputes, prevent abuse, and satisfy tax, accounting, or other legal requirements.
• Rate-limit counters: routinely removed after the short security window for which they are needed.

Deleting a document from the Dashboard deletes its database record and associated extracted data through cascading deletion, and removes the original storage object when one remains. Account deletion is handled by support. We may first verify your identity and ask you to cancel an active subscription. Some minimal billing, fraud-prevention, backup, or legal records may remain where required or permitted by law.

RasterLift uses access controls, row-level security, user-scoped private storage paths, signed access patterns, read-only original file references, server-only secrets, webhook verification, rate-limiting, data minimization, and automated original-file cleanup. Sensitive financial data is excluded from marketing analytics by design.

No internet service can guarantee absolute security. You are responsible for protecting your password, email account, devices, and active sessions. Contact support@rasterlift.com promptly if you believe your account or information has been compromised.

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to withdraw consent or complain to a regulator. These rights may be limited by identity verification, legal obligations, and valid exemptions.

You can edit extracted transaction rows, delete individual documents from the Dashboard, change cookie consent from the footer, manage or cancel subscriptions through Billing, and request account-level access or deletion by emailing support@rasterlift.com from the address tied to your account. We will respond within the period required by applicable law.

RasterLift and its providers operate internationally. Your information may therefore be processed in countries other than the one where you live. Those countries may have different privacy laws. Where required, RasterLift relies on provider contractual safeguards and other lawful transfer mechanisms.

RasterLift is a business-oriented financial-document tool and is not directed to children. You must be at least 18 years old, or the age of legal majority where you live, to create an account or purchase a subscription. Contact us if you believe a child has provided personal information without appropriate authorization.

We may update this policy when the Service, providers, or legal requirements change. The effective date at the top will be revised, and material changes may also be communicated through the Service or by email when appropriate.

For privacy questions, rights requests, account or document deletion, billing support, or legal notices, email support@rasterlift.com. You can also review the Terms of Service and Security page.