Privacy Policy

1. Introduction

Receiptu B.V. ("Receiptu," "we," "us," or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains: what personal data we collect, why we collect it, how we use and share it, your rights under applicable privacy laws (such as the EU General Data Protection Regulation – GDPR), and how to contact us.

By using our website and services at receiptu.com and related services ("Services"), you agree to the collection and use of your personal data as described here.

2. Who We Are

Receiptu

Email: [email protected]

We are the data controller for the personal data described here, unless otherwise stated.

3. What Personal Data We Collect

We collect personal data that you provide directly and data collected automatically during your use of the Services.

Data you provide when you create an account or contact us

• Name
• Email address
• Billing information (if you subscribe)
• Support and communication content

Data created or uploaded by you

• Client Data (uploaded receipts, files, metadata used within Receiptu services)

Data collected automatically

• Device and usage data (IP address, browser type, device identifiers, analytics data)
• Cookies and tracking technologies (used for essential functionality and analytics)

Data obtained from third parties

• If you choose to log in through or integrate with a third party (for example Google or a payment processor), we may receive data from them as permitted by law and by the permissions you grant.

4. Google Account and Gmail Data

If you choose to connect Gmail, Receiptu requests access to Google user data only after you approve Google's consent screen. Connecting Gmail is optional. You can use Receiptu without connecting a Google mailbox.

Google permissions we request

• Your Google Account email address (userinfo.email), so we can identify the connected mailbox.
• Read-only access to Gmail messages and attachments (https://www.googleapis.com/auth/gmail.readonly), so we can find receipts and invoices.

What we store when you connect Gmail

• Your Google Account email address.
• Encrypted OAuth access and refresh tokens, so we can keep scanning the mailbox until you disconnect.
• For messages that look like receipts or invoices: sender (From), subject, date, Gmail message ID, and matching PDF or image attachments.
• A scan log of Gmail message IDs we already looked at (folder, date, and status), so we do not scan the same message twice.

What we do not store

• We do not copy your whole inbox or Sent folder.
• We do not store email bodies or the contents of messages that are not treated as receipt or invoice candidates.

How we use this Google user data: we scan the connected Inbox and Sent folders for messages with attachments that look like receipts or invoices. We download those attachments into your Receiptu account as import suggestions. If you accept a suggestion, we process the document with our OCR providers and store the extracted bookkeeping fields in your account, the same way we handle documents you upload yourself.

What we do not do with Google user data: we do not send, modify, label, or delete your Gmail messages. We do not use Google user data for advertising, for selling data, or to train general-purpose AI or machine-learning models. We do not transfer Google user data to other apps except to our processors that help us provide this feature, such as EU cloud hosting and OCR extraction, and only as needed to import and process the documents you import.

Human access: Receiptu staff do not read your Gmail messages or attachments except where needed to investigate a security issue, to fix a problem you report, to comply with law, or when you explicitly ask us to look at a specific item for support.

You can disconnect Gmail in Receiptu at any time. You can also revoke Receiptu's access in your Google Account permissions (https://myaccount.google.com/permissions). After disconnect, we stop scanning that mailbox. Documents you already imported remain in your Receiptu account until you delete them, subject to the retention rules below.

Receiptu's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

5. How We Use Personal Data

We use personal data for the following purposes:

• To provide and operate the Services (user authentication, account management, billing and payments)
• To import receipts and invoices from a Gmail mailbox you choose to connect (read-only)
• To improve the Services (analytics, performance monitoring, bug detection)
• To communicate with you (support responses, product updates)
• To comply with legal obligations (taxes, accounting, audits)

We do not sell your personal data to third parties.

6. Legal Bases for Processing (GDPR)

We rely on the following lawful bases where applicable:

• Contractual necessity: to provide the Services you requested.
• Legitimate interests: for analytics and improving the Services.
• Consent: where required (for example cookie tracking, or connecting your Gmail mailbox).
• Legal obligation: to comply with financial and regulatory requirements.

7. Cookies and Tracking

We use cookies and similar technologies to:

• Enable essential site functionality
• Collect analytics about usage

If you are subject to GDPR or similar laws, we will ask for your consent where required before placing non-essential cookies. You can control cookie preferences in your browser settings or via our cookie banner.

8. Data Sharing and Third Parties

We share personal data only as necessary to:

• Provide the Services (e.g., cloud hosting providers)
• Extract data from receipts and invoices you upload or import from Gmail (via trusted OCR providers)
• Process payments (via trusted payment partners)
• Comply with law or respond to lawful requests

We require our third-party partners to maintain appropriate security and to process data only as permitted.

9. Data Retention

We keep your personal data only as long as needed:

• To provide the Services
• For legal, tax, or accounting reasons
• As permitted under applicable data retention rules (e.g., up to 7 years for accounting records)
• Gmail connection tokens and scan logs only while the mailbox stays connected, or as needed to operate the import feature and investigate issues

10. Your Rights

Depending on your location, you may have rights including:

• Access: ask what personal data we hold about you
• Correction: fix inaccurate or incomplete data
• Deletion: request removal of your data
• Portability: receive your data in a common format
• Object to processing: ask us to stop certain uses

To exercise your rights, contact us at [email protected]. We will respond within applicable legal time frames.

If you are in the EU, you also have the right to lodge a complaint with your local data protection authority.

11. Security

We implement reasonable technical and organizational safeguards to protect personal data from unauthorized access, disclosure, alteration, and destruction. However, no system is 100% secure.

12. Children's Privacy

Our Services are not intended for children under 16. We do not knowingly collect personal data from children without appropriate consent.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in the law or our services.

We will post the updated date at the top and notify you where required.

14. Contact Us

If you have questions about this policy or your data, contact: Email: [email protected]