Privacy Policy

We collect the following categories of data:

• Account information - name, email address, organisation name, hashed authentication credentials and, for paid plans, billing details.
• Uploaded documents - receipts, invoices, bills, and bank statements that you, your team or your clients upload for processing (including files imported from other services), together with any data extracted from them (supplier names, amounts, dates, VAT information, etc.).
• Clients of accounting firms - when a firm uses Receipt X to collect documents from its clients, we hold, on the firm's behalf, the client's name, email address and (if the firm adds it) phone number; the documents, replies and messages the client sends through their page or by email; and a sign-in record for each device the client uses (a cookie that keeps them signed in for up to 90 days, which they can end at any time). The firm decides what is collected and is the controller of that data; Receipt X processes it for the firm. Emails to clients are sent in the firm's name, and every reminder carries a link to stop further reminders.
• Data from accounting software you connect - when you connect Xero, QuickBooks or Sage, we read your chart of accounts, suppliers and ledger entries (read-only) to map expenses correctly and to point out possible problems in the books. We only write to that software when you approve an expense for export.
• Usage data - log data such as IP address, device and browser type, pages visited, and actions taken within the application, used to secure and improve the Service.

We process personal data to:

• provide, operate, and maintain the Service;
• perform AI extraction, categorisation, duplicate detection and export of your financial documents;
• manage billing, authentication, customer support and account communications;
• monitor and improve the security, reliability, and accuracy of the Service;
• comply with legal and regulatory obligations.

Our lawful bases under UK GDPR are performance of a contract, legitimate interests (running and securing the Service), and, where applicable, your consent or compliance with a legal obligation.

We rely on a small number of vetted sub-processors to operate the Service. Each is bound by contractual data-processing terms:

• DeepSeek - AI reading of uploaded documents (text, amounts, dates and VAT), categorisation, checks, and the in-app assistant. DeepSeek processes data on servers in the People's Republic of China (see section 8).
• Supabase - database, sign-in and file storage, hosted in London, United Kingdom.
• DigitalOcean - the servers that run the Receipt X application, located in Frankfurt, Germany.
• Stripe - subscription billing and payment processing. Card details are handled by Stripe directly and never reach our servers.
• Resend - sending emails on your behalf, such as document requests and reminders to your clients, when you use that feature.

When you connect accounting software (Xero, QuickBooks by Intuit or Sage), data moves between Receipt X and that provider at your direction; the provider's own privacy policy applies to the data it holds.

We keep your data for as long as your account is open. When you close your account or ask us to delete your data (see section 9), we permanently delete it from our live systems within 30 days, and any copies in our backups are overwritten within a further 30 days. Billing records are kept for as long as tax law requires (currently six years in the UK).

You have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data or completion of incomplete data;
• request deletion of your data (the “right to be forgotten”);
• receive a portable copy of your data in a common machine-readable format;
• object to or restrict certain processing, including processing based on legitimate interests;
• lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Data is encrypted in transit using TLS 1.2 or 1.3 and at rest using AES-256. Every table in our database has row-level security, so each workspace only ever sees its own data, and uploaded files are kept in private storage behind links that expire after one hour. Accounts can be protected with two-step verification, which a workspace owner can make compulsory. Access to production systems is limited to authorised personnel. More detail, including what we don't have yet, is on our Security page.

We use a limited set of strictly necessary cookies to keep you signed in and to secure the application. Please see our Cookie Policy for details.

Your data is stored in the United Kingdom (Supabase, London) and our application runs in Germany (DigitalOcean, Frankfurt). To read your documents and run the assistant, their content is sent to DeepSeek, which processes it in the People's Republic of China - a country the UK and EU have not recognised as providing an adequate level of data protection. DeepSeek's own privacy policy (10 February 2026) says it may use data to improve its models and gives a right to opt out of that. Stripe and Resend may process data in the United States under the UK-US Data Bridge, the EU-US Data Privacy Framework and/or Standard Contractual Clauses. If you have questions about these transfers, contact us (section 9).

To exercise any of your rights, or if you have questions about how we handle your data, contact us at receiptx9@gmail.com. We aim to respond to all requests within 30 days.