Legal
Privacy policy
DocShape converts PDF bank statements into spreadsheets. A bank statement is personal financial information, so this page explains exactly what happens to yours. It separates the document and its results, which are deleted after a short time, from the small job record and server logs that remain afterwards.
Who is responsible
DocShape is a product of EidaLabs, the trade name of a Dutch sole proprietorship (eenmanszaak) registered in Harderwijk, the Netherlands. The operator is the controller of the personal data described here.
- Operator
- EidaLabs
- Proprietor
- Benjamin Benedek
- Privacy contact
- info@eidalabs.com
Company details are also on the contact page.
Your statement and its results
There is no account. When you upload a statement, DocShape creates a job and gives your browser a random access key for it. Only that key opens the job.
- Where it is processed. Your PDF is read on DocShape’s own server. No external AI service is used to convert statements. The public beta refuses scanned statements; in the invite-only private beta, scanned pages are read with text recognition (OCR) that also runs on DocShape’s server.
- How it is stored. The uploaded PDF and the spreadsheet and CSV files made from it are stored on an encrypted volume on that server. The on-screen preview is held in memory only. The figures DocShape reads from your statement are never written into its database.
- When it is deleted. In the public beta, the PDF, its preview and its files are deleted automatically about an hour after upload. In the private beta, the job shows its exact deletion deadline. A statement that is refused or fails is deleted straight away. After a conversion finishes you can delete everything at once with “Delete now”. Deletion is checked by a sweep that runs every few minutes, so it can happen a few minutes after the deadline.
- Your downloads. Files you download are copies on your device. Deleting the job does not affect them.
What is kept after deletion
Deleting the document does not delete the job’s record. DocShape keeps this record in its database to run the service, count usage and investigate failures. It contains:
- the job’s random identifier, its status and its timestamps;
- the size, type and page count of the PDF, and a SHA-256 checksum of its bytes. The checksum cannot be turned back into the document;
- how many accounts the statement held;
- if it was refused or failed, a fixed reason code. It never includes document text;
- a one-way hash of the access key, not the key itself;
- for the public beta, the statistics described in public beta statistics.
The record holds no name, address or statement content. It is still linked to your job’s access key and, for about a day, to the pseudonym described under IP addresses, so DocShape treats it as personal data, not as anonymous data.
The PDF’s file name is also stored while the document exists. It is erased when the document is deleted, because file names often contain a person’s name.
How long records are kept. Job records are kept while the public beta runs and until its results have been evaluated. After the beta has closed, the operator records the beta’s totals and then deletes the job records. This is a manual step that the operator carries out; it is not automatic. The run totals described below hold no job identifier, time or address, and are kept as the beta’s result.
Public beta statistics
To find out whether the public beta works, DocShape measures it on its own server. Nothing is sent to an analytics company.
- With each public-beta job record: whether the conversion finished or was refused, with its fixed reason code; when a download was first requested (not whether it completed); and the category of a problem you report, if you report one.
- Problem reports are optional. Only the category you choose is sent: “Rows are missing or wrong”, “A balance or total is wrong”, “My statement was refused”, “The file does not open or import”, “Something else”. No free text and nothing from your statement is sent with it.
- Run totals. A few counters, each a fixed name and a number, count events that leave no job record, such as an upload refused before a job exists or a repeated download. They hold no job identifier, time or address.
The per-job statistics are part of the job record, so they are personal data in the same way and are kept for as long as the record.
IP addresses and abuse protection
Your IP address reaches DocShape’s server with every request, as it does for any website. It is used to deliver the page and to protect the service from abuse.
- No access log. DocShape’s web servers keep no per-request access log containing your address.
- Rate limits. To limit uploads and requests, DocShape keeps a short-lived counter in memory under a keyed hash of your address. An IPv6 address is first shortened to its network prefix. The counter expires by itself within ten minutes.
- The public beta’s daily limit. To count free conversions per visitor, a keyed hash of your address is stored with each public-beta job. It is erased about 25 hours after the upload. The hash is not your address and cannot be reversed without the server’s secret key, but it is a pseudonym: still personal data, not anonymous data.
- Error and firewall logs. When the web server hits an error while handling your request, it writes an error line that can include your IP address. The server’s firewall also records blocked connection attempts, including the source IP address. Both logs are rotated: the error log daily, keeping its last 14 files, and the firewall log weekly, keeping its last four. A file is only rotated once it has new lines in it, so this usually means about two and four weeks, but it is not a fixed time limit, and a line can be kept longer.
Server logs and backups
DocShape’s application writes operational log lines on its server. They can contain a job’s identifier, the path requested, a status, a fixed reason code and the internal address of DocShape’s own router. They never contain document content, file names, access keys or your IP address.
Before planned maintenance, the operator takes a copy of the database on the same encrypted volume. A copy contains the job records described above. It also contains the file names of documents that had not yet been deleted when it was taken.
How long they are kept. The application’s logs are limited to about 30 MB per service (three files of 10 MB): the oldest lines are deleted as new ones are written, and all of them when the service is replaced. This limits their size, not how long a line is kept. A database copy is deleted when the maintenance it was taken for is accepted, and at the latest 14 days after it was taken.
Cookies and browser storage
DocShape sets no cookies and uses no third-party analytics, advertising or tracking tools. The public beta’s own statistics are described above.
- Session storage. Your job’s access key is kept in the browser tab that uploaded the statement. The tab sends it with each request for that job, and it is cleared when the tab is closed. Without it, the conversion cannot work.
- Theme preference. If you switch between light and dark mode, the choice is saved in your browser’s local storage. It is never sent to DocShape.
- Private beta access. The private beta’s password is entered in the browser’s own prompt. The browser keeps it; DocShape’s pages never read it.
Fonts and scripts come from DocShape’s own server, so loading a page contacts no other company. That is why there is no cookie banner.
Email you send
You can write to info@eidalabs.com. Email sent to that address is forwarded by Cloudflare’s email routing service to the operator’s mailbox, which is a Google (Gmail) account (see service providers). Your address and message are kept to answer you: as long as needed to deal with your message, then deleted, unless the law requires it to be kept longer.
Please never send a bank statement by email.
Service providers
DocShape does not sell personal data. These companies provide services to it:
| Provider | What it does | What it can see |
|---|---|---|
| OVHcloud (OVH Hosting Limited) | Hosts the virtual server DocShape runs on, in a data centre in Frankfurt, Germany, as a processor. | Everything on the server, held on a volume DocShape encrypts with its own key. |
| Cloudflare | Answers DNS lookups for docshape.io, and forwards email sent to the operator’s address. | Email you send, while forwarding it. Website requests do not pass through Cloudflare; a DNS lookup reaches it from your network’s resolver. |
| Google (Gmail) | Hosts the operator’s mailbox, to which email for the operator’s address is forwarded. Google provides this mailbox under its own terms, as a separate controller. | Email you send to the operator, and the replies. |
| Better Stack | Monitors whether the website is up. | Its own requests for DocShape’s public pages, and a regular signal from DocShape’s server that carries no content. No visitor data. |
- Server location: Frankfurt, Germany (European Union).
- Processing agreement with the host: OVH Hosting Limited (Ireland) processes the data as a processor under OVHcloud’s data processing agreement (GDPR art. 28).
- Transfers outside the European Economic Area: limited, and covered by an EU adequacy decision, the EU–U.S. Data Privacy Framework or the EU’s standard contractual clauses, as described for each provider.
- OVHcloud stores the data in Germany. Under its agreement, OVHcloud companies elsewhere, including in Canada and the United Kingdom, may access the server remotely for support, maintenance and security. The EU has decided that both countries protect personal data adequately; for any other country OVHcloud relies on the EU’s standard contractual clauses.
- Cloudflare, Inc. is based in the United States. It is certified under the EU–U.S. Data Privacy Framework, and its data processing addendum includes the EU’s standard contractual clauses.
- Google may process email in the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework, and Google uses standard contractual clauses where they are required.
- Better Stack receives no visitor data.
DocShape’s code is written to support the services below, but each is switched off and holds no credential, so none of them receives anything: payment processing (Stripe), error reporting (Sentry), product analytics (PostHog), an external AI service for reading statements.
Why the data is processed
Each purpose has its own legal basis and its own retention:
| Purpose | Data | How long | Legal basis |
|---|---|---|---|
| Converting the statement you upload and letting you download the result | The PDF, its file name, preview and files; the job record; the access key | About an hour for the document; the record as described | Performing the service you ask for (GDPR art. 6(1)(b)) |
| Keeping the service secure and applying usage limits | Your IP address in transit, keyed-hash counters, the daily-limit pseudonym, error and firewall logs | Ten minutes, about 25 hours, or by log rotation | Legitimate interests (art. 6(1)(f)): keeping the service secure and available, and its free capacity fairly shared |
| Measuring whether the public beta works | Each job’s outcome, first download request and optional problem category; run totals | As long as the job record | Legitimate interests (art. 6(1)(f)): finding out whether the free beta converts statements correctly before it is offered more widely |
| Operating, maintaining and repairing the service | Job records, application logs, database copies | As described under logs and backups | Legitimate interests (art. 6(1)(f)): running, maintaining and repairing the service |
| Answering email you send | Your email address and message | As described under email | Legitimate interests (art. 6(1)(f)) in answering you; a legal obligation (art. 6(1)(c)) when you exercise a data-protection right |
Where the basis is legitimate interests, the interest is the one named in the table. DocShape relies on it only because the data involved is small and holds nothing from your statement, the address-based data is pseudonymised and short-lived, the records are not used to identify you or to make decisions about you, and you can object (below).
DocShape does not use your data for advertising, profiling or model training.
Your rights
Under the EU General Data Protection Regulation (GDPR) you may ask for access to your personal data, or for its correction or deletion. You may also ask to restrict or object to its processing, or to receive it in a portable form. You may object at any time to processing based on legitimate interests, on grounds relating to your situation (GDPR art. 21).
There is no account, so DocShape cannot tell which job is yours. Everything about your statement is deleted anyway, usually within about an hour, and you can delete it yourself sooner. If you write about a particular conversion, include the job identifier shown in your browser’s address bar.
Contact: info@eidalabs.com.
You may also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live.
Changes to this policy
This policy may change as DocShape changes. The date at the top shows which version you are reading.