Privacy Policy
Annalis reads business credit card and bank statements so a business owner can see where money goes. This policy describes what we collect, why, who else touches it, and how to get rid of it.
Who this covers
Annalis is operated at annalis.ai by Annalis Technologies, which is the controller of the data described below. When a business signs up, the person who creates the account is our customer, and the financial records they add are their business's data. We process that data to provide the service and for no other purpose.
What we collect
Account and people
The business name and the description you write of what the business does. For each person you invite: their email address, optionally their name, their role, and a one-way bcrypt hash of their password. We never store passwords in a form we can read.
Statements you upload
The original PDF file, its filename, a checksum, the issuer, the card label and statement period, and the totals printed on it. The PDF is stored so your accountant can retrieve source documents without going back to the bank.
Transactions
For each charge: date, the description as the issuer wrote it, a normalized merchant name, the amount, which card it belongs to, the cardholder name shown on the statement, and the category assigned to it.
Connected bank and card accounts
If you connect an account through Plaid, we receive and store the account name, its type, the last four digits of the account number, current and available balances, any credit limit, and the transactions on the accounts you select. We also store an access token issued by Plaid, encrypted at rest.
Security and operational records
Sign-in attempts, including the email tried and the originating IP address, kept for one day and used only to throttle password guessing. Password reset requests, stored as a hash of the token with an expiry. A history of categorization rule changes, so a save can be undone.
What we deliberately do not collect
- Bank credentials. Your bank username and password are entered inside Plaid and never reach our servers.
- Investment and retirement accounts. When you connect an institution we never offer, request, or store data from brokerage, 401(k), IRA or similar accounts, even when the bank makes them available.
- Accounts you do not select. After connecting, you choose which accounts belong in your books. Transactions from the rest are never read.
- Full card or account numbers, government identifiers, or Social Security numbers. We hold nothing beyond the last four digits.
How we use it
To parse statements, categorize charges, reconcile parsed totals against the totals printed on your statements, produce reports for you and your accountant, and identify recurring charges, price increases and duplicate charges that may be worth acting on. We do not sell data, we do not share it for advertising, and we do not use one business's data to serve another.
Who else processes it
| Provider | What they handle |
|---|---|
| Render | Application hosting and the database, in the United States |
| Plaid | Bank connections, only if you choose to connect an account |
| Anthropic | Categorizing merchants, only if that feature is enabled |
| Resend / Amazon SES | Delivering invitations and password reset emails |
| Stripe | Subscription payments, if you subscribe. We never see your card. |
| Google Analytics | Counting visits to our public pages only, never inside the application |
Bank connections
Connecting an account is entirely optional; Annalis works from uploaded statements alone. If you do connect one, Plaid handles the bank sign-in and their End User Privacy Policy governs what they collect. We receive account details, balances, and transactions for the accounts you select.
You can disconnect at any time from the Connected banks page. Doing so instructs Plaid to revoke the connection as well as removing it from Annalis. Transactions already imported remain in your books unless you ask us to delete them.
Automated categorization
When enabled, merchant names that no existing rule covers are sent to Anthropic's API, together with the description you wrote of your business, so a category can be suggested. Amounts, account numbers, balances and personal details are not sent — only the merchant text, how often it appeared, and its total. Anthropic does not use API inputs to train its models. Suggestions are marked as such and wait for you to confirm them.
Cookies and analytics
Inside the application we set one cookie: the signed session that keeps you logged in. There is no analytics, advertising or third-party tracking script on any page behind sign-in.
Our public pages — the homepage, this policy, and the rest — load Google Analytics, which sets its own cookies and reports page views, approximate location and device details to Google. It is used only to see how many people visit and what they read. A tracking blocker or Do Not Track will stop it, and the product behaves identically either way.
Payments
If you subscribe, payment is handled by Stripe. Card details are entered on Stripe's own checkout and never reach our servers; we store only the customer and subscription identifiers Stripe gives us, so we know whether an account is active.
How it is protected
- All traffic is encrypted in transit over HTTPS.
- Plaid access tokens are encrypted at rest with a key held outside the database.
- Passwords are stored as bcrypt hashes and are never recoverable.
- Repeated failed sign-ins lock the account temporarily and throttle the source.
- Password reset links are single-use, expire within an hour, and only a hash of the token is stored.
- Every record belongs to one account, and access is enforced on every request. Accountants can be given read-only access that cannot change anything.
How long we keep it
Statements, transactions and rules are kept until you delete them or close your account, because bookkeeping records are useful across tax years. Sign-in attempt records are deleted after one day. Password reset tokens expire within an hour.
Deleting your data
Write to privacy@annalis.ai from the email address on the account and we will delete the account, its statements, transactions, rules and any bank connections within 30 days, and confirm when it is done. You can remove individual bank connections yourself at any time.
Your rights
You can ask what we hold about you, ask us to correct it, and ask us to delete it. Most of it is visible in the application already: every transaction, every stored statement and every rule can be viewed and exported as CSV whenever you like.
Changes
If this policy changes materially we will email the account owner before the change takes effect. The date at the top always reflects the current version.