Privacy policy

Who handles your information

Bankverto is an independently operated software service using Formaexlabs as its trading name. Our public privacy contact is available without signing in. Bankverto determines how account, billing, security and support information is used. For client records in a CA workspace, the practice determines the processing purposes and Bankverto provides the processing it requests. The practice must establish its authority to supply the records and grant access.

Professional customers should contact us before uploading records that require a separate data-processing agreement, regulated service-provider terms or specific transfer arrangements. A subscription or upload acknowledgement does not by itself establish those arrangements.

Information we use and why

Account and workspace

Email, sign-in records and membership let us authenticate you and control access.

Statements and records

Files, extracted transactions, names, dates, currencies, amounts, balances, descriptions and references provide the review, analysis and exports you request. Corrections and saved rules support future reviews.

Practice records

Client details, manually entered invoices, transaction matches and audit entries support the CA practice tools selected by its managers.

Usage and payments

Upload/page counts enforce allowances. Payment and subscription references support access, reconciliation, refunds and disputes.

Support and security

Messages, replies, request references and service/security events help us resolve requests and investigate misuse.

Most information comes from you or the practice that supplies your records. Payment providers supply payment status and references; service providers generate operational events. Statements can include other people’s information and reveal sensitive details through payment descriptions. Supply only records you have authority to process. Never include bank passwords, card PINs or OTPs in support messages.

Your processing choices

The statement-processing notice below explains how uploads are handled. Choosing “Upload & process” requests the processing described here; we record the notice version, document, account and time. Necessary browser storage and acceptance of general terms do not replace this processing notice. You can decline by not uploading, or stop further work through statement deletion where your role permits. Export needed records first, or contact us for help.

Where EU or UK law applies, we use account and requested service information to perform our contract; service-security and fraud-prevention records for our legitimate interests in protecting the service and its users; and records required by law to meet legal obligations. We use consent where required for a particular activity. For client records, the practice establishes its own lawful basis and instructions. Withdrawing consent affects future consent-based processing and can make the related feature unavailable; it does not undo processing already lawfully completed.

Statements and external AI

Keep your original files. We delete them after successful processing and temporarily retain interrupted or failed uploads for recovery. Uploading requests statement extraction and external AI enrichment, which may occur outside India. For practice records, only upload client files you are authorised to process.

Bankverto extracts statement records and uses Cloudflare Workers AI as an external processor for transaction enrichment, not on-device AI. Selected descriptions and merchant context are sent to Cloudflare. Names or other personal information may remain despite reference redaction. We do not send the original full PDF to Workers AI for this text-enrichment step. AI can make mistakes; check names, categories and extracted values against your own original.

Money Assistant

Calculated Money Assistant summaries do not send your question or summaries to the AI provider. If you explicitly choose an AI answer, your question and selected financial summaries are sent to Cloudflare when the service is configured. That option has its own notice and choice.

Cloudflare’s published Workers AI terms say customer content is not used to train models. Its retention terms include legal, security and feature-specific exceptions, and operational metadata may be retained. We call Workers AI directly. This does not establish zero provider retention or India-only processing. See our service providers for their roles and notices.

Who can access records

Personal records are restricted to your account and authorized service administration. CA workspace owners, authorized staff and client-portal users have access according to their membership and client assignments. Supabase, Vercel and Cloudflare provide storage, hosting and processing; Razorpay handles payments when you use checkout. Information may also be disclosed where legally required or necessary to investigate abuse or protect legal rights.

We do not sell personal information, share it for cross-context behavioural advertising or use it for targeted advertising. We do not use statement classification to decide lending, insurance, employment or other eligibility. There is no advertising opt-out switch to turn on: these advertising uses are not part of the service. A browser Global Privacy Control signal does not change this policy.

Retention and deletion

Original statements

After extracted transactions are saved successfully, we delete originals from active file storage and remove OCR/AI recovery checkpoints. Worker temporary files are cleared when extraction ends, including errors and timeouts. Source previews and downloads are then unavailable; keep your own original.

Interrupted or failed work

Inputs and checkpoints remain for recovery until you delete the statement or request removal. A failed deletion is retried; a saved transaction does not guarantee that a storage outage has already allowed cleanup to finish.

Extracted records

Transactions and review evidence remain until you or an authorized manager delete them. Separately entered invoices remain until the manager removes them or deletes the related client/workspace. Deleting a transaction removes its invoice-match association.

Exports

Background export download links expire after seven days. Keep any downloaded copy securely; deleting an account cannot recall copies already downloaded by you or another authorized recipient.

Account and service records

Account details support your active account. Usage counters prevent repeat quota claims; statement deletion does not restore allowance. Acceptance records preserve the version agreed. Payment, support and audit records may remain for reconciliation, complaints, legal obligations or unresolved disputes.

Security and backups

The application security-event trail is scheduled for 190-day retention. Other provider logs and backups follow their own arrangements. Storage failures, unreferenced objects or provider backups require separate reconciliation; deletion from the active application does not erase every provider copy immediately.

We assess requests against these purposes and any legal hold, explain exceptions, and can provide account-specific retention information. Provider backup rotation and restoration checks are separate from active storage deletion. We do not claim a single retention period covers every system or jurisdiction.

International processing

Our primary database is hosted in India. Hosting, AI, support and payment providers may process information elsewhere. Your location does not determine every processing location. Where Indian rules apply to sensitive financial information, transfers require the relevant protection and a necessary lawful contract or consent. Where EU or UK transfer restrictions apply, any required contractual safeguard and transfer assessment must cover the actual parties, destinations and onward transfers. A checkbox alone does not establish those safeguards.

Contact us before providing records subject to a residency requirement or a restricted international transfer. We do not represent website availability, a currency selector or a provider’s certification as proof that every international processing arrangement has been completed.

Request access, correction or deletion

Use Help & privacy requests or email our privacy contact to request access, correction, a portable copy, deletion, restriction, objection or withdrawal of consent. Identify your account or practice and the request. We may make proportionate identity and authority checks before releasing or deleting records. Do not send an identity document unless a secure, necessary verification method has been agreed.

If a practice supplied the records, it may need to respond as the organization responsible for them. We explain any referral, refusal or retention exception. To appeal or request a review, reply in the same email thread or reopen your Help ticket and say “Privacy appeal”. You do not need an active subscription to raise a request, and we do not penalize you for exercising applicable rights.

Rights in your region

India

You can request information, correction, erasure, consent withdrawal and grievance redressal under the law that applies. DPDP Act and Rules rights apply as their relevant provisions come into force; commencement is phased. Contact us about a grievance first. Where available under the applicable law, you may then approach the Data Protection Board of India. This notice does not claim every DPDP provision is already in force.

EU, EEA and UK

Applicable rights can include access, correction, erasure, restriction, portability, objection and withdrawal of consent. Requests are ordinarily answered within one month; where the law permits an extension, we explain the reason within that first month. You can complain to your local supervisory authority or the UK Information Commissioner’s Office. Bankverto does not make solely automated decisions with legal or similarly significant effects about you.

United States

State rights vary with residence, the applicable law and its thresholds or exemptions. They may include confirming processing, access, correction, deletion, portability, limits on certain sensitive-data uses, and opting out of sale, sharing, targeted advertising or certain profiling. California residents may request disclosure of information categories, sources, purposes and recipients. Our information and sharing sections describe those activities; contact us for disclosures relevant to your account.

Where a US state law applies, we follow its response and appeal deadlines, ordinarily 45 days for an initial substantive response, with permitted extensions explained. An authorized agent can contact us; we may verify both the agent’s authority and your identity as the law permits. Use the review route above if you disagree with our decision, and contact the relevant state authority where the law provides that remedy.

United Arab Emirates

Rights and transfer requirements depend on the applicable federal or free-zone framework, including any sector-specific rules. Contact us to request access, correction, deletion or review. Availability of Bankverto does not establish approval under a UAE financial-services regime.

Children, security and changes

Accounts are for adults aged 18 or older; signup requires an explicit adult confirmation. The service has no parental-consent workflow. Do not upload a child’s records or information requiring special-category consent unless the required authority and arrangements have first been established with us and, for practice records, the responsible organization.

We use private storage, access controls and restricted backend credentials to reduce risk. These controls cannot guarantee perfect security. Report suspected exposure through the privacy contact. Where notification is required, we notify the relevant organization, people or authority under the applicable obligations. We identify policy changes by version and request a new choice when required. Reading this notice is separate from agreeing to the Terms or authorizing a particular upload.

For support, billing, refunds, complaints or a privacy request, email support.bankverto@gmail.com. You can email without signing in. Include enough information to identify your request; never send passwords or full account numbers. Contact and follow-up guidance.