Reciptix LLP ("we," "our," or "us") operates the Receiptix mobile application and website ("the Service"). Reciptix LLP is a limited liability partnership registered in the United Kingdom and is the data controller for personal data processed through the Service. This Privacy Policy explains what we collect, why, who we share it with, and what rights you have.
Account Information. When you create an account, we collect your email address (required) and optionally your name and profile photo. If you sign in with Apple, Google, or another authentication provider, we receive the basic profile information that provider chooses to share.
Expense Data. This is the data you create as you use the app. It includes:
Subscription and Purchase Data. When you subscribe to a paid plan, we receive subscription status, plan tier, currency, renewal date, and original transaction identifiers from Apple, Google, or RevenueCat. We do not see or store payment card numbers or bank account details — those are handled by Apple and Google.
Project Sharing Data. If you share a project with another user, your display name and profile photo (but not your email address) become visible to other members of that project, and theirs to you.
Telegram Linking Data. If you link your account to our Telegram bot, we store your Telegram user ID so we can associate Telegram messages with your account. We do not store Telegram usernames or unrelated message content.
Device and Technical Data. To operate the Service, we automatically collect:
What we do not collect. We do not collect advertising identifiers (IDFA on iOS, GAID on Android). We do not access your contacts, calendar, photo library (beyond images you explicitly select), or location.
We use the information described above to:
What we never do:
Under UK GDPR and EU GDPR, we rely on the following legal bases to process your personal data:
We rely on the following service providers to deliver the Service. Each processes personal data only on our behalf and only for the purposes described.
We may add or change sub-processors over time. Material changes will be reflected in this policy.
You can choose to connect an AI assistant — such as ChatGPT (by OpenAI) or Claude (by Anthropic) — to your Receiptix account, so you can ask it about your receipts and spending. Nothing is shared with any assistant unless you connect it yourself.
Connecting. You sign in on a Receiptix page (auth.receiptix.io), or approve the connection in the app, and the page names the assistant you are approving. We record that approval: your account, the assistant's name and the website it connects from, when you approved it, and when it last connected. Sign-in sessions, connection codes and the assistant's refresh tokens are stored only in hashed form. Our sign-in pages use Google reCAPTCHA Enterprise to protect against abuse, and nothing on them is used for analytics or advertising. You can also create a Receiptix account on these pages; it holds the same information as an account created in the app.
What the assistant receives. When you approve it, the assistant receives your account's email address and whether it has been verified (if you use Receiptix without an account, there is none to share). After that, when you ask it about your receipts, it can read the receipts it looks up — in your personal space and in the projects you own or that are shared with you — and the spending totals we calculate from them: each receipt's merchant, date, amounts and currency, line items and their categories, your own tags, the project's name and who paid, how the receipt was added, the text read from it, and links to its photo or PDF and its thumbnail. For a shared project it also sees the names of the project's members, as the app shows them to you. Each link opens that one file for an hour and then stops working; it does not reveal your account or the receipt, but anyone who has it can open the file until it expires.
Searching through an assistant. When an assistant searches your receipts, we turn its search text into a text embedding with Google's Gemini embedding model, as the app's own search does, to find matches by meaning, and we count searches per person and hour to prevent abuse. We do not store or log the search text.
The assistant is your choice. OpenAI and Anthropic receive this data because you connected their assistant. In that role they are not our service providers: they handle it under their own terms and privacy policies with you, and we do not control how they use or retain it. (Anthropic also processes receipt data for us through its API, as described in Section 4 — a separate service, under our agreement with Anthropic.) Please review their policies before you connect.
Disconnecting. You can disconnect an assistant at any time in the app (Settings → AI assistants) or at auth.receiptix.io/account. Its access ends within a minute, and we delete the approval and its tokens. Deleting your Receiptix account disconnects every assistant. Anything an assistant has already received stays with its provider under its terms — for example in your conversation history there, which you can delete with that provider — and links to your receipts' files that it received stop working within an hour.
Where your data is stored. Your data is stored using Google Firebase, primarily in data centers operated by Google. Some data may be processed in the United States or other regions where our service providers operate (see Section 7 on international transfers).
Security. We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest, role-based access controls, and authentication.
Retention. We retain your account and expense data for as long as your account remains active. When you delete your account (see Account Deletion), we delete your personal data and expense records from our active systems within 30 days. Some information may remain in encrypted backups for up to 90 days before being permanently removed. Anonymized usage statistics, security logs, and aggregate metrics may be retained longer for product improvement and compliance purposes.
Reciptix LLP is registered in the United Kingdom. Most of our service providers are based in the United States or operate global infrastructure. When your personal data is transferred outside the UK or the European Economic Area, we rely on appropriate safeguards to protect it, including:
Your expense data is processed automatically by our systems. Our team does not proactively browse or read user data.
Access to individual user data by our team is limited to specific situations:
Depending on where you live, you may have some or all of the following rights regarding your personal data:
To exercise any of these rights, contact us at support@receiptix.io. To delete your account directly, see our Account Deletion instructions. We will respond within one month of receiving your request.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights regarding your personal information.
Categories of personal information we collect. In the past 12 months, we have collected the following categories: identifiers (email, user ID, device identifiers); commercial information (subscription data); internet or other electronic activity (usage events, crash reports); geolocation data (only the country/region inferred from IP address); and other information you provide (expense data).
Your CCPA/CPRA rights:
To exercise these rights, contact us at support@receiptix.io. We will verify your request by confirming your identity through the email address associated with your account.
In the app: the Receiptix mobile app does not use browser cookies. It does use device identifiers and similar technologies (Firebase Installation ID, push tokens) as described in Section 1.
On our website: our website (receiptix.io) uses cookies for essential functionality and Google Analytics.
In our emails: our transactional and lifecycle emails may include open tracking pixels so we can measure delivery and engagement at an aggregate level. If you would prefer not to be tracked in this way, most email clients allow you to disable image loading.
Receiptix is not directed at children. The Service is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and you believe your child has provided us with personal data, please contact us at support@receiptix.io and we will delete the account.
For users in the United States: in compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13.
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (in the UK, the Information Commissioner's Office) within 72 hours of becoming aware of the breach, where required by law. If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date below and, for significant changes, notify you by email or through the app. Your continued use of the Service after the changes take effect constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy, want to exercise your rights, or wish to make a complaint, please contact us at support@receiptix.io.
You can also see our Terms of Use.
Last Updated: October 18, 2026