Privacy Policy

This policy explains what personal data Repceipt collects, why we collect it, who else touches it, and what you can ask us to do with it. It covers the website, the editor, and the account and billing areas.

We have tried to write it in plain language and to describe only what the product actually does.

Repceipt is the controller of the personal data described here — we decide what is collected and why.

For any privacy question, data request, or complaint, write to support@repceipt.com.

Account data. Your email address, and a verification record confirming you own it. If you sign in with Google, we receive the name, email address, and profile picture on your Google account — we do not receive your Google password.

Receipt content. The documents you build: the store names, line items, prices, dates, and notes you type, plus any logos or images you upload. This is content you chose to enter, so what ends up here is largely up to you.

Billing data. If you subscribe, we store a customer reference, your plan, its status, and the current billing period. Card numbers are handled by Stripe and never reach our systems.

We do not run advertising trackers, and we do not buy personal data about you from anyone.

If you are not signed in, your work in progress stays in your own browser, in session storage. It never reaches our database, and your browser discards it when you close the tab.

Once you sign in and save, the receipt is stored in our database against your account, along with any images you uploaded. Database access rules restrict each stored receipt to the account that owns it.

• —To provide the service — signing you in, saving your receipts, and generating exports
• —To take payment, manage subscriptions, and send billing-related messages
• —To send account emails such as email verification (we do not send marketing email)
• —To answer support requests you send us
• —To keep the service secure, detect abuse, and enforce our Terms
• —To understand which features are used and fix problems, so the product improves
• —To meet legal, tax, and accounting obligations

We do not use the content of your receipts to build a profile of you, and we do not sell personal data.

Where the GDPR or similar law applies, we rely on:

• —Performance of a contract — running your account, storing your receipts, taking payment
• —Legitimate interests — keeping the service secure, preventing abuse, and improving the product, balanced against your rights
• —Legal obligation — retaining billing records and responding to lawful requests
• —Consent — where we ask for it specifically; you can withdraw it at any time

We use cookies for authentication: they keep you signed in between page loads and protect the session. These are necessary for the service to work, and turning them off will stop sign-in from working.

We use session storage in your browser to hold unsaved editor drafts, as described above.

We do not set advertising cookies, and we do not use cross-site tracking. Because we do not track you across the web in the first place, browser "Do Not Track" signals do not change what we collect.

We rely on a small number of providers to run the service. Each processes data on our instructions:

• —Supabase — accounts and authentication, database storage for your receipts, and file storage for uploaded images
• —Stripe — payment processing and subscription management
• —Vercel — hosting for the site and the export API, and operational logs
• —Resend — delivery of account emails such as email verification
• —Google — optional Google sign-in, if you choose it

Stripe collects and processes your card details directly. Repceipt does not receive, store, or have access to your full card number, and card data does not pass through our servers.

We keep the limited billing records we need to service your subscription and satisfy tax and accounting rules — the plan, its status, dates, and amounts.

Stripe handles that data as its own controller as well as ours; its privacy notice covers what it does with it.

We share personal data only in these situations:

• —With the service providers listed above, so they can perform their function
• —Where the law requires it, or in response to a valid legal request
• —To establish, exercise, or defend legal claims, or to protect the rights and safety of users and the public
• —With an acquirer, if the service is ever sold or merged — you would be told before your data moved

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Given what the product does, we monitor for accounts being used to defraud people — for example, patterns that suggest bulk generation for chargeback or false-claim schemes.

This may involve reviewing account activity and, where we have reason to, the content associated with an account. Accounts found to be breaking the Terms can be restricted or closed, and where the law requires it we will cooperate with law enforcement.

• —Account data — while your account is open, and a short period afterwards
• —Receipt content and uploads — until you delete the receipt, or delete your account
• —Billing records — for as long as tax and accounting law requires, typically several years
• —Logs — a short rolling window kept for security and debugging

Deleting your account removes your saved receipts and uploads. Backups roll off on their own cycle, so a copy may persist briefly after deletion before it is overwritten.

Data is encrypted in transit, access to production systems is restricted, and each stored receipt is fenced to its owning account by database-level access rules.

No service can promise perfect security. If a breach affects your personal data and the law requires it, we will notify you and the relevant supervisory authority.

You can help by using a unique password and keeping access to your email account secure.

Our providers operate infrastructure in several countries, so your data may be processed outside the country you live in, including in the United States.

Where data leaves the EEA or the UK, we rely on the safeguards our providers have in place for those transfers, such as Standard Contractual Clauses.

Subject to local law, you can ask us to:

• —Give you a copy of the personal data we hold about you
• —Correct anything inaccurate
• —Delete your data — you can do this yourself by deleting your account in settings
• —Restrict or object to certain processing
• —Export your data in a portable format
• —Withdraw consent, where consent is what we relied on

Write to support@repceipt.com and we will respond within the time the law allows — one month in most places. We will not charge you or treat you differently for exercising these rights.

You have the rights above under the GDPR and the UK GDPR. You also have the right to complain to your national data protection authority — in the UK, the Information Commissioner’s Office.

We would rather hear from you first, so please contact us before escalating and we will try to put it right.

Under the CCPA and CPRA you have the right to know what personal information we collect and why, to access and delete it, to correct it, and to be free from discrimination for exercising those rights.

We have not sold or shared personal information for cross-context behavioural advertising in the past twelve months, and we do not collect sensitive personal information for the purpose of inferring characteristics about you.

You may use an authorised agent to make a request; we will ask for proof of their authority.

The service is not intended for children. You must be at least 16 to create an account, and we do not knowingly collect personal data from anyone younger.

If you believe a child has given us personal data, contact support@repceipt.com and we will delete the account and its contents.

We will update this policy as the product changes. The "Updated" date at the top of the page always reflects the current version.

If a change materially affects how we handle your data, we will give notice in the product or by email before it takes effect.

For privacy questions, data requests, or complaints, write to support@repceipt.com with enough detail for us to identify your account.