Last updated: 16 October 2026 · Operated by Onevia Technology Ltd, trading as ClearStatement
This Privacy Policy explains how ClearStatement ("we", "us", "our"), operated by Onevia Technology Ltd trading as ClearStatement, collects, uses, and protects personal data in connection with the ClearStatement service ("the Service").
We are committed to protecting your privacy and handling all personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data controller: Onevia Technology Ltd, trading as ClearStatement
Company number: 17386326 (registered in England and Wales)
Registered office: 18 Turpins Way, Baldock, England, SG7 6LW
ICO registration reference: ZC220692
Contact: help@clearstatement.co.uk
Website: clearstatement.co.uk
Account data: your email address, your firm name, your role on the account (administrator or team member), the date you accepted our Terms of Service and which version you accepted, and your password. We never store your password itself, only a salted, one-way hash of it. If an account administrator invites colleagues to a team account, we hold each team member's email address, role and invitation status.
Billing data: your name, billing email address, billing address and VAT number (if you give one), and your subscription details. Payments are processed by Stripe; we never see or store card details.
Security and technical data: basic technical information such as your IP address and browser type, used for security and operational purposes. To protect accounts against password guessing and abuse, we keep short-lived counters of failed sign-in attempts and password-reset requests, linked to the email address and IP address used. These counters delete themselves automatically after 15 minutes (sign-in) or one hour (password reset).
Category template: the category names and match keywords you set up are saved to your account so they are available on any device you sign in from. Your template is your own configuration, not client data, so please don't put client names or account details in your keywords.
Service usage data: when you are signed in, we record simple counts of how the Service is used, linked to your account and email address: when you open the app or sign in, when a statement is read (whether it was read successfully, whether it was a PDF or CSV, which bank format was recognised, how many transactions were found, how many months it covers and how long it took to read), when file checks run on a statement (the result, how many warnings were shown and which kinds of check raised them), when the AI categorisation runs (how many transactions and how long it took), when you export a report or save a case, and, for each case you export, how long it took from the first statement to the export and how many of its transactions were sorted by your keyword rules, by AI, by hand or left uncategorised. We use this to understand how the Service is used, to support your account and to improve the Service. It never includes anything from the statement itself, such as names, descriptions, amounts or balances. This is our own record, not a third-party analytics or tracking service.
Website and app visit statistics: we use Cloudflare Web Analytics to count visits to our website and the Service and to measure how quickly pages load. It records the page visited, the website that referred you, your browser, operating system and device type, your approximate country and page loading times. It does not use cookies, does not identify you or follow you across other websites, and does not record anything you type, upload or see in the Service, including bank statement data.
Support messages: if you email us or use the Help form in the app, we receive your name, email address and whatever you include in your message.
Bank statement data: The Service reads your uploaded bank statement and extracts transaction data entirely within your browser — the statement file itself is never uploaded anywhere. Transactions matched by your category template are categorised within your browser and no data about them is transmitted. If you choose to use AI-assisted categorisation for transactions that were not matched, the description, amount and direction (money in or out) of those transactions only are sent over an encrypted (HTTPS) connection to our own backend service, which immediately forwards them to our AI provider (Anthropic) for categorisation and returns the result. We do not send the statement file, the account holder's name, account numbers or sort codes. The Service shows you a confirmation before any data is sent for AI categorisation, listing exactly what is and is not included; that confirmation applies to your current session only and is requested again the next time you open the Service. We do not log, cache, or store any bank statement or transaction data on our servers at any point, and the categorised results and the Excel workbook the Service produces are generated and remain in your browser.
Saved case files: if you use Save case, the Service creates a case file holding the transactions and categories you are working on so you can pick the case up later. The file is encrypted in your browser with a key linked to your subscription and saved only to the location you choose on your own device. We never receive a copy and cannot read it. It can only be reopened by signing in to the same ClearStatement subscription, which includes other members of your team account. You are responsible for storing case files securely and deleting them in line with your own retention policy.
You (the subscriber) are the data controller for any personal data belonging to your clients that you process using the Service. ClearStatement acts as a data processor in this context. A Data Processing Agreement setting out our obligations as processor is available on request.
As described in Section 2 above, where you choose to use AI-assisted categorisation, the descriptions, amounts and directions of unmatched transactions pass over an encrypted connection through our own backend (operated by us on Cloudflare) to Anthropic, our AI provider, solely for the purpose of categorisation, and the result is returned to your browser. Our backend only accepts requests in the fixed categorisation format the Service uses and rejects anything else. We do not transmit client names, account numbers or sort codes as separate fields. You should be aware that a transaction description recorded by a bank may itself contain a payment reference or the name of a payer or payee, and that such text forms part of the description that is sent. Transactions matched by your category template are never transmitted at all. No client personal data is stored by ClearStatement at any point in that pipeline.
Anthropic processes this data under its Commercial Terms of Service, which incorporate its Data Processing Addendum, including Standard Contractual Clauses for international transfers. Under those terms Anthropic does not use the data to train its models, and deletes it within 30 days unless it must be kept longer for legal reasons or to enforce its usage policies. Anthropic stores data in the United States and may carry out processing in the United States, Europe, Asia or Australia.
If we become aware of a personal data breach affecting client data we process on your behalf, we will notify you within 48 hours.
You are responsible for ensuring you have the appropriate basis to process your clients' personal data and for informing clients accordingly under UK GDPR.
We use the following third-party services:
Some of these providers process data outside the UK, including in the United States. Where they do, the transfer is covered by the provider's data processing terms and appropriate safeguards, such as Standard Contractual Clauses with the UK Addendum or the UK–US data bridge.
Under UK GDPR, you have the right to:
To exercise any of these rights, contact us at help@clearstatement.co.uk.
The ClearStatement tool does not use tracking cookies. We use your browser's local storage solely to keep you signed in between visits and to keep a copy of your category template on your device. Your client's account holder name is deliberately never saved to local storage — it is cleared as soon as you refresh or move to the next statement, so one client's details can't carry over to the next when you're working through several in the same browser session. No data is shared with advertisers, and we do not use advertising or cross-site tracking. The only analytics are the simple usage counts described in Section 2, recorded by our own systems, and Cloudflare Web Analytics, which counts visits and page loading times without using cookies.
We take appropriate technical and organisational measures to protect your personal data, including:
If a personal data breach occurs, we will notify the ICO within 72 hours where the law requires it, and tell affected subscribers without undue delay.
We may update this Privacy Policy from time to time. Material changes will be communicated by email. The current version is always available at clearstatement.co.uk/privacy.html.
For any privacy-related queries, please contact us at help@clearstatement.co.uk.