This privacy policy explains how Receiptor AI collects, uses, and protects your information. We're a small team building software to automate bookkeeping, and we take your privacy seriously.
Receiptor AI is operated by Merlino, Inc., a Delaware corporation.
We provide our services worldwide with no geographic restrictions.
When you sign up, we collect:
We use Stripe to process payments. We do not store your full credit card details. Stripe handles all payment data in accordance with its security standards.
When you connect your email account, we:
We support Gmail, Outlook, and IMAP email providers. Access is granted through OAuth tokens, app-specific passwords, or account credentials, depending on your email provider.
We process and extract data from:
From these documents, we extract accounting-related information, including:
We do not extract or store full credit card numbers or bank account numbers.
If you use WhatsApp:
We integrate with Google Drive and Dropbox with limited permissions:
We integrate with QuickBooks Online and Xero. You can:
We use OAuth for these integrations and do not store your accounting software passwords.
When you use Save to Receiptor, you choose a PDF or image linked from a website, capture a full-page screenshot, or select a supported file from your computer. You can preview the document and check the destination workspace before confirming an upload. Documents you submit are sent to Receiptor AI for processing under this policy, including the document-processing providers and optional integrations described here.
The extension accesses pages when you request capture or document discovery. It can request access to an individual website, including a website hosting an embedded document. You can also choose to allow capture across HTTPS websites. These permissions do not enable automatic browsing of billing histories or background collection. You can manage or revoke website permissions in Chrome's extension settings.
Submitted documents may contain names, contact details, financial information, and other information visible in the file or captured page. A screenshot can include page content outside the document, so check the preview before uploading. Capture metadata includes the website origin, capture method, and capture time. Full source page URLs and their query strings are not included as upload metadata, but addresses or other information visible in document content or screenshot pixels can still be included.
The extension signs you in through Receiptor OAuth and uses the authorized account and workspace to upload documents and check processing status. OAuth access and refresh tokens are kept in extension session storage, restricted to trusted extension contexts. Public client registration information and submission status may be kept locally. The extension does not receive your Receiptor password or store website login credentials.
To recover an interrupted upload, the extension can retain one confirmed document locally, up to 10 MB, with its destination and submission identifier. It checks a 24-hour expiry when pending state is accessed. Local document bytes are removed after upload acceptance, when you discard the pending file, or during a successful local sign-out cleanup. Discarding the local copy does not delete a document already accepted by Receiptor. Server copies follow the document retention and deletion practices in this policy.
The extension does not sell captured content, use it for advertising, or load remotely hosted executable code. Its purpose is to capture and submit the documents you choose to your authorized Receiptor workspace. For privacy questions or data requests, contact info@receiptor.ai.
We collect:
We use Google Analytics and PostHog for analytics, which may include session replays and usage logs to help us improve the product.
We use essential cookies for authentication and functionality. Our analytics tools (Google Analytics, PostHog) use cookies to track usage. You can control cookies through your browser settings. We respect Do Not Track browser signals.
We use your information to:
We do not use your data for marketing purposes or to train AI models.
We use a combination of third-party AI services (OpenAI, Azure, AWS) and our custom-trained models to process your documents.
Your data is never used to train or improve AI models—neither ours nor third-party models.
You can permanently delete your documents at any time without contacting support.
We use the following third-party services that may process your data:
These services act as subprocessors under GDPR terms. For international data transfers, we rely on the safeguards in our providers' data processing terms, including the European Commission's Standard Contractual Clauses where they apply.
We do not sell, rent, or trade your personal information to third parties.
We do not share your data with law enforcement or government agencies except when required by valid legal process (court order, subpoena, or other legal obligation). To date, we have never received such a request.
In the event of a merger, acquisition, or sale of assets, user data may be transferred to the new owner. We would notify you via email and provide options for data deletion if you prefer not to continue.
You can download your data at any time in the following formats:
You can:
When you delete your account, all data is removed immediately.
You can unsubscribe from product update emails using the link in any email or through your account settings. You will continue to receive essential transactional emails (such as extraction confirmations, error notifications, etc.).
For EU, UK, and California residents, you have the right to:
To exercise these rights, contact us at info@receiptor.ai.
GDPR Compliance: We comply with the General Data Protection Regulation for all EU and UK users.
CCPA Compliance: We comply with the California Consumer Privacy Act for California residents.
Receiptor AI is operated by Merlino, Inc., a US company, and serves customers worldwide. Your data is stored in France and Australia, as described in section 5. Some of the service providers listed in section 6 process data in other countries, including the United States. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the safeguards in our providers' data processing terms, including the European Commission's Standard Contractual Clauses where they apply.
In the unlikely event of a data breach:
Receiptor AI is intended for business use. We do not have age verification in place, but our service is not designed for or directed at children under 16. We do not knowingly collect information from children.
Only authorized team members (Romeo Bellon and Luigi Fernandez, the founders) have access to customer data, and only under these circumstances:
All data access is logged for security and accountability.
We will notify you of privacy policy changes via email through Customer.io. For material changes that affect how we use your data, we may require your acceptance before you continue using the service.
For privacy questions, data requests, or concerns:
For data access, correction, or deletion requests, simply email us at info@receiptor.ai with your request. We'll respond promptly.
This policy reflects our commitment to protecting your privacy while being transparent about our practices. We're a small team that values every customer, and we're here to answer any questions you have.
