Privacy Policy

This policy covers merchantstatementanalyzer.com: the statement analyzer, its reports, the effective rate calculator and the guides. The site is run by Tap Simple, LLC ("we", "us"). Tap Simple's other services are covered by its own policy at tapsimple.com/privacy-policy.

The short version

• You upload a card processing statement. An AI service reads it so we can show your figures and explain every fee.
• If you give us your contact details for the full report, Tap Simple may contact you about card processing. You can say no at any time.
• We do not sell your information for money. We will use advertising cookies to measure and show our ads, and you can opt out.
• We keep de-identified copies of some statements to train our statement reading. Staff prepare them by hand.
• Statements and what is read from them are deleted 90 days after upload. Your contact record is deleted 180 days after your last visit.
• Email [email protected] to see, correct or delete your information.

What we collect

From the statement you upload:

• the statement PDF;
• what is read from it: the business name and address, the processor, merchant and account identifiers printed on it, card sales, fees, each fee line and the statement period.

We refuse statements that print a full card number, and we do not store them.

When you ask for the full report:

• your first and last name, email, mobile number and role (owner, agent or someone else);
• whether you want news and tips from Tap Simple by email.

If you make a custom report:

• the name, contact details, website, color and logo you add to it.

If you pay for a custom report:

• our payment processor collects your card details in its own secure form. We never see or store your card number or security code. We keep the amount, the date, the result, the card brand and its last four digits.

When you use the site:

• your IP address, browser type, the pages you visit and when, and a record of each upload;
• the campaign that brought you here, if any (for example an ad's tracking code or the referring site). We drop anything in those values that looks like an email address or phone number;
• a record that you accepted our Terms and this policy, with the version, the time, your IP address and browser.

The effective rate calculator:

• the numbers you type are not saved to any record. Like any web address, the calculator's page address (which holds your numbers) can appear briefly in our server logs.

How we use it

• To read your statement and prepare your figures, report, custom report and PDF.
• To send you the report or link you ask for.
• To contact you about Tap Simple's card processing services, if you gave us your contact details and are not an agent. You can ask us to stop at any time.
• To send news and tips by email, only if you ticked the box.
• To check and improve the analyzer: our staff may review a statement and its reading to fix mistakes and improve how statements are read.
• To train AI models that read statements, using de-identified copies only (see below).
• To measure our advertising and show our ads to people who may be interested, including on other sites (see Advertising).
• To keep the site secure, prevent abuse and fix problems.
• To meet legal obligations and enforce our Terms.

Training on de-identified statements

We keep statements to train and improve the AI models that read statements, until the statement is deleted on the schedule below. Training is done by hand, never automatically:

• staff choose a statement and make a de-identified copy of it, removing business and personal names, addresses, contact details, merchant, bank and account numbers, signatures and logos;
• only de-identified copies are used for training, including training an AI model through a provider such as OpenAI;
• the original statement is never used for training and is deleted on the schedule below.

A de-identified copy no longer identifies you or your business, so we may keep it after the original is deleted.

Who we share it with

We do not sell your personal information for money. We share it for advertising only as described under Advertising, and you can opt out.

We share it only with companies that work for us, under contracts that limit what they can do with it:

• OpenAI, which reads your statement. It receives the statement's text and images of its pages. Under OpenAI's API terms, this data is not used to train its models, and OpenAI may keep it for up to 30 days to monitor for abuse.
• GoHighLevel, our customer records system. Once you give your contact details, it receives them with your business name, processor, statement figures, your role and the campaign that brought you here.
• Mailgun, which sends our emails.
• Sevalla, which hosts the site, its database and stored files.
• Cloudflare, which delivers the site and protects it from attacks.
• Our payment processor, North (PayAnywhere), for paid custom reports.
• Google, if we use Google Analytics or Google Tag Manager to measure how the site is used.
• Advertising partners such as Google and Meta, as described under Advertising.

Analytics and advertising tools are not loaded when your browser sends a Global Privacy Control signal.

We may also share information when the law requires it, to protect our rights or users, or as part of a merger, sale or transfer of our business.

Uploading someone else's statement

If you upload a statement that belongs to another business, for example as its agent, you confirm that you have its permission to do so.

Advertising

We will use advertising cookies, pixels and similar tools from partners such as Google and Meta. They tell us which ads brought people to the site and whether they used the analyzer, and they let us show our ads to people who visited, on other sites and apps. These partners collect your IP address, browser and device details and the pages you visit here. They never receive your statement, its figures or the contact details you give us.

Some state laws call this "selling" or "sharing" personal information, or "targeted advertising". You can opt out at any time:

• turn on Global Privacy Control in your browser, and we will not load these tools;
• block or delete cookies in your browser settings;
• or email [email protected] and ask us to opt you out.

How long we keep it

• Statement PDFs and what is read from them: 90 days after upload. This includes any original statement kept for training.
• De-identified training copies: as long as they are useful, since they no longer identify you.
• Your report, contact details and the records tied to them: 180 days after your last visit.
• Your session on the site: 7 days after your last visit.
• Records of each upload, with the IP address: 90 days.
• Encrypted backups: 35 days.
• Your contact record in our customer records system: until you ask us to delete it.
• Payment records: as long as we need them for accounting, tax and card network rules.
• Records of what you agreed to, and of your requests to us: as long as we need them to show what was agreed and answered.

Your choices and rights

• Email us at [email protected] to see the information we hold about you, correct it, or delete it.
• To stop hearing from Tap Simple, reply STOP to a text, use the unsubscribe link in an email, or email us.
• To opt out of advertising cookies and of "sale" or "sharing" for advertising, see Advertising above.
• Depending on where you live, you may have other rights under state law, such as the right to know what we collect and to not be treated differently for using your rights.

We answer within 45 days. To protect you, we confirm a request by replying to the email address on file.

Cookies and browser storage

• A session cookie keeps your analysis together while you use the site. It lasts 7 days after your last visit.
• A cookie with a random number counts the statements uploaded from your browser each day, to stop abuse. It lasts 30 days.
• Your browser keeps the campaign that brought you here for up to 90 days, so a later visit is counted correctly.
• If we use Google Analytics, it sets its own cookies.
• Advertising partners set their own cookies and pixels, as described under Advertising.
• A Global Privacy Control signal turns off analytics and advertising tools, and so do your browser's cookie settings.
• If you pay for a custom report, our payment processor's form may use its own cookies and device checks to prevent fraud.

How we protect it

• The site is served only over encrypted connections (HTTPS).
• What is read from your statement is stored encrypted. Stored files are private and opened only through short-lived links.
• Only staff who need it can see your information, and staff access to sensitive information is recorded.

No system is perfectly secure, but we work to protect your information and will tell you if the law requires us to after a breach.

Children

This site is for businesses and people 18 and older. We do not knowingly collect information from children.

Changes to this policy

When we change this policy, we post the new version here with a new date. If the change is significant, we ask you to accept it again before your next upload.

Contact us