Privacy Policy
Last Updated: September 24, 2026
At Excel to Pain.001 ("we", "our", or "us"), operated by Handx OÜ, we take your privacy and data security seriously. This Privacy Policy explains how we handle your information when you use our website https://www.exceltopain001.com.
The data controller responsible for the processing described in this policy is Handx OÜ. Full company details, including our registration number and registered address, are published on our Imprint page.
1. Data Processing (Client-Side by Default)
Our Privacy Commitment:
The free Converter and our XML/NACHA Validators are designed to process your file entirely in your browser — your file is never uploaded to our servers for these tools. Three optional, separate features work differently and are described below: the AI address-parsing feature, our Developer API, and the Payroll product.
- No File Uploads (Converter & Validators): Your Excel, CSV, XML or NACHA files are parsed and converted entirely within your web browser (Client-Side).
- No Server Storage (Converter & Validators): For these tools we do NOT upload, store, or save your financial data, bank details, or transaction records on our servers.
- Offline Capability: Once the application is loaded, the conversion process can technically run without an active internet connection (excluding the payment step).
The generated XML file is created locally on your device and is available for download immediately.
Exceptions — where data is sent to a server:
- AI address-parsing (opt-in): If you map a column to the "Full Address (AI-Parse → Creditor)" field and run the parser, the text in that column is sent to OpenAI for parsing. We show an in-app notice at the point you use this feature; see Section 3 for details. No other column or file data is sent.
- Developer API: Our REST API (
/api/v1/*) is a server-side product by design — files or transaction data you send to it are processed on our servers to generate the output file. If you use an Idempotency-Key with a request, the response is cached in our database for 24 hours to support safe retries. - Payroll product: If you use the authenticated Payroll feature to save recipient lists, recipient names, IBANs and BICs are deliberately stored server-side (encrypted, hosted in the EU) so they can be reused for future pay runs. Individual salary amounts are not stored as database records; they exist only inside your generated file, which is auto-deleted after 90 days.
2. Information We Collect
Since we do not process your files on our servers, the only information we collect is related to the operation of the service, payments, and analytics:
- Payment Information: If you choose to pay for a premium conversion, your payment is processed securely by Stripe. We do not store your credit card details. Stripe provides us with a confirmation of payment and your email address for receipt delivery.
- Usage Analytics: We use Google Analytics (GA4) to understand how visitors interact with our website (e.g., page views, session duration). This data is anonymized and does not contain your financial file content.
- Contact Information: If you email our support team, we will have your email address and any information you choose to provide in your message.
3. Third-Party Services
We use trusted third-party service providers to operate our business:
- Stripe: Processes your payment when you buy a conversion or subscribe. We do not store your card details. Please review Stripe's Privacy Policy.
- Supabase: Hosts our account database and authentication. If you create an account, your email, saved mapping profiles, API keys, Payroll recipient lists (name, IBAN, BIC), and team membership data are stored with Supabase. Please review Supabase's Privacy Policy.
- OpenAI: Powers two opt-in features: the AI address-parsing tool (sends the text of the column you map to it) and AI column-mapping suggestions (sends only your file's column header names, never row data). Used only when you actively trigger these features. Please review OpenAI's Privacy Policy.
- Resend: Sends transactional emails, such as team invitations, on our behalf. Processes the invited recipient's email address. Please review Resend's Privacy Policy.
- Gmail / Nodemailer: We use a Gmail account via SMTP to send ourselves internal notifications when a new lead starts checkout (your email address and selected plan). This is an internal operational notice, not marketing email to you.
- Google Analytics (GA4) & Google Ads: For website traffic analysis and measuring ad conversions. Only loaded with your consent (see Section 4). Please review Google's Privacy Policy.
- Microsoft Clarity: Provides anonymized session-replay and heatmap analytics on our marketing pages, so we can see how visitors use the site. It never loads on the authenticated
/apparea, and only loads after you accept cookies (see Section 4). File-content areas of the Converter and Validators (data previews, mapping, validation results) are masked so their content is never captured. Please review Microsoft's Privacy Statement.
4. Cookies
We use essential cookies to maintain your session state (e.g., to remember if a payment has been completed during your visit) and analytical cookies via Google Analytics to improve our service. You can control cookie preferences through your browser settings.
5. Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have rights regarding your personal data. Since we process your files locally and do not store them, we do not hold your financial data. For data held by our payment processor or analytics provider, or for your contact email, you have the right to access, correct, or request deletion of your data.
6. Contact Us
If you have any questions about this Privacy Policy, please contact us at: