SwipeAuditMerchant statement intelligence

Privacy & data handling

Effective September 27, 2026

This notice explains how SwipeAudit LLC ("SwipeAudit," "we," "us," or "our") handles information when you use SwipeAudit. Questions or privacy requests may be sent to support@swipe-audit.com.

Information we collect

  • Account information: email address, password hash, account dates, and sign-in session records.
  • Statement information: the PDF temporarily, its extracted text, filename, information appearing in it, and audit results derived from it.
  • Billing information: purchase, credit, subscription, and billing-status records received from Stripe. SwipeAudit does not receive or store your full card number.
  • Technical and usage information: signed visitor and session identifiers, timestamps, request and error information, and a one-way hash derived from an IP address for abuse prevention.
  • Communications: messages and support information you choose to send.

What happens to your statement

  1. You upload a PDF, which is written to a temporary location on our server.
  2. The free compatibility check extracts PDF text on our server to identify known unsupported formats. It does not send the text to Anthropic or use an audit credit.
  3. If you start a full audit, statement text is sent to Anthropic's API, a third-party AI service, to identify statement line items. Those line items are checked against SwipeAudit's rate-reference data on our server.
  4. The uploaded PDF is deleted when processing finishes, whether the audit succeeds or fails.

Statement text sent to Anthropic may include a business name, merchant ID, transaction totals, and other information in the document. You may redact your merchant ID and business name before uploading; SwipeAudit does not need them to analyze fees. If third-party AI processing is not acceptable for your business, do not upload a statement.

How we use information

  • provide audits, saved reports, account access, billing, and support;
  • authenticate users, prevent duplicate free-audit use, detect abuse, and protect the service;
  • send password-reset, account, billing, and service communications;
  • email a summary of a completed audit to the address on your account;
  • diagnose errors, maintain the service, and understand whether features work; and
  • comply with law, enforce our Terms, and protect rights and safety.

Saved reports

Anonymous audit reports are not saved to an account. For signed-in users, we save derived audit results and statement-level summaries, including the source filename, but not the uploaded PDF. SwipeAudit does not persist extracted statement results in a separate processing cache.

Report delivery by email

When a signed-in account completes an audit, SwipeAudit emails a short summary to that account's email address. The summary includes the statement period, any effective rate that could be established or an explanation for withholding it, the pricing-model finding, and counts of the items surfaced, together with a link back to the full report. It does not include the full line-item detail, because email is not a confidential channel. Anonymous audits are never emailed, since no address is collected for that purpose.

AI-assisted questions and support

If you use an AI-assisted question or support feature, the message you submit is sent to Anthropic's API to generate a response. The support assistant may also receive limited access context, such as whether you are signed in, the type of audit access on the account, and how many audits remain. It does not receive your email address, statement PDF, full report, payment-card information, password, or API keys through that context. SwipeAudit does not save these assistant conversations in its application database.

Backups

SwipeAudit maintains scheduled backups of its database so that accounts, purchased audit access, and saved reports can be restored after a failure. Backups contain the same categories of information described above. Local backup copies use rolling retention and older local copies are removed automatically. Where configured, a copy is also stored with a third-party object-storage provider so that a single hardware failure cannot destroy all copies; retention of those off-site copies follows the lifecycle settings configured with that provider. Backups are not used for any purpose other than restoring the service.

Cookies and similar technology

SwipeAudit uses first-party cookies needed to operate the service. A signed visitor cookie supports the one-free-audit limit, and a secure, HttpOnly sign-in cookie keeps an account signed in for up to 30 days. These are functional and security cookies, not advertising cookies. SwipeAudit does not currently use third-party advertising trackers.

Service providers and disclosures

  • Anthropic: statement text for AI-assisted extraction, and messages plus limited access context submitted through AI-assisted question or support features;
  • Stripe: account and transaction information needed to process payments and manage subscriptions;
  • Resend: email address and message content needed to deliver transactional email; and
  • Object-storage provider (where configured): encrypted-in-transit copies of database backups held for disaster recovery;
  • Hosting and infrastructure providers: information processed while hosting, securing, and operating the service.

We may also disclose information when required by law, to protect rights or safety, investigate fraud or abuse, or as part of a merger, financing, reorganization, or sale. We do not sell statement data or provide it to payment processors or data brokers for their own marketing.

Retention

  • Uploaded PDFs are deleted when processing finishes.
  • Active sign-in sessions expire after up to 30 days. Expired or revoked authentication records and obsolete password-reset records are periodically removed.
  • Saved reports remain until you delete them or the associated account data is deleted.
  • Local database backups use rolling retention. Off-site backup retention follows the storage provider lifecycle configured by SwipeAudit. Information you delete may persist in a backup until the applicable backup is removed.
  • Account and billing records are kept while needed to provide the service and afterward as reasonably necessary for security, disputes, accounting, tax, and legal obligations.

Your choices

You can delete an individual report from My Audits and download your saved reports and account/billing history from Your Account. The download excludes password hashes, security tokens, abuse-prevention records, and Stripe object IDs. You may request correction or deletion of other account information by emailing support@swipe-audit.com. We may verify the request and retain information where required or permitted for legal, security, accounting, or fraud-prevention purposes. Local law may provide additional rights.

Security

SwipeAudit uses measures intended to protect customer information, including one-way password hashing, hashed session and reset tokens, secure HttpOnly cookies in production, account-scoped report access, and deletion of temporary PDFs. No system is completely secure, and we cannot guarantee information will never be accessed, lost, or disclosed without authorization. SwipeAudit has not completed SOC 2 or a comparable independent security audit and does not claim otherwise.

Children

SwipeAudit is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us.

Changes to this notice

We may update this notice as the service or legal requirements change. We will post the updated version with a new effective date and provide additional notice when required by law.

Contact

SwipeAudit LLC
Email: support@swipe-audit.com