Privacy Policy

CompanyReceipts ("CompanyReceipts," "we," "us," or "our") provides a receipt and expense manager that lets you capture receipts, record the financial details on them, reconcile them against card and bank transactions, and export them — for your personal expenses and one or more businesses. This Privacy Policy explains what information we collect, how and why we use it, who we share it with, how long we keep it, and the choices and rights you have. It applies to the CompanyReceipts iOS app, the web dashboard at companyreceipts.com, our email-in address, and related services (collectively, the "Service").

By creating an account or using the Service, you acknowledge the practices described here. If you do not agree, please do not use the Service.

1. Information we collect

Information you provide

• Account information. Your email address, and optionally your name and chosen subscription tier, created when you sign up.
• Receipt content. Receipt images you capture or upload and the details extracted from or entered about them: vendor name, purchase date, subtotal, tax, total, currency, payment method, card type, the last four digits of a card (only if you choose to record it), receipt or invoice number, category, notes, line items, and tax-deductible status.
• Receipts you email in. If you forward a receipt to receipts@inbound.companyreceipts.com, we match the sender address to your account and file the message's attachments and text as a receipt for you to review. Messages from an address that does not match an account are discarded.
• Business and organization data. Companies you create, mileage trips, custom categories, expense reports, team membership, roles, approvals, and missing-receipt requests if you use the team features.
• Voice notes. If you attach an optional audio memo to a receipt, we store that recording with the receipt.
• Support communications. Information you send us when you contact support.

Information collected automatically or from your device

• Location. If you grant permission, the app can tag a receipt with the approximate location where it was captured, and mileage trips you log include distance and route purpose. You can decline or revoke location access in your device settings.
• Camera and photo library. Used only to capture or import the receipt images you choose; we do not browse your photo library.
• Push notification tokens. If you enable notifications, we store a device token so we can send you alerts (for example, an approval request or a decision on your receipt).
• Technical data. Authentication tokens and session cookies needed to keep you signed in, plus basic logs (such as request timestamps, IP address, and error diagnostics) generated by our hosting providers to operate and secure the Service.

Bank and card transactions (Plaid)

If you choose to connect a bank or card account to automatically import transactions for reconciliation, that connection is made through Plaid Inc. You enter your financial-institution credentials directly with Plaid — not with us — and we never see or store your banking username or password. Plaid provides us, on your instruction, with transaction details such as the merchant name, amount, date, and a card account's last four digits, plus the names and masks of the accounts you link, which we use to match transactions to your receipts. Plaid's handling of your data is governed by the Plaid End User Privacy Policy. You can disconnect a linked account at any time, which revokes our access going forward.

2. Categories of personal information

Depending on how you use the Service, the categories of personal information we process include: identifiers (such as your email); financial information (receipt totals, tax, payment method, card last four, and — if you connect an account — bank and card transaction data); commercial information (purchase and expense records); audio (voice notes); geolocation (if enabled); internet and device activity (logs, session data); and inferences drawn from your receipts (such as spending by category). We do not intentionally collect government identifiers, health data, or other special categories of data; please do not store them in your receipts.

3. How we use your information

• To provide the Service — capture, read, store, organize, search, reconcile, and export your receipts and reports.
• To authenticate you and keep your account and data secure.
• To enable features you turn on — such as emailing a receipt or report, team sharing and approvals, accounting export, bank reconciliation, and backups to a cloud drive you connect.
• To send transactional messages and notifications you have enabled.
• To provide customer support and respond to your requests.
• To operate, maintain, debug, secure, and improve the Service, and to comply with legal obligations.

We do not sell or rent your personal information, we do not share it for cross-context behavioral advertising, and we do not use your receipts, financial records, or bank data to build advertising profiles or to train third-party advertising models.

4. How automated extraction ("AI") is used

To save you typing, the Service reads the details off a receipt image. In the iOS app this text recognition runs on your device. For receipts you email in, we may use a third-party model provider (currently OpenAI) to extract the vendor, amount, date, and category from the image on our servers; that provider processes the image only to return the extracted fields and is contractually restricted from using your content to train its models. Extraction is a convenience and may contain errors — you remain responsible for reviewing your records.

5. Data isolation

Your data is private to you by design. Every record is tied to your account and protected by per-row database access controls (row-level security), so one user cannot read another user's data. When you join or create an organization, data is shared only within that organization and only with the members and roles you grant; data stays isolated between different organizations, and your personal (non-shared) receipts remain visible only to you.

6. Service providers & subprocessors

We rely on a limited set of vetted providers to run the Service. They process data only on our instructions and only as needed to perform their function:

• Supabase — the PostgreSQL database, authentication, and storage of your receipt images.
• Vercel — hosting and delivery of the web dashboard and our server endpoints.
• Cloudflare — DNS, network security, and email routing for our domain.
• Postmark — outbound transactional email (verifications, invitations, and receipts or reports you email) and inbound processing of receipts you forward in.
• Apple — App Store distribution and, if you subscribe in the app, in-app purchase and subscription billing.
• Stripe — payment and subscription processing for plans purchased on our website. Card details are handled by Stripe; we do not store full card numbers.
• Plaid — the optional bank/card connection used to import transactions (see Section 1).
• OpenAI — optional server-side extraction of details from receipts you email in (see Section 4).
• QuickBooks Online / Xero — only if you connect them; we send the approved expense records you choose to sync.
• Google Drive, Dropbox, Box, or Microsoft OneDrive — only if you explicitly connect one to back up copies of your receipts; we access only the folder you authorize, and you can disconnect at any time.
• Error- and performance-monitoring providers — if enabled, to capture diagnostics that help us detect and fix problems (configured to avoid your receipt content).

7. When we disclose information

We disclose personal information only: (a) to the service providers above; (b) to other members of an organization you join, per the roles you grant; (c) to the third-party services you connect; (d) if required by law, legal process, or a valid government request, or to protect the rights, property, or safety of CompanyReceipts, our users, or the public; and (e) in connection with a merger, acquisition, or sale of assets, in which case we will notify you and this Policy will continue to apply to your information.

8. Data retention

We keep your information for as long as your account is active and as needed to provide the Service. You can delete individual receipts at any time, and you can permanently delete your entire account — and your receipts, images, transactions, and associated records — from Settings → Account on either the app or the web. After deletion, residual copies in encrypted backups are purged on our providers' standard backup-rotation cycle, and we may retain limited records where required for legal, tax, security, or fraud-prevention purposes.

9. Your rights & choices

• Access & export. Export your receipts as JSON and CSV at any time from Settings → Account.
• Correction. Edit any receipt or account detail directly in the app or web.
• Deletion. Permanently delete your account and all associated data from Settings → Account, or by emailing us.
• Withdraw connections. Disconnect any bank, accounting, or cloud-drive connection, or turn off notifications and location, at any time.

10. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, to access and delete it, to correct inaccurate information, and to not be discriminated against for exercising these rights. We collect the categories described in Section 2 to provide the Service. We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of in that respect. You may exercise your rights through Settings → Account or by emailing us, and you may use an authorized agent; we will verify requests against your account.

11. EEA/UK rights (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, CompanyReceipts is the controller of your personal data. Our legal bases for processing are: performance of our contract with you (to provide the Service), your consent (for optional features such as location, bank connections, or marketing emails, which you may withdraw), our legitimate interests (to secure, maintain, and improve the Service), and compliance with legal obligations. You have the right to access, rectify, erase, restrict, or object to processing, to data portability, and to lodge a complaint with your local supervisory authority. Contact us to exercise these rights.

12. Security

Data is encrypted in transit (HTTPS/TLS) and at rest by our hosting provider. Access to your records is enforced at the database level so only you — and the organization members you authorize — can read them; secrets such as third-party access tokens are stored server-side and are not exposed to the app or browser. The iOS app can be locked with Face ID / Touch ID. No system is perfectly secure, but we use industry-standard safeguards to protect your information and will notify you of a breach where required by law.

13. International transfers

We and our providers are based in the United States, and your information may be processed there or in other countries where our providers operate. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. By using the Service you understand your data may be transferred to and processed in those locations.

14. Cookies

We use only the cookies and local storage strictly necessary to sign you in and keep your session secure. We do not use third-party advertising or cross-site tracking cookies.

15. Children

CompanyReceipts is intended for adults and is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect their personal information; if you believe a child has provided us data, contact us and we will delete it.

16. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Your continued use of the Service after an update takes effect constitutes acknowledgement of the change.

17. Contact us

Questions, requests, or privacy concerns? Email support@companyreceipts.com.