Privacy notice
Last updated: 28 October 2026. CSV Repair annual licence.
Who to contact
CSV Repair offers an annual licence for £99 GBP, valid for 365 days without automatic renewal. Contact suporte@api.rohnelt.dev for privacy questions and rights requests.
Statements stay on your device
Statement bytes, file names, column mappings, transaction details and repaired CSVs are processed in memory in your browser. The browser workbench does not upload statements and has no third-party analytics, external fonts, tracking cookies or browser persistence. Clear the statement, reload or close the tab to discard its in-memory copy. Downloads and original files remain on your device until you delete them.
Server requests
The server receives ordinary connection information such as IP address and user agent when you visit; hosting infrastructure may log request metadata for security. Never put financial information or licence keys in URLs. Licence validation sends only the key in an authorisation header. It does not send any part of the CSV. Keys are held in tab memory and stored as SHA-256 hashes on the server, not as plaintext keys. The server stores payment/session references, payment status, delivery status, expiry, webhook event identifiers and revocation records for issued licences. It does not need your statement or bank credentials. For requested transactional licence delivery, your email and licence are transmitted through our email bridge to Resend. Your email is not stored in the application licence records; delivery status is stored to prevent duplicate sends. A private server nonce enables licence recovery for the confirmed return page.
Purposes, basis and retention
Necessary licence processing supports performance of a contract; abuse prevention relies on legitimate interests; mandatory financial records rely on legal obligations. No marketing consent is collected or marketing email sent. The application currently has no automatic deletion schedule: payment/session references, licence hashes, recovery nonces, expiry, delivery flags, webhook identifiers and revocation records remain in its private licence file after expiry until manually removed. Email addresses are used for delivery and are not saved in that file. Hosting and email-provider logs have separate retention controls; we do not promise a fixed deletion period for those logs. Support can assess a deletion request and explain any records that must remain for an unresolved payment, dispute or legal obligation. Requests for deletion are assessed against outstanding delivery, fraud prevention and legal retention obligations.
Recipients and international processing
The application is hosted on infrastructure in Brazil. No payment processor receives statement contents from this tool. Stripe processes your checkout email, payment details and payment records under its privacy notice. Card details are not received or stored by this application. Requested licence emails pass through our transactional email bridge to Resend, which processes the recipient address and message. Stripe and Resend may process data outside your country under their own applicable terms and privacy policies. We do not claim GDPR certification or additional transfer safeguards that have not been established.
Optional remote CSV sample
The free MCP tool and /csv-repair/validate API receive only the CSV sample you explicitly send: at most 20 data lines plus a header, up to 16,000 bytes. Unlike the browser workbench, this sample is processed on the server in request memory. The application does not save or log the sample, repaired CSV or tool result. Use synthetic or redacted data. Connection metadata may still be logged by hosting infrastructure. Your MCP client or AI provider may retain its conversation under its own policy.
Your rights
Subject to applicable law, you may request access, correction, erasure, restriction, portability and object to legitimate-interest processing. Contact support with a payment reference if relevant; do not send your bank statement. You may complain to the UK ICO, your EEA supervisory authority or Brazil’s ANPD. We do not use automated decisions producing legal effects or sell personal data. The service is intended for adult business users.