Privacy Policy

The data controller for Erceipt is Taurel, obrt za usluge, vl. Danko Mudrinić, registered in the Croatian Craft Register (Obrtni registar); full contact details are in section 15 (Contact). For any privacy question or request, contact support@erceipt.com. Our processing does not meet the conditions of Article 37 GDPR, so we have not appointed a Data Protection Officer; contact us directly at that email.

This policy covers the Erceipt mobile app (Android and iOS), the website at erceipt.com, and the API at api.erceipt.com. It explains what personal data we process under the EU General Data Protection Regulation (GDPR) and equivalent laws, why, and what rights you have.

Account data. Email address and name. Collected when you register or sign in with email and password, Google, or Sign in with Apple (iOS). If you use Apple Hide My Email, we receive Apple's private relay address instead of your personal email. Passwords are stored only as a one-way hash; we cannot read your password. Google and Apple identifiers (subject IDs) are stored solely to sign you in again.

Your content. Receipt photos you capture or pick from the gallery, and data extracted from them (merchant, items, prices, tax breakdown, serial numbers, return or warranty dates you add or that extraction suggests). Original photos stay on your device. A compressed copy and the extracted fields sync to our server so you can search and recover your vault. On-device search embeddings stay on the device.

Subscription data. If you buy Erceipt Pro, we receive from Apple or Google the product and plan, a purchase token or original transaction ID, the subscription status, the expiry date, and whether it auto-renews. We use these only to unlock Pro on your account. We never receive your card or payment details. We also count your AI scans and AI requests to apply trial and monthly limits.

Price reports and smart search. Your price-change report, shrinkflation (same price, smaller pack, compared per kg or L), cheaper-swap hints and yearly recap are calculated on our server only from your own receipts. We never combine your receipts with other users' data and never show them to anyone else. Search first runs on your phone (plain text, then on-device embeddings). Only if that finds nothing does the app use the AI step described in section 5; results are cached on your phone so the same search is not sent twice.

Claim PDF. The return or warranty claim PDF is created on your phone. We do not receive or store it. It goes only where you send it from your phone's share sheet.

Demo mode. The demo uses an invented household that ships inside the app. It contains no real people or shops, and nothing you do in the demo is added to your vault.

Tax export. When you export a report as CSV or PDF (Pro), our server builds the file from your own receipts and sends it straight to your phone. We do not store the exported file.

Permissions and notifications. The app asks for camera and photo-library access only to capture or attach receipts, and for notification permission to remind you. Reminders (return and warranty deadlines, monthly report, price changes) are scheduled on your phone as local notifications. Our server does not send push messages. The app sends no notifications between 21:00 and 09:00, at most 3 system notices a week, and you can turn each type off in Settings. The app does not ask for location access and does not track your location.

Sessions and security. Refresh tokens, sign-in sessions, email verification and password-reset tokens, and (for staff) a short-lived admin cookie. We may log IP address, time, and error data in protected server logs to operate and secure the Service.

Identifiers. A server-generated account ID. If you allow analytics, also a Firebase app instance ID.

Usage & diagnostics. Crash reports (Firebase Crashlytics) are on by default, based on our legitimate interest in keeping the app stable and fixing errors quickly; they contain technical data (device model, OS version, stack trace) and, after you sign in, may be linked to your account ID so we can support you. You can turn them off at any time in Settings → Privacy. Usage analytics (Firebase Analytics) is off by default and only runs with your consent: after your first sign-in the app asks you once whether you want to help us with anonymous usage statistics (e.g. app open, screen views, login). You can change your choice at any time in Settings → Privacy.

We do not collect location (precise or approximate), contacts, health data, or browsing history.

You need an email address (or a Google/Apple sign-in) to create an account, because the contract cannot be performed without it. Receipts and their content are up to you. Analytics is optional and crash reports can be turned off; neither is ever a condition for using Erceipt.

We share data with the following, only to the extent needed to run the Service:

• EU hosting: Hetzner Online GmbH (Gunzenhausen, Germany), data centre in Nuremberg, Germany. A virtual private server that runs the API, Postgres database and receipt-file storage (processor, under a data processing agreement).
• Google Firebase (Analytics, Crashlytics), Google Ireland Limited / Google LLC: app usage events, app instance ID, crash logs and your account ID after sign-in. Analytics only if you have consented; crash reports until you turn them off (processor, under the Google data processing terms).
• Google Sign-In — when you tap Continue with Google, Google sends us an ID token. We store the Google account identifier plus the email and name Google provides, solely to create or sign in to your Erceipt account.
• Sign in with Apple (iOS) — when you tap Continue with Apple, Apple sends us an identity token. We store Apple's user identifier plus the email and name Apple provides (or a Hide My Email relay address), solely to create or sign in.
• Google Gemini API, provided by Google as our processor under Google's paid-service terms and the Google Cloud/Gemini API data processing addendum. We use a paid, billing-enabled Google project. Under those terms, Google processes the data only to provide the service to us and does not use it to train or improve its models. What is sent: a compressed receipt image and related extracted text, to read each receipt you scan. For price comparison and smart search (Pro): your search words plus up to 100 short item names from your receipts, or, for the last search step only, a short text line for up to 80 receipts (shop, date, items and amounts, max 400 characters each). No images, email, name or account ID are sent. Google keeps prompts and responses for 55 days solely to detect and prevent abuse of its Prohibited Use Policy and for required legal disclosures, as its Gemini API terms and abuse-monitoring policy describe; this data is not used to train models. Processing may take place outside the EEA (see Section 6).
• Apple App Store and Google Play — process Pro purchases as independent controllers. We call their servers to verify your purchase and receive the subscription details listed in section 3.
• Resend — your email address, to send verification, password-reset, and staff-admin sign-in messages.
• Cloudflare, Inc. (Cloudflare Email Routing): when you email us, your message (sender address, content and attachments) is forwarded to our support mailbox, which is hosted by Google. Cloudflare does not store the message beyond delivery.

Allowlisted operators of Taurel may see account metadata in a restricted admin tool (email, name, receipt counts, extraction usage). That tool is not a public product. We do not sell personal data, and we do not use it for third-party advertising.

Primary storage of accounts and receipt files is in the European Union. Google's services, Sign in with Apple, Resend and Cloudflare may process data outside the EEA, including the United States. Where that happens, those providers rely on an adequacy decision (including the EU–U.S. Data Privacy Framework) and/or Standard Contractual Clauses. You may request information on applicable safeguards at support@erceipt.com.

• Account and receipt data: while your account is active. If you do not sign in for 24 months, we will email you and, if you do not respond within 30 days, delete the account.
• Sessions and one-time tokens: until they expire (sign-in refresh tokens 30 days; email verification links 24 hours; password-reset links 1 hour; staff sign-in links 10 minutes).
• Server security logs (IP address, time, errors): 30 days, then deleted, unless needed longer to investigate a specific security incident or legal claim.
• Analytics (if consented) and crash reports: Firebase retention set to 2 months for user-level data; Crashlytics reports: 90 days.
• Subscription records: for the duration of the subscription plus 5 years, to defend legal claims (limitation period).
• Support emails, DSA notices and complaints: 2 years after the matter is closed (complaints register: at least 1 year, Croatian Consumer Protection Act).
• After account deletion: data is deleted from our server and your device. Database and file backups are deleted on a rolling basis within 14 days. Aggregated, de-identified analytics may be kept longer because it no longer identifies you.

Depending on the circumstances, you can ask us to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (see Section 9).
• Export your data in a portable format — email support@erceipt.com.
• Restrict processing, or object to processing based on legitimate interests (including analytics).
• Withdraw your consent to analytics, or turn off crash reporting (objection), at any time in Settings → Privacy, or by emailing us. Withdrawal does not affect processing before it. When you withdraw, collection stops and we ask Firebase to delete your analytics data.

These rights are not absolute. We may refuse or limit a request where the GDPR allows (legal obligation, establishing or defending claims, protecting others). We do not make solely automated decisions with legal or similarly significant effects (Art. 22 GDPR). Email support@erceipt.com. We respond within one month (extendable by two months for complex requests, with notice).

You can delete your account at any time from the app: Settings → Delete Account. This permanently deletes your server-side account and data, and wipes local receipt data and files from your device. This action cannot be undone. To keep your account but remove every receipt, use Settings → Danger zone → Delete all receipts; this deletes them on this device and on our server, so also on your other devices. Deleting your account does not cancel a store subscription; cancel it in the App Store or Google Play. We may keep a minimal security log of the deletion and any data we must retain by law. No app? See how to delete your account without the app.

Data is encrypted in transit (HTTPS) between the app and our server. Passwords are stored hashed. Access to production data is limited to what is needed to operate and support the Service. If a personal-data breach is likely to risk people's rights, we will notify AZOP without undue delay and, where feasible, within 72 hours, and we will notify affected users where the GDPR requires it.

Erceipt is not directed at children. You must be at least 16 years old, or older if your country sets a higher age of digital consent, to create an account. We do not knowingly collect data from younger people. If we learn that an account belongs to someone under that age, we will delete it.

The public website does not use tracking or advertising cookies. It may use strictly necessary local storage (such as remembering your color scheme). The staff admin page on the API host uses a strictly necessary HttpOnly session cookie.

We may update this policy as the Service changes. We'll update the date at the top of this page and, for material changes, notify you in the app.

If you are in the EU/EEA and believe we have not resolved your concern, you can lodge a complaint with your local data protection authority, or with Croatia's Agencija za zaštitu osobnih podataka (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, azop@azop.hr. You also have the right to an effective judicial remedy.

Data controller and contact for privacy questions and requests:

Taurel, obrt za usluge, vl. Danko Mudrinić
Registered address: Ulica Emanuela Vidovića 9, 10090 Zagreb, Croatia
OIB: 23631794050 · MB: 98712942
Email: support@erceipt.com