What happens to a statement, step by step.
This page says what is true about how statements are handled and what is not. It makes no claim the service does not hold.
Where the PDFs are stored.
Uploaded PDFs are stored on Cloudflare R2 under a key that belongs to your account. R2 encrypts every object at rest. Exports and client summaries are stored the same way. Those made on request expire after 24 hours, and the download links for a finished batch's files last 30 days. Statement files, rows, and checks are stored only on Cloudflare. Pages are sent to Anthropic's API to be read, and to OpenAI's API only when the fallback is on. Your email address is also held by Resend to send mail and by Stripe for payments.
Who reads the pages.
The text of each page is sent to Claude Haiku 5.5 from Anthropic, through Anthropic's API, to be read into rows. For scans, the page is sent as an image. The call uses a fixed schema, so the model can only answer in rows. It runs under Anthropic's API terms. Ledgerfoot does not use your statements to train anything. When Ledgerfoot has the fallback on, a page that could not be read may go to OpenAI's API. The batch page says when it was used. OpenAI's terms govern that call. The Privacy page lists both providers.
How long files stay.
Uploaded PDFs are deleted after 30 days by default. Pro accounts can set 7 to 90 days, or keep them until deleted. A reminder email goes out three days before a deletion. The extracted rows, the checks, the exceptions, and the rules stay while your account exists. Exports made on request expire after 24 hours, and a finished batch's download links after 30 days.
What deleting does.
Deleting a workspace deletes its PDFs from storage, then its rows, exceptions, rules, and exports from the database. Deleting your account does the same for every workspace, then deletes the account, the sessions, and the sign-in records. Payment records stay with Stripe, as tax law requires. Nothing about you stays in Ledgerfoot's database.
How signing in works.
Email and a six-digit code, no password. Codes and session tokens are stored only as keyed hashes. A session lasts ninety days on one browser and can be ended from the account page.
What this page does not say.
Ledgerfoot has not been audited by a third party and does not claim to have been. It is a small service run by one person on Cloudflare's platform. This page says what is encrypted, what is sent where, and what is deleted when, and nothing more. If your engagement requires an audited vendor, this service is not the right fit yet.
Found something?
Write to brett@nexusmktg.com with what you found. Brett reads every message himself.