Privacy Policy

We collect the following categories of data:

• Account information — name, email address, organisation name, hashed authentication credentials and, for paid plans, billing details.
• Uploaded documents — receipts, invoices, bills, and bank statements that you or your team upload for processing, together with any data extracted from them (supplier names, amounts, dates, VAT information, etc.).
• Usage data — log data such as IP address, device and browser type, pages visited, and actions taken within the application, used to secure and improve the Service.

We process personal data to:

• provide, operate, and maintain the Service;
• perform AI extraction, categorisation, duplicate detection and export of your financial documents;
• manage billing, authentication, customer support and account communications;
• monitor and improve the security, reliability, and accuracy of the Service;
• comply with legal and regulatory obligations.

Our lawful bases under UK GDPR are performance of a contract, legitimate interests (running and securing the Service), and, where applicable, your consent or compliance with a legal obligation.

We rely on a small number of vetted sub-processors to operate the Service. Each is bound by contractual data-processing terms:

• Google Document AI — optical character recognition and structured extraction of uploaded documents.
• OpenAI and Google Gemini — large-language-model processing for classification, summarisation, VAT categorisation and duplicate detection. Uploaded content sent to these providers is not used to train their public models.
• Supabase — managed database, authentication and file storage hosting our application data in the EU/UK region.
• Stripe — subscription billing and payment processing. Card details are handled by Stripe directly and never reach our servers.

We retain Customer Data for as long as your account is active. If you cancel your subscription, your data remains available for export for 30 days, after which it is permanently deleted from our live systems and, within a further 90 days, from backups. Billing records are retained for the period required by UK tax law (currently six years).

You have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data or completion of incomplete data;
• request deletion of your data (the “right to be forgotten”);
• receive a portable copy of your data in a common machine-readable format;
• object to or restrict certain processing, including processing based on legitimate interests;
• lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Data is encrypted in transit using TLS 1.2+ and at rest using industry-standard AES-256. Access to production systems is limited to a small number of authorised personnel and protected by multi-factor authentication. We monitor our infrastructure continuously and apply security patches promptly.

We use a limited set of strictly necessary cookies to keep you signed in and to secure the application. Please see our Cookie Policy for details.

Our primary data storage is located within the UK/EU. Some AI sub-processors listed above may process data in the United States; such transfers are covered by the UK-US Data Bridge, the EU-US Data Privacy Framework, and/or Standard Contractual Clauses approved by the UK ICO, providing appropriate safeguards under UK GDPR.

To exercise any of your rights, or if you have questions about how we handle your data, contact us at receiptx9@gmail.com. We aim to respond to all requests within 30 days.