Privacy Policy

Last updated: September 10, 2026

TransactionLookup.com ("we," "our," or "us") is committed to protecting your privacy. This policy explains what information we collect, how we use it, and — most importantly for our Statement Scan feature — what happens to the files you upload.

What We Collect

When you use our service, we may collect:

• The bank charge descriptor text you submit for identification.
• Bank or card statements you choose to upload to our Statement Scan feature. These are processed in memory to identify charges and are not saved to our systems — see "How Statement Scan Handles Your File" below.
• Account information — if you create an account or subscribe, we store your email address, your subscription status, and a Stripe customer reference.
• Basic usage data (pages visited, time on site) and device/browser information via analytics.

We never ask for, and you should never send us, your online-banking password, PIN, or full account and card numbers. Statement Scan is designed to work without them.

How We Use Your Data

• To identify and decode bank charge descriptors you submit.
• To analyze statements you upload and flag subscriptions, possible duplicates, junk fees, and charges to verify.
• To improve the accuracy of our identification database (descriptor text only — not your uploaded statements).
• To process payments and provide access to paid reports.
• To understand usage patterns and improve the service.
• To display advertisements, managed for us by Mediavine (see "Advertising" below).

How Statement Scan Handles Your File

• Your file is held in memory only while it's analyzed. We do not write it to our databases, disk, or logs, and we do not keep a copy after your session.
• We strip photo metadata (such as GPS location tags) from JPG, PNG, WebP, and HEIC photos on our servers before your statement is analyzed. For most photos it also happens in your browser before upload, as an added first pass.
• To read your statement, we send its contents to OpenAI, our AI provider, which performs the extraction. OpenAI may retain data for up to 30 days for abuse monitoring before deleting it. This is OpenAI's standard API policy; we are pursuing a zero-retention arrangement and will update this policy if it changes.
• We instruct the AI to leave full account numbers, names, addresses, and balances out of the results.
• We never sell your statement data, and we never use it for advertising.

Analytics

We use Google Analytics to collect anonymized usage data such as page views, session duration, and referral sources. Google Analytics uses cookies to distinguish unique users. You can opt out by installing the Google Analytics Opt-out Browser Add-on.

Advertising

Mediavine Programmatic Advertising (Ver 1.1)

This website works with Mediavine to manage the third-party, interest-based advertising that appears on it. When you visit, Mediavine serves content and advertisements that may set first-party cookies (from this site) and third-party cookies (from other domains). Tags, pixels, beacons and similar technologies may also be placed on the site to measure how visitors interact with it and with the ads. Your browser lets you block cookies and clear stored data; the All About Cookies site explains how.

To serve personalized advertising, Mediavine and its partners may collect:

• IP address
• Operating system type and version
• Device type
• Language of the website
• Web browser type
• Email (in hashed form)

Mediavine's partners may create unique IDs from this data to build audience segments and may combine it with information they have collected independently to deliver targeted advertising. You can opt out of interest-based advertising through the Network Advertising Initiative (NAI) or the Digital Advertising Alliance (DAA), and on mobile devices by installing AppChoices. Mediavine's advertising partners are listed at mediavine.com/ad-partners. Where consent is required for advertising cookies (for example in the EEA or UK), personalized ads are only served on the basis of that consent, collected through Mediavine's consent banner. We never use the contents of your uploaded statements for advertising.

Payments

Payments are processed by Stripe. Checkout happens on Stripe's own secure pages — your full card number never touches our servers. From Stripe we receive your email, your payment/subscription status, and a Stripe customer reference.

Email

We use Resend to send account sign-in links. Payment receipts, if any, are sent by Stripe. We do not send marketing email unless you explicitly opt in to reminders.

Third-Party Services

We rely on the following third-party services (subprocessors):

• OpenAI — powers charge identification and statement scanning (may retain data up to 30 days for abuse monitoring, as noted above). Privacy Policy
• Stripe — processes payments. Privacy Policy
• Resend — sends sign-in links. Privacy Policy
• Google Analytics — anonymized usage tracking. Privacy Policy
• Mediavine — manages display advertising and its consent banner. Privacy Policy

Data Retention

• Submitted descriptors and their AI-generated analyses are stored indefinitely to build our public knowledge base.
• Uploaded statements are not retained by us — they are processed in memory and discarded when your session ends. OpenAI may hold data up to 30 days for abuse monitoring (see above).
• Account data (email + purchase/subscription status) is kept while your account is active and deleted on request.
• Analytics data follows Google Analytics' default retention.

Your Rights

You have the right to request access to, correction of, or deletion of any personal data we hold about you. To exercise these rights, contact us at support@transactionlookup.com. We respond to every request and do not discriminate against you for making one.

If you are in the European Economic Area or the UK (GDPR): we process the data described above on the basis of your consent (advertising and analytics cookies, where a consent prompt is shown), the performance of our contract with you (accounts and paid features), and our legitimate interest in operating and improving the service (charge identification and security). You additionally have the rights to data portability, to restrict or object to processing, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority. The service is operated by its founder, named on our About page; contact the address above for any data-protection matter.

If you are a California resident (CCPA/CPRA): you have the right to know what personal information we collect (this policy is the disclosure), to request its deletion, and to opt out of the "sale" or "sharing" of personal information. We do not sell personal information for money. Third-party advertising cookies may qualify as "sharing" under the CPRA; you can opt out through the "Do Not Sell or Share My Personal Information" control in Mediavine's consent banner on this site, through the Digital Advertising Alliance opt-out, or by emailing us at the address above.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the service after changes constitutes acceptance of the revised policy.

Contact

If you have any questions about this Privacy Policy, please contact us at support@transactionlookup.com.