Privacy policy

Receipts2sheets app is free for Sheetify Bookkeeping customers 🎉

This privacy policy is applicable to the Receipts2sheets app (hereinafter referred to as "Application") for mobile devices, which was developed by Stewart Gauld (hereinafter referred to as "Service Provider") as a a Freemium service. This service is provided "AS IS".

What information does the Application obtain and how is it used?

User Provided Information:

The Application acquires the information you supply when you download and register the Application. Registration with the Service Provider is not mandatory. However, bear in mind that you might not be able to utilize some of the features offered by the Application unless you register with them.

The Service Provider may also use the information you provided them to contact you from time to time to provide you with important information, required notices and marketing promotions.

Automatically Collected Information:

In addition, the Application may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile devices unique device ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browsers you use, and information about the way you use the Application.

Does the Application collect precise real time location information of the device?

This Application does not gather precise information about the location of your mobile device.

Do third parties see and/or have access to information obtained by the Application?

Only aggregated, anonymized data is periodically transmitted to external services to aid the Service Provider in improving the Application and their service. The Service Provider may share your information with third parties in the ways that are described in this privacy statement.

Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:

Google Play Services
Appwrite Database Panel
Google Services (Google Sign In, Drive, Sheets)
Google ML Kit for OCR processing

The Service Provider may disclose User Provided and Automatically Collected Information: as required by law, such as to comply with a subpoena, or similar legal process; when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request; with their trusted services providers who work on their behalf, do not have an independent use of the information we disclose to them, and have agreed to adhere to the rules set forth in this privacy statement.

What are my opt-out rights?

You can halt all collection of information by the Application easily by uninstalling the Application. You may use the standard uninstall processes as may be available as part of your mobile device or via the mobile application marketplace or network.

Data Retention Policy, Managing Your Information:

The Service Provider will retain User Provided data for as long as you use the Application and for a reasonable time thereafter. The Service Provider will retain Automatically Collected information for up to 24 months and thereafter may store it in aggregate. If you'd like the Service Provider to delete User Provided Data that you have provided via the Application, please contact them at stewart@sheetifycrm.com and we will respond in a reasonable time. Please note that some or all of the User Provided Data may be required in order for the Application to function properly.

Children:

The Service Provider does not use the Application to knowingly solicit data from or market to children under the age of 13.

The Application does not address anyone under the age of 13. The Service Provider does not knowingly collect personally identifiable information from children under 13 years of age. In the case the Service Provider discover that a child under 13 has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact the Service Provider (stewart@sheetifycrm.com) so that they will be able to take the necessary actions.

Security:

The Service Provider are concerned about safeguarding the confidentiality of your information. The Service Provider provide physical, electronic, and procedural safeguards to protect information we process and maintain. For example, we limit access to this information to authorized employees and contractors who need to know that information in order to operate, develop or improve their Application. Please be aware that, although we endeavor provide reasonable security for information we process and maintain, no security system can prevent all potential security breaches.

Changes:

This Privacy Policy may be updated from time to time for any reason. The Service Provider will notify you of any changes to the Privacy Policy by updating this page with the new Privacy Policy. You are advised to consult this Privacy Policy regularly for any changes, as continued use is deemed approval of all changes.

This privacy policy is effective as of 2025-07-25

Your Consent:

By using the Application, you are giving your consent to the Service Provider processing of your information as set forth in this Privacy Policy now and as amended by us. "Processing,” means using cookies on a computer/hand held device or using or touching information in any way, including, but not limited to, collecting, storing, deleting, using, combining and disclosing information.

Here is the Privacy Policy formatted with clear headers, bullet points, and emphasis for high readability. You can copy and paste this directly into your website editor (WordPress, Squarespace, Webflow, etc.).

1. Information We Collect

1.1 Personal Information

Account Information: Email address, name (when using social login), and encrypted password.
Authentication Data: Google account information (for Google Sheets integration), Apple ID (for Apple Sign-in).
Receipt Data: Images of receipts you scan, extracted text, and metadata (merchant name, amount, date, category, payment method).
Profile Data: User preferences, settings, and customizations.
Payment Information: Subscription details (processed by Apple App Store or Google Play Store — we do not store credit card information).

1.2 Automatically Collected Information

Device Information: Device type, model, operating system version, unique device identifiers (UDID, Advertising ID), device language, timezone.
Usage Data: App features used, frequency of use, session duration, navigation paths, performance data.
Location Data: Approximate location based on IP address (not precise GPS location).
Error Reports: Crash logs, error reports, and diagnostic data to improve app stability.
Camera/Photo Access: When scanning receipts (only with your permission).
Network Information: Internet connection type, network provider.

1.3 Cookies and Tracking Technologies

We use the following technologies:

Session Tokens: To maintain your login session.
Analytics SDKs: Firebase Analytics, Crashlytics for performance monitoring.
Persistent Identifiers: To remember your preferences.

2. How We Use Your Information

We use the collected information to:

Provide and maintain our receipt scanning and expense tracking services.
Process and analyze receipt images using AI technology (Google Gemini AI).
Sync your expense data with your Google Sheets.
Send email verifications, password reset links, and important service notifications.
Process subscription payments and manage your account.
Improve app functionality, features, and user experience.
Provide customer support and respond to inquiries.
Ensure security, prevent fraud, and enforce our Terms of Service.
Comply with legal obligations and respond to legal requests.
Analyze usage patterns and app performance.
Send optional marketing communications (with your consent).

2.1 Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your data based on:

Contract Performance: To provide the services you requested.
Consent: For marketing communications and certain data processing activities.
Legitimate Interests: For fraud prevention, analytics, and service improvement.
Legal Obligations: To comply with applicable laws.

3. Data Storage and Security

Encryption: All data is encrypted in transit using SSL/TLS (256-bit encryption) and at rest using AES-256 encryption.
Storage Location: Data is stored on secure cloud servers via Appwrite cloud infrastructure.
Receipt Images: Stored securely in encrypted cloud storage and only accessible by you.
Google Sheets Data: Stored in your own Google account — we only facilitate the synchronization.
Access Controls: Strict access controls and authentication mechanisms.
Regular Audits: Security audits and vulnerability assessments.
Backup Systems: Regular encrypted backups for data recovery.

⚠️ Important: While we implement industry-standard security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

4. Third-Party Services

We integrate with the following third-party services that may collect and process your data:

4.1 Authentication & Cloud Services

Google Services: For Google Sign-in, Google Sheets API, and Google Drive integration.
Apple Sign-in: For authentication on iOS devices.
Appwrite: For backend services, database, and data storage.

4.2 AI & Processing Services

Google Document AI: For receipt image text extraction (OCR).
Google Gemini AI (2.0 Flash): AI insights and data processing.

4.3 Analytics & Performance

Firebase Analytics: For usage analytics.
Firebase Crashlytics: For crash reporting and performance monitoring.
Firebase Performance Monitoring: For app performance tracking.

4.4 Payment Processing

Apple App Store: For iOS in-app purchases.
Google Play Store: For Android in-app purchases.

5. Data Sharing and Disclosure

5.1 We Do NOT:

❌ Sell your personal information to third parties.
❌ Share your receipt data with other users.
❌ Use your data for targeted advertising.
❌ Rent or lease your information.
❌ Share data with data brokers.

5.2 We May Share Information:

With Your Consent: When you explicitly authorize sharing.
Service Providers: With trusted vendors who assist in app operations (under strict confidentiality agreements and data processing agreements).
Legal Requirements: To comply with laws, regulations, court orders, or government requests.
Safety & Rights Protection: To protect our rights, property, or safety, or that of our users.
Business Transfers: In connection with a merger, acquisition, or sale of assets (users will be notified).
Aggregated Data: Anonymized and aggregated data that cannot identify individuals.

6. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence, including the United States. We ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs) approved by the European Commission.
Adequacy decisions for data transfers.
Privacy Shield Framework compliance (where applicable).
Binding corporate rules for international transfers.

7. Your Rights and Choices

7.1 All Users

Access: View all your data within the app.
Correction: Edit and update your information.
Deletion: Delete individual accounts or your entire account.

7.2 GDPR Rights (EEA/UK Users)

If you are located in the EEA or UK, you have additional rights:

Right to Access: Request a copy of your personal data.
Right to Rectification: Correct inaccurate data.
Right to Erasure: Request deletion of your data ("right to be forgotten").
Right to Restrict Processing: Limit how we use your data.
Right to Data Portability: Receive your data in a machine-readable format.
Right to Object: Object to certain data processing activities.
Right to Withdraw Consent: Withdraw consent at any time.
Right to Lodge a Complaint: File a complaint with your local data protection authority.

7.3 CCPA Rights (California Users)

If you are a California resident, you have the right to:

Know: What personal information we collect, use, and share.
Access: Request access to your personal information.
Delete: Request deletion of your personal information.
Opt-Out: Opt-out of the sale of personal information (Note: We do not sell personal information).
Non-Discrimination: Not be discriminated against for exercising your rights.

To Exercise Your Rights

Email us at: stewart@sheetifycrm.com
In-App: Use the in-app settings menu.
We will respond within 30 days (or as required by applicable law).

8. Data Retention

Active Account: Receipt data is retained as long as your account is active.
Deleted Receipts: Removed immediately from active storage (may remain in backups for up to 90 days).
Account Deletion: Data is permanently deleted within 30 days of an account deletion request.
Legal Retention: Some data may be retained longer to comply with legal obligations.
Backups: Encrypted backups may retain data for up to 90 days for recovery purposes.
Analytics Data: Anonymized analytics data may be retained indefinitely.

9. Children's Privacy

Our App is not intended for children under 13 years of age (or 16 in the EEA). We do not knowingly collect personal information from children under these ages.

If we discover that we have collected information from a child under the applicable age:

We will delete the information immediately.
We will terminate the account.
We will notify parents/guardians if possible.

If you believe we have collected information from a child, please contact us immediately at stewart@sheetifycrm.com.

10. Mobile App Permissions

The App requests the following permissions:

Camera: To scan receipts (optional, only when you use the scan feature).
Photo Library: To select existing receipt images (optional).
Internet: To sync data with Google Sheets and cloud storage.
Storage: To temporarily store receipt images during processing.

11. Do Not Track (DNT)

We currently do not respond to Do Not Track (DNT) signals.

12. California "Shine the Light" Law

California residents can request information about our disclosure of personal information to third parties for direct marketing purposes. As stated, we do not share personal information with third parties for their direct marketing purposes.

13. Data Breach Notification

In the event of a data breach that affects your personal information:

We will notify affected users within 72 hours (as required by GDPR).
Notifications will be sent via email and in-app notification.
We will inform relevant supervisory authorities as required by law.
We will provide details about the breach and steps taken to address it.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

Updating the "Last Updated" date at the top of this policy.
Sending an email notification to your registered email address.
Displaying a prominent notice in the App.
Requiring acceptance for material changes.

Continued use of the App after changes constitutes acceptance of the updated policy.

15. Account Deletion

You can delete your account at any time.

How to delete:

In-App: Navigate to Settings → Account → Delete Account.
By Email: Contact stewart@sheetifycrm.com.
Web Portal: Visit our Account Deletion page.

Upon deletion:

Your account will be immediately deactivated.
All personal data will be permanently deleted within 30 days.
Receipt images will be removed from our servers.
You will receive a confirmation email.
Backups will be purged within 90 days.

16. Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at:

Email: stewart@sheetifycrm.com

Privacy Policy