Bankfiletool

The Terms state users retain rights to content they submit, which is user-favorable on its face. However, this is immediately undercut by a broad license grant to the vendor, and the documents never specifically address uploaded bank statement files as distinct sensitive input data.

The documents do not distinguish between user-submitted content and AI-generated output (the extracted spreadsheets). The vendor claims ownership of 'original content, features, and functionality' of the website generally, leaving ownership of conversion output ambiguous.

The policies are silent on whether user inputs are used to train or improve AI models. The broad content license permitting the vendor to 'use, reproduce, modify' content, combined with a stated purpose of 'gather analysis or valuable information to improve our services', could encompass training use without any explicit prohibition. For an AI tool processing bank statements, this silence is a serious risk.

The legal documents contain no data retention schedule, no deletion mechanism, no deletion SLA, and no security-related retention obligations. The marketing copy advertises 'zero data retention', but this commitment appears nowhere in the binding Privacy Policy or Terms, so users have no enforceable deletion right. For a service handling sensitive financial records, this is a critical gap.

The Privacy Policy discloses that third-party companies may be employed to facilitate or analyze the service, but provides no named sub-processors, no limits on what is shared, and no user control. There is no evidence of selling data, but the vague disclosure combined with a license to 'distribute' content and the absence of the marketing 'never shared' promise in the binding text leaves the scope of sharing unclear for sensitive financial data.

The documents provide no opt-out mechanism of any kind — no way to opt out of data collection, model training use, analytics, or third-party sharing. The only stated recourse is a generic contact link. This absence of any opt-out option warrants a RED rating.

As a fintech tool processing bank statements, Bankfiletool is assessed against the universal baseline plus fintech frameworks (GLBA, PCI DSS, SOC 1/2, etc.). The documents mention no compliance frameworks or certifications whatsoever — no GDPR, CCPA, SOC 2, GLBA, or any other. For a service handling sensitive financial data, this total absence conflicts with the privacy and financial-data laws that likely apply to it.

The documents make no reference to model behavior, explainability, or enterprise auditing capabilities. Although the product performs AI-based extraction and balance reconciliation, the policies do not address transparency or auditability at all.

The Privacy Policy offers only a single boilerplate sentence about 'appropriate security measures' with no specifics — no encryption details, access controls, penetration testing, bug bounty, or incident response process. No breach history is disclosed and no security page or trust center is referenced in the legal documents. Marketing claims of 'end-to-end encryption' and 'bank-grade security' are absent from the binding text.

The product surface describes multiple tiers (no-login, registered free, and subscribed/paid for accountants and businesses), but the legal documents draw no distinction in data handling between free and paid tiers. No enterprise agreement or DPA was available. Paying users receive no documented additional data protections.

The documents are silent on whether staff may access or read user-submitted files or outputs. Given the broad license to 'use, reproduce, modify' content and the vague third-party analysis clause, there is no assurance that human review of sensitive bank statements is restricted.

The documents contain no references to government or law enforcement data requests, legal disputes, subpoenas, or cooperation procedures. For a service holding sensitive financial data, the absence of any transparency about how such requests are handled is a notable gap.

The Privacy Policy discloses collection of standard PII (name, email, contact details, usage data, IP address, browser, OS) but completely omits the most sensitive category the product handles: uploaded bank statements containing account numbers, transaction histories, and balances — clearly financial SPI. The policy is silent on this SPI, providing no notice or controls for the very data central to the service, warranting a RED rating.

Both policies are dated 2025/03/10, roughly 18 months before the analysis date — moderately recent. However, coverage is severely deficient: the product is an AI-first service that parses bank statements with an 'AI engine', yet the policies never mention AI/ML processing, model training, financial data, bank statements, or third-party model providers. This AI-first product with a policy silent on AI justifies RED despite the recent date.

Two documents were supplied (Privacy Policy and Terms of Service), enabling a cross-document comparison. No direct contradictions were found between them; they address largely non-overlapping topics and are internally consistent where they touch. Note that both are generic and neither reflects the marketing promises, but no conflicting binding terms exist between the two legal documents.