Privacy Policy

1. Information We Collect

Receipy ("we," "our," or "us") collects the following categories of information when you use our website and services:

Information You Provide

• Receipt images or files: When you upload a grocery receipt (JPG, PNG, or PDF), we process the image to extract text identifying grocery items. The image is used solely for this purpose.
• Email address: If you join our waitlist or create an account, we collect your email address to send you product updates and communications you requested.
• Dietary preferences: Preferences you select (e.g., vegetarian, gluten-free) to personalize meal plan suggestions.

Information Collected Automatically

• Usage data: Pages visited, features used, time spent, and interactions with the app.
• Device data: Browser type, operating system, screen resolution, and referring URLs.
• IP address: Approximate geographic location (country/state level only).
• Cookies and local storage: Session identifiers and preference data (see Section 4).

Information We Do NOT Collect

• Payment card or financial information (we do not process payments directly)
• Government-issued ID numbers
• Precise GPS location
• Contact lists or social media data

2. How We Use Your Information

We use the information we collect for the following purposes:

• Core service: Parsing receipt text, identifying ingredients, estimating expiry dates, and generating personalized 7-day meal plans.
• Product communications: Sending waitlist updates, product announcements, and service emails to users who signed up.
• Product improvement: Analyzing aggregated, anonymized usage patterns to improve accuracy, recipe matching, and user experience.
• Security: Detecting and preventing fraudulent activity or abuse of our services.
• Legal compliance: Meeting our obligations under applicable US federal and state laws.

We do not use your information for: targeted advertising, profiling for third-party marketing, or any automated decision-making that produces legal or similarly significant effects.

3. Information Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

Service Providers

We work with trusted third-party vendors who help us operate our service, including:

• Cloud hosting and infrastructure providers (e.g., servers, databases)
• AI/OCR processing providers for receipt text extraction
• Email delivery providers for transactional and marketing emails
• Analytics tools (using anonymized/aggregated data only)

These providers are contractually bound to use your data only as instructed by us and in accordance with this policy.

Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Receipy, our users, or the public.

Business Transfers

If Receipy is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

4. Cookies & Tracking

We use cookies and similar tracking technologies to operate and improve our service:

• Essential cookies: Required for the site to function (session management, security tokens). Cannot be disabled.
• Preference cookies: Remember your dietary preferences and display settings.
• Analytics cookies: Help us understand how visitors use our site (page views, feature usage). We use anonymized data only.

You can control cookies through your browser settings. Disabling non-essential cookies will not impair core functionality. We honor "Do Not Track" browser signals where technically feasible.

5. Data Retention

• Receipt images: Deleted within 24 hours of processing. We retain only the extracted ingredient text, not the image file.
• Ingredient and meal plan data: Retained for 90 days for users without accounts. Account holders may delete their history at any time.
• Email addresses: Retained until you unsubscribe or request deletion.
• Anonymized analytics: Retained indefinitely in aggregated, non-identifiable form.

You may request deletion of your personal data at any time by emailing legal@receipy.io. We will process verified requests within 30 days.

6. Security

We implement industry-standard technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls limiting employee access to personal data
• Regular security reviews of our infrastructure and code

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach affecting your rights, we will notify you as required by applicable law.

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is currently necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise your California rights, contact us at legal@receipy.io with the subject line "CCPA Request." We will verify your identity before processing your request and respond within 45 days.

8. Children's Privacy

Receipy is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at legal@receipy.io and we will delete such information promptly.

Users between 13 and 18 should use the service only with parental or guardian consent.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to registered users at least 14 days before changes take effect
• Display a prominent notice on our website for 30 days

Your continued use of Receipy after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree to the changes, you should stop using the service and may request deletion of your data.