Private upload and retention

Unlike the local CSV Repair browser tool, Done-for-You uploads your records for automated processing and encrypted storage in Brazil. Do not upload until intake is open and your email is verified. Contact: suporte@rohnelt.dev.

Purpose and roles

You normally act as controller of bank transaction records and authorise this service as processor under the processing terms. We separately use your delivery email, consent/terms record and minimum payment references to fulfil the service, secure access, support requests and meet legal obligations. Supply only records you are authorised to disclose. Do not supply credentials or special-category/sensitive personal data.

Protection and recipients

Private data is encrypted with AES-256-GCM at rest in a private directory with restricted permissions. Access codes and session tokens are stored as hashes; portal cookies are Secure, HttpOnly and SameSite=Strict. Package downloads require authentication. Financial files are not sent to analytics, external AI systems or email providers. The transactional email bridge uses Resend for email address, brand and non-financial message content. Stripe handles payment information under its own terms; bank statement files are not sent to Stripe. Hosting and processing occur in Brazil.

Retention and deletion

Unpaid or abandoned intake expires after 24 hours. Paid originals/results expire 14 days after delivery; a failed paid queue also expires after 14 days. Cleanup runs at startup, on requests and at least once daily while the service is running. The portal permits earlier deletion. We do not back up bank-file content. Deletion removes access and can prevent correction investigations; keep your originals. Minimal payment-event records may be retained separately for fraud prevention and mandatory obligations, without financial files. This is not a financial archive.

International processing and rights

UK intake is blocked until the applicable transfer mechanism, assessment and supplier arrangements are verified. EU adequacy does not automatically establish UK adequacy. Other regions are not released by this page. For AU intake, you must have authority and satisfy applicable disclosure/transfer requirements. Contractual acceptance does not waive legal duties.

Request access, correction, deletion, restriction, export or help with rights by contacting support from your verified address. We assist controllers with data-subject requests, security incidents and lawful regulatory inquiries. We will inform affected controllers without undue delay after becoming aware of a personal-data breach and cooperate with their legal obligations. You may complain to the competent data-protection authority. Do not place financial data in URLs or support email; use the private portal for provider errors.