Privacy policy.

Updated 31 October 2026. FolioTern’s operator is responsible for the personal data processed to run this service. Contact the operator and the person responsible for privacy through the support form; use “Privacy request” as your subject. This policy describes what the service does, rather than promising that online processing is risk-free.

Local file tools

Spreadsheet, PDF page and image tools process supported source files in your browser. Running those local tools does not upload source files or table rows. Files and results stay in page memory and clear on reload or navigation; downloads remain on your device. Saving a spreadsheet workflow sends its name, column labels, rules, mappings and defaults to account storage. Do not include sensitive information in settings you choose to save.

Accounts and saved workspaces

Sign-in provides a site-specific account identifier and email used to secure your records and support billing. Explicitly saving a workspace uploads its tasks, money records, projects, notes, contacts, requests and rule history to the hosted database. The separate bank statement converter uploads extracted financial tables only when you choose Save to account; local conversion does not require saving them.

Workspace members can read its contents. Owners control invitations and decisions; editors can change permitted records and viewers can export. Invitations use expiring, one-use tokens stored as hashes. We store member identifiers, roles, revisions and recent action metadata to enforce access and resolve conflicts. Removing a member blocks future account access but cannot recall previous downloads.

AI receipt and bill scanning

Only when you select a document and explicitly consent to scanning, a resized image is sent through our server to OpenAI to extract a draft. Do not upload documents you are not authorised to process. Remove unnecessary personal details first. FolioTern does not save the image as an account attachment or include it in application logs. OpenAI may process or retain API data under its applicable security, abuse-monitoring and data-control policies; setting a response not to be stored does not promise zero provider retention.

We store the extracted draft, the submitting account, target workspace, time, status and an image fingerprint used to reduce duplicate processing. Drafts are available for seven days; expired draft records are removed during routine processing. You can delete an available draft. A confirmed expense or bill becomes part of the workspace and remains until you remove it there. Deleting a draft does not remove a confirmed transaction or change a completed scan’s usage count.

Reports and premium access

Paid reports process saved records on the server. The server checks paid status, account identity and workspace permissions. Team members can generate eligible reports only for workspaces they can access. The Teams command centre includes only workspaces owned by the signed-in account; financial totals remain separated by currency. Decision actions record the actor and date. We store subscription identifiers, status and period end to control plan access.

Billing

Stripe processes card and payment details. FolioTern stores the customer and subscription identifiers, selected plan, payment status and related billing-event identifiers; we do not store full card numbers. Stripe may process information as described in its privacy policy. Financial and tax record retention may be required by law even after you stop using the service.

Support messages

The public support form collects the email, subject and message you submit, a reference and the time. A signed-in support request also links to your account. Messages are stored for operator review. Where email delivery is configured, our sending provider, Resend, forwards the submitted information to the operator’s private support mailbox. The operator’s personal Gmail address is not included in the public page or public API response.

We use your contact details to handle the request, not to automatically enrol you in marketing. Signed-in replies appear in support history; the operator may also respond to your supplied email. Do not send passwords, card details, identity documents or sensitive source-file contents. Signed-in tickets can be closed or deleted from the website. For a public message, quote its reference to request access, correction or deletion.

Security and service operation

Hosting and network providers process the information needed to deliver the website, including connection details and technical logs. We use access controls, HTTPS, request limits and bounded processing. Support spam prevention uses a daily hash of the connection address rather than storing the raw address in the message record. We retain delivery status and provider references to avoid duplicate notifications. Optional aggregate spreadsheet usage counters do not contain file contents and are disabled unless the operator enables them.

Purposes, service providers and transfers

We process information to provide requested features, authenticate accounts, handle subscriptions, answer support, prevent misuse, maintain security and comply with law. Necessary providers include website hosting and storage, sign-in, Stripe for payments, OpenAI for scans you approve and Resend for configured support delivery. Processing may occur outside Singapore. We use appropriate contractual and operational safeguards where required for international transfers; ask us for information about the arrangements relevant to your data.

We do not sell your workspace records or use your private files for advertising. This website does not connect a bank account, search your inbox or cancel outside subscriptions. External services you visit through a link operate under their own policies.

Retention and your choices

Keep independent copies of important records. Unsaved browser drafts disappear on navigation or reload. Saved records remain until deleted, account closure is processed, or a lawful retention or service-closure policy applies. Deleting active records does not necessarily erase infrastructure backups immediately; backup retention and legal obligations can delay final deletion. We restrict retained data to the relevant purpose.

You can export workspace data, control membership and delete supported saved records. Contact privacy support to request access, correction, deletion, withdrawal of consent or information about processing. We may verify your identity before acting and explain any lawful reason we cannot fully comply. Withdrawal may prevent the feature that needs the data from operating. Mandatory rights under applicable data-protection law remain unaffected.

Cookies and updates

Sign-in and security may use necessary cookies or equivalent browser mechanisms. Local file processing does not require advertising trackers. We will update this policy and its date when processing changes materially, and provide additional notice where required. Privacy and data-protection enquiries: contact FolioTern.