Privacy Policy

1. Data Controller & Processor Roles

StatementCheck (operating at statementcheck.app) acts purely as a Data Processor and administrative document parsing tool on behalf of the mortgage broker or adviser (the Data Controller). The broker determines the purposes and means of processing client financial data and is responsible for ensuring that appropriate lawful bases and client consents are in place before uploading documents to the service. The adviser retains ultimate regulatory responsibility under FCA MCOB rules for verifying all parsed statement data before making any lender submissions. Under UK GDPR, the regulated adviser or firm is the Data Controller and StatementCheck is the Data Processor.

2. In-Memory Zero-Retention Architecture

3. Third-Party AI Processing

Document analysis is performed using third-party AI API providers (Anthropic and OpenAI). All third-party API processing utilises commercial zero-data-retention enterprise tier endpoints. Client financial records, account numbers, and sort codes are NEVER used to train machine learning models and no client bank statement PII is retained or logged by these providers. Our providers are contractually bound not to retain or use submitted data for any purpose other than processing the immediate request.

4. Data We Process

When you use StatementCheck, the following data is processed transiently:

• The uploaded bank statement document (PDF or image file)
• Extracted transaction data (dates, descriptions, amounts, categories)
• Generated affordability summaries and underwriter flags

None of this data is stored persistently. All processing occurs in-memory and is discarded once the response is delivered.

5. Cookies & Tracking

StatementCheck does NOT use third-party tracking or advertising cookies. No client-side storage is used to track usage or limit access. No analytics, advertising, or third-party tracking cookies are deployed. See our Cookie Policy for full details.

6. Your Rights Under UK GDPR

As the Data Controller, the broker is responsible for responding to data subject requests from their clients. However, StatementCheck will support any reasonable request to exercise the following rights under UK GDPR:

• Right of Access — You may request information about what personal data is being processed.
• Right to Erasure — You may request deletion of any personal data. Due to our zero-retention architecture, data is automatically erased after processing.
• Right to Rectification — You may request correction of inaccurate personal data.
• Right to Restrict Processing — You may request that processing of your data be restricted.
• Right to Object — You may object to the processing of your data.
• Right to Data Portability — You may request your data in a structured, machine-readable format.

7. Data Security

StatementCheck employs industry-standard security measures including HTTPS/TLS encryption for all data in transit. Our zero-retention architecture means that even in the event of a security incident, there is no persistent store of client financial documents to compromise.

8. International Transfers

Third-party AI API providers may process data outside the UK. All transfers are conducted under appropriate safeguards, including Standard Contractual Clauses (SCCs) as approved by the UK Government, and using enterprise tier endpoints with zero-data-retention agreements.