Privacy policy

ReceiptKite is operated by Raj Bagri, a sole proprietor in Panna, Madhya Pradesh, India (“we”, “us”). This policy explains what we collect when bookkeeping firms (“customers”) and their clients use ReceiptKite, and how we protect it. Questions: privacy@receiptkite.com.

Our role

For documents and data that customers upload about their clients, the customer is the controller and we are their processor: we only process it to provide the service, on their instructions, under our Data Processing Agreement. For account information about the people who sign in, we are the controller.

What we collect

• Account data: name, email address, sign-in provider, firm name and team roles.
• Client documents: invoices, receipts and statements uploaded by customers, sent by email, or uploaded by their clients through upload links, and the data we extract from them (vendors, amounts, dates, line items, bank details).
• Usage and security data: an audit log of actions (sign-ins, views, edits, exports) with IP address and browser, and technical logs.
• Billing data: handled by Paddle, our reseller and merchant of record. We store your subscription status, never your card details.
• Connected ledgers: if a customer connects Xero, QuickBooks or Zoho Books, access tokens (encrypted) and the chart of accounts needed to create bills.

How we use it

• To read documents, validate them and present them for review.
• To create exports and bills in the customer’s accounting software when they ask us to.
• To send the emails customers set up: team invites and receipt reminders to their clients.
• To secure the service, prevent abuse and meet legal obligations.

We do not sell personal data, and we do not use customer documents to train AI models.

Sub-processors

• Google (Gemini API, paid tier; Firebase Authentication; Google Cloud in London, UK and the Netherlands, EU): document reading, sign-in and application servers.
• Supabase (London, UK): database and encrypted file storage.
• Paddle: checkout, payments and invoicing, as merchant of record.
• Resend (EU): sending invites and reminders, and receiving documents emailed to clients’ ReceiptKite addresses.
• Cloudflare: domain name service and forwarding of our support email.
• Xero / Intuit QuickBooks / Zoho Books: only when a customer connects them.

Security

Every stored file is encrypted with AES-256-GCM by the application, on top of storage-level encryption. Each firm’s data is isolated in the database with row-level security. Access to files uses short-lived signed links and is recorded in an append-only audit log.

Retention

Customers choose how long documents are kept and can delete them at any time. When an account is closed we delete its documents within 30 days and backups roll off within 35 days, unless the law requires us to keep something longer.

Your rights

You can ask for a copy of your personal data, or ask us to correct or delete it. If your data was uploaded by a bookkeeping firm, contact them first: they control it, and we will help them respond. You may also complain to your local data-protection authority. In India, these rights come from the Digital Personal Data Protection Act, 2023; our grievance contact is Raj Bagri at privacy@receiptkite.com, and we reply within 30 days.

International transfers

Documents are stored in the UK. Some processing, such as AI reading by Google, may happen in other countries. Where data leaves the UK or EEA, we rely on Standard Contractual Clauses or an adequacy decision.

Changes

We will tell customers by email at least 30 days before any material change to this policy.