Privacy Policy

01Introduction

This Privacy Policy explains how SnapTract ("SnapTract," "we," "us," or "our") collects, uses, stores, shares, and protects personal information when you use the SnapTract mobile application and related websites or services (collectively, the "Service").

SnapTract is offered worldwide. This Policy is intended to meet requirements under the EU/EEA General Data Protection Regulation ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and other applicable privacy laws.

By using the Service, you acknowledge this Policy. If you do not agree, do not use the Service.

02Who we are (data controller)

For personal data processed in connection with the Service, the data controller is the operator of SnapTract, reachable via Contact us.

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you may contact us at the same address to exercise your rights or raise privacy questions. Where required by law, you may also lodge a complaint with your local supervisory authority.

03Scope

This Policy applies to personal information we process about you as a user of SnapTract. It does not apply to third-party websites, apps, or services that we do not control (including Apple, AI providers, or cloud hosts), which have their own privacy policies.

04Information we collect

Depending on how you use the Service, we may process:

• Account and identity data: Apple Sign In identifier, email address (including a private relay address if you hide your email), and display name if you provide one.
• Profile and preferences: currency, locale/region settings, employee or department fields you choose to add, and similar settings.
• Receipt and expense content: receipt images, merchant names, dates, amounts, tax fields, categories, notes, tags, and reports or exports you create.
• Device and technical data: device type, OS version, app version, language, rough diagnostics needed to run and secure the Service, and — only if you enable notifications — a push notification token.
• Support communications: messages, email address, and related details you send via Contact us or support channels.
• Subscription status: whether you have an active SnapTract Pro entitlement, as reported by Apple (we do not receive your full payment card details).

We do not intentionally collect precise GPS location for advertising. Location is not required for core receipt scanning.

05How we collect information

We collect information:

• Directly from you when you create an account, scan or upload receipts, edit data, export reports, or contact support.
• Automatically from your device when the app runs (technical and diagnostic data needed to operate the Service).
• From Apple when you Sign in with Apple or purchase/manage a subscription.
• From processors acting on our instructions (for example, AI extraction of receipt text and cloud storage).

06Legal bases (GDPR / UK GDPR)

If you are in the EEA, UK, or Switzerland, we process personal data only where a legal basis applies, including:

• Contract: to provide the Service you request (account, sync, scanning, reports, subscriptions you buy).
• Legitimate interests: to secure the Service, prevent abuse, improve reliability, and communicate about service changes — balanced against your rights.
• Consent: where required (for example, optional push notifications). You may withdraw consent at any time without affecting prior lawful processing.
• Legal obligation: where we must retain or disclose information to comply with law.

Where we rely on legitimate interests, you may object as described in "Your rights" below.

07How we use information

We use personal information to:

• Provide, operate, maintain, and improve the Service.
• Authenticate you and sync your data across your devices.
• Process receipt images with AI to extract structured data you can review and edit.
• Generate spending views, price memory, expense reports, and exports you request.
• Send push notifications you have enabled.
• Process subscriptions and entitlements via Apple.
• Respond to support requests and investigate abuse or security issues.
• Comply with law and enforce our Terms of Service.

We do not sell your personal information and we do not use it for third-party advertising or cross-context behavioral advertising.

08AI processing

When you scan or upload a receipt, image content and related text may be sent to our AI processor solely to extract fields (merchant, amounts, dates, line items, and similar). Extracted results can be wrong. You are responsible for reviewing and correcting data before relying on it for reimbursement, accounting, or tax.

We instruct processors to use this content only to provide the extraction service to us. We do not use your receipts to train public advertising models. Processor terms may allow limited use to operate and secure their API; see their policies for details.

09Where data is stored and international transfers

Your structured data is stored in our managed backend (Supabase). Receipt images are stored with cloud object storage (Cloudflare R2). Some processing occurs on your device.

Because SnapTract is available worldwide, personal data may be processed in countries other than where you live, including the United States and other locations where our providers operate. Those countries may have different data-protection laws than your home country.

For transfers from the EEA, UK, or Switzerland to countries not deemed adequate, we rely on appropriate safeguards where required — such as the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement / Addendum, and provider certifications or contractual commitments — together with technical and organizational measures. You may contact us for more information about transfers applicable to your account.

10Sharing and processors

We share personal information only as needed to run the Service:

• Apple — Sign in with Apple, App Store subscriptions, and push delivery.
• Supabase — database, authentication-related backend, and server functions.
• Cloudflare — object storage for receipt images.
• AI provider — receipt reading / extraction.
• Professional advisors or authorities — only if required by law or to protect rights, safety, or the Service.

These parties act as processors or independent controllers as applicable under their terms. We require processors who handle personal data on our behalf to protect it and use it only for instructed purposes.

We do not sell or rent your personal information.

11Retention

We retain personal information for as long as your account remains active and as needed to provide the Service. When you delete your account, we delete or anonymize associated personal data from our systems within a reasonable period, except where we must retain limited information for legal, security, fraud-prevention, accounting, or dispute-resolution purposes.

Backups may persist for a short additional period before being overwritten. Device-local copies remain until you remove the app or clear local data.

12Security

We use reasonable technical and organizational measures designed to protect personal information, including access controls, encryption in transit where applicable, and provider security features. No method of transmission or storage is completely secure. You are responsible for keeping your device and Apple ID secure. We are not liable for unauthorized access resulting from circumstances beyond our reasonable control.

13Your rights (EEA, UK, Switzerland)

Subject to applicable law, you may have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Erase data ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent where processing is consent-based.
• Lodge a complaint with a supervisory authority in your country of residence or work.

You can exercise many of these rights in the app (edit or delete data; delete your account from Profile). For other requests, use Contact us. We may need to verify your identity before fulfilling a request. Some rights are limited where we have overriding legitimate grounds or legal duties.

14Your rights (California and other US states)

If you are a California resident (and where similar US state laws apply, such as Virginia, Colorado, Connecticut, Utah, and others), you may have rights to:

• Know / access categories and specific pieces of personal information collected.
• Delete personal information.
• Correct inaccurate personal information.
• Opt out of "sale" or "sharing" for cross-context behavioral advertising (we do not sell or share personal information for such purposes).
• Limit use of sensitive personal information where applicable.
• Non-discrimination for exercising privacy rights.

To submit a request, use Contact us or use in-app account deletion. We will not discriminate against you for exercising your rights. We do not use personal information for targeted advertising as defined under those laws.

15Your choices

You may:

• Edit profile and receipt data in the app.
• Disable push notifications in iOS Settings.
• Manage or cancel SnapTract Pro in Apple ID subscription settings.
• Delete your account and associated cloud data from Profile.
• Contact us to request access, correction, or deletion where the app does not already provide it.

Sign in with Apple options (including Hide My Email) are controlled by Apple.

16Children's privacy

SnapTract is not directed to children under 13 (or under 16 in the EEA/UK where a higher digital consent age applies), and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, use Contact us and we will take steps to delete it.

17Cookies, analytics, and tracking

The native iOS app does not use third-party advertising trackers. Our marketing or legal web pages may use strictly necessary cookies or similar technologies to operate the site. We do not currently use third-party advertising analytics SDKs in the app. If that changes, we will update this Policy and obtain consent where required.

18Automated decision-making

AI extraction suggests structured fields from receipts. This is assistive automation; it does not produce legal or similarly significant decisions about you without human review. You control whether to accept, edit, or discard extracted data.

19Do Not Track

Some browsers send "Do Not Track" signals. There is no consistent industry standard for responding to them. Aside from the practices described in this Policy, we do not alter the Service based solely on a Do Not Track signal.

20Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be indicated by updating that date and, where appropriate, by in-app notice. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy, except where applicable law requires additional consent.

21Contact

Privacy questions or requests: use Contact us, or use Contact us in the app / on our legal site.

We aim to respond within a reasonable period and, for GDPR requests, within one month (extendable where permitted by law for complex requests).