Privacy Policy

1. Introduction

Snap Receipt ("we," "our," or "us") operates the Snap Receipt mobile application and associated backend services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

This policy applies to information collected through our mobile applications (iOS and Android), our web application, and our backend infrastructure.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: Email address, phone number, display name, and profile photo (optional). You may also begin using the Service anonymously without providing personal identifiers.
• Receipt images: Photos of receipts you upload via your device camera, document scanner, or file picker.
• Financial data: Merchant names, purchase amounts, itemized line items, payment method type and last four digits, expense categories, and transaction dates extracted from your receipts.
• Budget and preference data: Budget categories and limits, notification preferences, currency, timezone, and privacy settings you configure.
• Shopping lists: Items and preferences you provide when creating or generating shopping lists.

2.2 Information Collected Automatically

• Device information: Device type, operating system version, app version, unique device identifiers, and platform (iOS/Android).
• Usage analytics: Screen views, feature interactions, navigation paths, and in-app actions collected through our analytics provider.
• Error and performance data: Crash reports, runtime errors, and performance metrics collected through our error monitoring and application performance monitoring services.
• Push notification tokens: Device tokens required to deliver push notifications through our notification delivery service.

2.3 Information from Third Parties

• Subscription and purchase data: Transaction details, subscription status, renewal events, pricing, and billing issues received from Apple App Store and Google Play Store through our subscription management provider.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Core Service delivery: Processing receipt images via AI to extract and categorize your expenses, generating spending insights, detecting subscriptions, and creating smart shopping lists.
• Account management: Authenticating your identity, managing your session, and sending verification codes via email or SMS.
• Notifications: Delivering push notifications for budget alerts, subscription reminders, and monthly reports based on your notification preferences.
• Subscription management: Processing in-app purchases, managing your plan status, and handling billing events.
• Product improvement: Analyzing aggregate usage patterns and feature engagement to improve app functionality and user experience.
• Error resolution: Identifying, diagnosing, and fixing bugs, crashes, and performance issues.
• Security: Detecting and preventing fraud, abuse, or unauthorized access to the Service.

4. Third-Party Service Providers

We engage trusted third-party companies and services to facilitate our Service, perform Service-related tasks, or assist us in analyzing how our Service is used. These third parties have access to your information only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

We may also use additional infrastructure providers (e.g., database hosting, caching services) to operate the Service. These providers process data on our behalf under strict data processing agreements. The specific providers we use may change over time as we improve the Service. An up-to-date list of our sub-processors is available upon request.

5. AI & Automated Processing

Our Service uses artificial intelligence to provide its core functionality. When you upload a receipt image, it is transmitted to our servers and then forwarded to our third-party AI providers for processing. The AI extracts:

• Merchant name (normalized and display formats)
• Purchase date and time
• Amount breakdown (subtotal, tax, tip, delivery fees)
• Itemized line items with descriptions and prices
• Payment method type and last four digits
• Expense category classification
• Subscription detection indicators

We also use AI to generate monthly spending reports, category insights, and smart shopping list suggestions based on your historical purchase data.

5.1 Third-Party AI Providers

Receipt images and the data extracted from them are shared with the following third-party AI providers:

• OpenAI — see OpenAI's Privacy Policy and API Data Usage Policies.
• Google AI — see Google's Gemini API Additional Terms and Privacy Policy.

To keep receipt extraction accurate as AI models evolve, we may from time to time route requests through other comparable enterprise AI providers in addition to or instead of those listed above. Any such provider will be subject to the same handling commitments described in this section, and we will update this list when material changes occur.

We have selected providers that, under their API terms, handle your data only for the purpose of returning a response to our request and do not use your data to train their models. We do not control the content of these providers' policies, but we believe they offer protections at least equivalent to those described in this Privacy Policy at the time we engaged them.

You have the right not to be subject to decisions based solely on automated processing. If you believe an AI-generated categorization or extraction is incorrect, you can manually edit any receipt details within the app.

6. Data Storage & Security

6.1 Where We Store Your Data

• Database: Your account information, receipt data, budgets, and other structured data are stored in an encrypted database hosted on secure cloud infrastructure.
• Object storage: Receipt images are stored in secure cloud object storage with signed, time-limited access URLs.
• Session data: Authentication sessions are stored in a secure in-memory data store with automatic expiration.
• Local device storage: Minimal preferences (e.g., session token, settings) are stored locally on your device using platform-standard secure storage.

6.2 Security Measures

• All data transmitted between the app and our servers is encrypted in transit using TLS/HTTPS.
• Receipt image URLs are signed and time-limited, preventing unauthorized access.
• Authentication uses secure, encrypted session tokens.
• Verification codes for email and SMS login are single-use and expire after a short period.
• Database access is restricted to authenticated application-level connections.
• Background job processing (e.g., AI extraction, notifications) runs in isolated queues with error handling.

While we implement commercially reasonable security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you the Service.

• Account data: Retained for the lifetime of your account. When you request deletion (in-app via Settings → Delete Account), your account enters a 14-day cooling-off period during which you may cancel the request by signing in again. After 14 days, your account and associated data are permanently purged by an automated worker.
• Receipt images: Retained as long as your account is active. You may control whether receipt images are stored via the image storage toggle in your privacy settings.
• Session data: Authentication sessions are automatically expired and purged from our session store.
• Analytics data: Usage analytics are retained per our analytics provider's data retention policies.
• Error logs: Crash and error data are retained per our error monitoring provider's retention policies (typically 90 days).
• Temporary files: Some uploaded files have explicit expiration timestamps and are automatically invalidated.

We may retain anonymized, aggregated data indefinitely for statistical and product improvement purposes. This data cannot be used to identify you.

8. Your Rights & Choices

Depending on your jurisdiction (including under GDPR, CCPA, and other applicable laws), you may have the following rights:

8.1 Access & Portability

You have the right to request a copy of the personal data we hold about you in a structured, commonly used format.

8.2 Correction

You can edit your receipt details, account information, and preferences directly within the app at any time.

8.3 Deletion

You may delete your account directly from the app at Settings → Delete Account. Deletion is scheduled for 14 days after your request, during which you can cancel by signing back in. After the cooling-off period elapses, your account and all associated data (receipts, expenses, budgets, shopping lists, notification preferences, and authentication tokens) are permanently purged. You may also request deletion by emailing the address in Section 12.

8.4 Opt-Out of Analytics

You may contact us to opt out of analytics tracking. Note that error reporting is essential for maintaining Service stability and cannot be individually disabled.

8.5 Notification Preferences

You can configure notification frequency, quiet hours, and disable notifications entirely through the in-app notification settings. You can also revoke push notification permission at the operating system level.

8.6 Receipt Image Storage

You can control whether receipt images are retained after processing via the privacy settings in the app.

8.7 Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

8.8 Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in your jurisdiction.

9. Children's Privacy

The Service is not directed to individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information promptly.

10. International Data Transfers

Your information may be transferred to — and processed in — countries other than the country in which you reside. Our third-party service providers — including those providing AI processing, analytics, error monitoring, notification delivery, cloud storage, and communication services — may process data in the United States and other jurisdictions.

Where data is transferred outside the European Economic Area (EEA), United Kingdom (UK), or other jurisdictions with data transfer restrictions, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Other lawful transfer mechanisms recognized under applicable data protection laws

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the app and updating the "Last Updated" date at the top of this page.

For significant changes that materially affect your rights or the way we process your data, we will provide additional notice through in-app notifications or email (if you have provided an email address).

Your continued use of the Service after changes become effective constitutes your acceptance of the revised Privacy Policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@appsvanta.com
• Developer: AppsVanta
• App: Snap Receipt — AI-Powered Expense Track

We aim to respond to all legitimate requests within 30 days. In some cases, we may need to verify your identity before fulfilling your request.

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, our legal basis for collecting and using your personal data depends on the specific data and context:

California Privacy Rights (CCPA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: You may request deletion of the personal information we have collected about you, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Sale of Personal Information: We do not sell your personal information to third parties as defined under the CCPA.
• Sharing for Cross-Context Behavioral Advertising: We do not share your personal information for cross-context behavioral advertising purposes.

To exercise your California privacy rights, please contact us using the details in Section 12.

Device Permissions

The Snap Receipt app may request the following device permissions:

You can revoke any optional permission at any time through your device's system settings.