Legal information
Privacy Policy
Last updated: October 7, 2026
Data controller
SEKIDAM, publisher of RowTick (contact details in the Legal notice). For any question about your data: contact@rowtick.com.
Data processed, purposes and retention periods
| Data | Purpose and legal basis | Retention |
|---|---|---|
| Account: Google ID, email address, name, profile picture URL, account creation and last sign-in dates | Creating and securing your account (performance of the contract) | Until the account is closed |
| Session: random token, stored in a cookie and, as a hash, on our servers | Keeping you signed in (performance of the contract) | 30 days, or until you sign out |
| Uploaded statements (PDF, file name, hash) and conversion results: transactions, balances, account numbers, account holder and any other information shown on the statement, including information about third parties | Providing the conversion, history, exports and categorization (performance of the contract) | 7 days after upload, then deleted automatically; sooner if you delete them from your history |
| Purchases and page balance: pack purchased, amount, date, Stripe payment reference, balance movements (with the name of the converted file); with each purchase, the version of the Terms of Service accepted, the date and time of your agreement and your request for immediate performance | Managing your balance and billing (performance of the contract); keeping accounting records (legal obligation); proving acceptance of the Terms of Service (legal obligation and legitimate interest) | Accounting records and proof of agreement: 10 years (article L123-22 of the French Commercial Code); balance movements: until the account is closed |
| Server technical logs: IP address, date, page or file requested, errors | Security and proper operation of the service (legitimate interest) | 30 jours |
| Messages you send us | Replying to you (legitimate interest, or pre-contractual steps) | 3 years after the last exchange |
Your card details are entered on Stripe's payment page: we never receive them. We do not sell your data and do not use it for advertising. No decision producing legal effects concerning you is based solely on automated processing.
Statement analysis by artificial intelligence
To convert a statement, its text (not the PDF file) is sent to the Claude AI model, provided by Anthropic. For categorization, transaction descriptions and amounts are sent as well. Anthropic acts as a processor: under its commercial terms, it does not use this data to train its models and retains it only for a limited period, in particular for the security of its service.
Recipients and processors
Your data is accessible only to the publisher and to the following providers, to the extent necessary for their tasks:
- Hetzner Online GmbH (Germany): hosting of servers and data.
- Anthropic, PBC (United States): AI reading of statements.
- Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., United States): payment. Stripe also acts as an independent controller for its own obligations (fraud prevention, financial regulation).
- Google (Google Ireland Limited and Google LLC, United States): sign-in with your Google account, which sends us your ID, email address, name and profile picture. This information is used only to identify your account.
- Cloudflare, Inc. (United States): domain name management and request routing; encrypted storage, in the European Union, of backups of the accounts and purchases database (restore points kept for 7 days; statements and conversions are not copied there).
- Zoho: email service for the contact address (Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Pays-Bas ; données hébergées dans l'Union européenne).
Transfers outside the European Union
Some of the providers above process data in the United States; database backups remain in the European Union. These transfers are governed by the European Commission's adequacy decision on the EU–US Data Privacy Framework, for certified companies, or otherwise by the European Commission's standard contractual clauses. You can obtain a copy by writing to contact@rowtick.com.
Cookies and browser storage
The website uses only strictly necessary trackers, which are exempt from consent. There is no advertising and no audience measurement.
- Session cookie (
__Host-session): keeps you signed in, for up to 30 days. - Sign-in cookie (
__Host-login): protects the return from Google during sign-in, for 10 minutes. - Language cookie (
locale): remembers the language you chose, "en" (English) or "fr" (French), for 1 year. It is set only when you explicitly choose a language in the language selector or in the language suggestion banner, and is used solely to show the site in the language you requested.
The browser's local storage (localStorage) keeps the following items. They stay in your browser, are not sent to us and have no expiry; you can clear them from your browser settings.
- Display theme (
app:theme): "light" or "dark", only if you chose one. - Language banner dismissed (
app:language-banner): "dismissed", once you close the banner suggesting another language, so that it is not shown again. - History present (
app:had-history): "1" or "0", to show the history area as soon as the page loads, without layout shift. - Table corrections (
app:sheet:followed by the conversion and account IDs): settings and corrections you make in a table (edited values and categories, deleted rows, sorting, filters, columns), erased from this browser when you delete the conversion from your history there. - Combined view corrections (
app:sheet:batch:followed by the grouped statements): the same corrections for a batch of statements combined into a single view.
The Google (sign-in) and Stripe (payment) pages set their own cookies, governed by their own policies.
Security
Communications are encrypted (HTTPS). Each conversion is accessible only to the account that uploaded it. Session tokens are stored as hashes.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, as well as the right to set instructions regarding what happens to your data after your death. To exercise these rights, write to contact@rowtick.com from your account's email address. You can delete your conversions from your history and request the closure of your account at any time.
You can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
Changes to this policy
This policy may change as the service evolves. The date of the last update is shown at the top of the page; in the event of a significant change, account holders will be notified.