Privacy Policy

StatementNest is operated by Tien Dinh (trading as Varmeli), Mjölkörtsvägen 20, Ronneby, Sweden. Contact: contact@varmeli.com.

Last updated 9 October 2026. Tien Dinh is the controller of the personal data described here.

What stays on your device

Your statement PDFs, the extracted transactions, saved-work files and exports are processed and downloaded in your browser. They are not uploaded to our servers and we cannot see them. Closing the tab clears them from tab memory.

What we store when you subscribe

• An opaque account and session reference (no name or email).
• Stripe customer, subscription and checkout identifiers.
• A digest of your private recovery code, never the code itself.
• Your plan, billing period and page usage, including a salted one-way fingerprint and page count for each PDF you convert so a file is not counted twice. We do not store file contents or file names.
• Payment-event identifiers needed to avoid processing an event twice.

Stripe collects and processes your payment details, billing address, email and tax information under its own privacy policy. We receive only the identifiers above and the status of your subscription.

Why we use it, and the legal basis

To provide and bill the service you subscribed to (contract), to prevent abuse and fraud and to keep the service secure (legitimate interests), and to keep records we are legally required to keep (legal obligation, such as the Swedish Bookkeeping Act, which requires accounting records to be kept for seven years).

Cookies

We set one strictly necessary session cookie (__Host-statementnest_session), which is HttpOnly, Secure and SameSite=Lax and lasts 30 days. It keeps you signed in to your subscription. We use no advertising or analytics cookies and show no third-party trackers.

Who we share it with

Stripe (payments and tax) and Netlify (hosting and the database that holds the records above). We do not sell personal data. These providers may process data outside the EU/EEA under standard contractual clauses or equivalent safeguards.

How long we keep it

• Account, usage and fingerprint records: while your subscription is active and for 12 months after it ends, then deleted.
• Recovery-code digest: deleted when you ask or when the account record is deleted.
• Payment records and invoices held for accounting: seven years, as the law requires.

We delete records manually, so a request is the fastest route.

Your rights

You can ask for access to, correction of, or deletion of your data, ask us to restrict or stop processing, and ask for a copy. Email contact@varmeli.com and include your plan and the approximate purchase date, since we do not hold your name or email. We reply within 30 days. You may also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.