Privacy Policy

Last updated: July 1, 2026

1. What Data We Collect

Account data: Email address and password (stored as an Argon2 hash — we never see your plain-text password).

Receipt data: Receipt and invoice images you upload, plus extracted fields (vendor, date, amount, category).

Usage data: Page views, feature usage, and error logs for service improvement.

2. How We Use Your Data

• To process and categorize your receipts
• To export data in formats you request (CSV, PDF)
• To improve service accuracy and reliability
• To communicate service-related notices (password resets, invitations)

3. AI Processing Disclosure

Receipt images are sent to Anthropic Claude for text extraction and categorization. Under our current plan, images are processed transiently and are not retained by Anthropic. We never share your data with other third parties for training or marketing purposes.

4. Data Storage

Data is stored on our Hostinger VPS (Frankfurt, Germany) in an encrypted SQLite database. Export files are stored for 30 days. Backups are retained for 30 days.

5. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access: Request a copy of your data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data
• Portability: Receive your data in a machine-readable format

To exercise these rights, contact your organization's account administrator.

6. Cookies

We use essential session cookies for authentication. No tracking or analytics cookies are used. You can control cookies through your browser settings.

7. Third-Party Services

• Anthropic Claude — AI receipt processing (transient)
• SendGrid — Transactional email (password resets, invitations)
• Sentry — Error monitoring (opt-in, configured via environment variable)

8. Data Breach Notification

In the event of a data breach affecting your personal data, we will notify affected users within 72 hours.

9. Contact

For privacy-related inquiries, contact your organization's account administrator.