Privacy Policy
Last updated: 24 October 2026
{{LEGAL ENTITY}}, a {{LEGAL FORM}} registered under number {{REGISTRATION NUMBER}}, with its registered office at {{REGISTERED OFFICE}}, is the controller of the personal data described here. We operate ReceiptMapper. This policy explains what we collect, why, who handles it and what rights you have. For questions, write to support@receiptmapper.com.
1. What we collect
| Data | When | Notes |
|---|---|---|
| Name and email address | You sign up | Used to run your account and contact you about it. |
| Password | You sign up or change it | Stored only as a salted PBKDF2 hash, never in readable form. |
| Payment details of your plan | You buy a plan | Stripe takes your card details. We receive a payment reference, plan, amount, currency and the email used at checkout. We never see your card number. |
| Receipt images | You upload them | Sent to our AI provider to be read, then discarded. We do not store the images. |
| Extracted receipt data | A receipt is processed | Text fields such as date, vendor, category, VAT, totals, currency, payment method and a confidence score. Receipts may contain personal data about other people, such as names on invoices. |
| Credits and plan status | You use the Service | Credits bought and used, access end date. |
| Messages you send us | You use the contact form or email us | Name, email address and message. |
| Technical data | You visit the site | IP address and request details are handled by Cloudflare to deliver and protect the site. A session cookie keeps you signed in. We run no analytics. |
We do not collect special category data on purpose and we do not need it to run the Service. Please do not upload documents that contain it.
2. Why we use it and our legal basis
| Purpose | Legal basis (UK and EU GDPR) |
|---|---|
| Create and run your account, process receipts, spend and refund credits | Contract: it is needed to provide the Service you bought |
| Take payments, unlock plans, handle refunds and keep payment records | Contract, and legal obligation for accounting and tax records |
| Answer your messages and support requests | Contract or our legitimate interest in helping you |
| Keep the Service secure, prevent abuse and fraud, rate limit requests | Legitimate interest in protecting the Service and its users |
| Send service messages such as account or billing notices | Contract or legitimate interest. We send no marketing. |
We never use your content to train AI models. We do not sell personal data and we do not use it for advertising.
3. Who processes your data
| Provider | What they do | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, D1 database, Workers AI (receipt data extraction) | USA (global edge) |
| Stripe, Inc. | Payment processing | USA |
We share data with these providers only to run the Service, and with authorities or advisers where the law requires it. If our business is ever sold or reorganised, personal data may transfer to the successor, which must follow this policy.
4. What stays in your browser
Your light or dark mode choice is saved in your browser's local storage and is not sent to us. Receipt tables you have not exported live in the page until you leave it. Once you leave, you can reopen a processed batch from your account.
5. How long we keep it
| Data | Kept for |
|---|---|
| Account details | Until you delete your account |
| Extracted receipt data | Until you delete your account. If you do not, until 12 months after your access period ends, then it is deleted automatically. |
| Receipt images | Not stored after processing |
| Sessions | 30 days, or until you log out |
| Contact messages | 12 months, then deleted automatically |
| Payment records | As long as tax and accounting law requires (commonly 6 to 7 years). After you delete your account they are no longer linked to it. |
| Login and rate limit records | About 24 hours |
6. International transfers
Our providers operate globally and may process data in the United States and other countries. Where personal data leaves the UK or the European Economic Area, we rely on safeguards such as the providers' standard contractual clauses and, where available, adequacy decisions or the UK and EU data bridge frameworks.
7. Your rights
Depending on where you live, you can ask to access your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. Where we rely on consent you can withdraw it. You can delete your account and stored receipt data yourself on the Account page. For other requests, email support@receiptmapper.com. We reply within one month. We may ask you to confirm who you are.
You have the right to complain to your data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). If you live in the EU you can contact the authority in your country. Our contact point for data protection is {{DATA AUTHORITY}}. We would like the chance to fix a problem first, so please contact us.
8. Receipts that contain other people's data
If you upload receipts or invoices that include personal data about other people, you are responsible for having a lawful basis to do so. For that data we act as your processor and handle it only on your instructions to provide the Service.
9. Children
The Service is for people aged 18 or over. We do not knowingly collect data from children. If you think a child has given us data, tell us and we will delete it.
10. Security
We protect data with encryption in transit, hashed passwords, access controls and rate limiting. See the Security page. No system is perfectly secure, and we will notify you and the authorities of a breach where the law requires.
11. Cookies
We set one strictly necessary session cookie and use no analytics or advertising cookies. Details are in the Cookie Policy.
12. Changes
We may update this policy. If a change is material we will tell you by email or on the Service before it applies. The date at the top shows the latest version.