Privacy Policy

No file storage

Folia does not store your PDF bank statements or the CSV output we generate. Files are processed entirely in memory inside an AWS Lambda function and discarded immediately after your CSV is returned. Nothing is written to disk or stored in a database.

Where your data is processed

Our infrastructure — the servers that receive your file, run the extraction pipeline, and host our database — runs in the ca-central-1 AWS region (Montréal, Canada) and on a Canadian-region Supabase database.

For most major banks, statements are read directly from the PDF’s text layer and never leave that Canadian infrastructure. For statements we can’t read that way, page images are sent to Anthropic’s Claude API for processing — Anthropic is a United States-based subprocessor, so for those statements, page images (not the original PDF file, and not your account information) are transmitted outside Canada for the moments it takes to process them. See Anthropic’s privacy policy for how they handle data submitted to their API.

Subprocessors

We use the following subprocessors to provide the Service:

• AWS (Lambda, S3) — document processing infrastructure, ca-central-1
• Supabase — application database, Canadian region
• Anthropic — AI-based statement reading for banks not covered by our direct text-extraction path (see above)
• Stripe — payment processing; we do not store your card details
• Auth0 — authentication and login

What we do store

For each document you process, we retain metadata to provide the service and display your processing history: filename, page count, transaction count, account and bank name, upload timestamp, processing status, and processing cost. If our balance-reconciliation check flags a possible discrepancy in a statement, we also retain the specific transaction rows involved in that discrepancy (dates, descriptions, and amounts), so the flag can be reviewed — this is the one case where transaction-level detail is stored; it does not happen for documents that process without a flagged discrepancy.

Account data

We store your name, email address, and company name to operate your account. Billing is handled by Stripe; we do not store payment card details. Authentication is handled by Auth0.

Data retention and deletion

You may request deletion of your account and its associated data at any time from your account settings. Your account is deactivated immediately and any active subscription is cancelled immediately, without a refund for the unused portion. Your data is then permanently deleted 30 days after the request. You can cancel the deletion and restore full access by logging in again before that date; reactivating your account does not restore a cancelled subscription.

Contact

For privacy inquiries, contact us at privacy@withfolia.ca.