Privacy policy

This policy explains what personal data Receipt Router collects, why we collect it, who we share it with and what you can ask us to do with it.

Who we are

Receipt Router is run by Decent Software Ltd, a company registered in England and Wales (company number 16831421). Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We are the controller of the personal data described here and are registered with the Information Commissioner's Office (ICO) under reference ZC137637.

For anything to do with your data, email joe@decentsoftware.co.uk.

What we collect

• Your account. Your email address. We sign you in with emailed links, so we don't store a password.
• Receipts you send us. The emails you forward to your Receipt Router address: the sender, the subject and the receipt attached to or contained in the email. Forwarded emails can include personal data about you or other people, such as names and addresses printed on a receipt.
• Details we read from your receipts. The merchant's name and address, the total, currency, date and receipt number, and the raw output of the text recognition.
• Connections you set up. Access tokens for FreeAgent and Google Drive, stored encrypted. Our Google Drive access only covers files and folders Receipt Router creates; we can't see anything else in your Drive.
• Billing. Payments are handled by Stripe. We keep your Stripe customer and subscription IDs, your subscription status and dates, and your card's brand and last four digits. We never see or store your full card number.
• Technical data. Server logs, including IP addresses and the requests made to our service, which we use to keep the service running and secure.

We only see emails you choose to forward. We never ask for access to your inbox.

Why we use it

• To provide the service (performance of our contract with you): receiving your receipts, reading them, delivering them to FreeAgent and Google Drive, and billing you.
• To keep you informed (legitimate interests): emails about receipts waiting to be delivered, deliveries that failed and connections that need reconnecting.
• To keep the service secure (legitimate interests): preventing abuse, investigating problems and protecting your account.
• To meet our legal obligations: keeping accounting and tax records.

We don't sell your data, use it for advertising or use your receipts to train AI models.

Who processes it for us

We use these companies to run Receipt Router. Each one only processes your data on our behalf and under contract.

• Hetzner: hosts our servers and database (Germany).
• Cloudflare: stores receipt files (R2, EU).
• Resend: receives forwarded emails and sends our emails to you (US).
• Taggun: reads the details from your receipts (New Zealand, Australia, France and the US). Taggun may keep a copy of each receipt for up to three years.
• Stripe: takes payments and manages subscriptions (US and Ireland).
• Vercel: hosts this website (US).

When you connect FreeAgent or Google Drive, we send your receipts and their details there because you asked us to. Their own privacy policies cover what they do with them.

Where data leaves the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement (or the Addendum to the EU Standard Contractual Clauses) to protect it.

How long we keep it

• Receipt files are deleted 90 days after we receive them. Files still waiting to be delivered, or being retried, are kept until they're delivered.
• Receipt details (merchant, total, date and so on) are kept while your account is open, so you can see your history.
• Billing records are kept for six years, as UK tax law requires.
• Your account is kept until you ask us to delete it. We then delete your data within 30 days, apart from records we have to keep by law.

Copies we've delivered to your FreeAgent or Google Drive are yours. Deleting your Receipt Router account doesn't remove them.

Cookies and analytics

This website uses Simple Analytics and Vercel Analytics to count visits. Neither uses cookies or tracks you across sites, and neither collects personal data.

The Receipt Router app sets only the cookies it needs to sign you in and protect your account. We don't use advertising or tracking cookies.

Google user data

Receipt Router's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We only use our Google Drive access to create folders and save your receipts in them. We don't read your other files, use Drive data for advertising or share it with anyone else.

Your rights

Under UK data protection law, you can ask us to:

• give you a copy of your data
• correct data that's wrong
• delete your data
• restrict or object to how we use it
• send your data to you or another service in a usable format

Email joe@decentsoftware.co.uk and we'll reply within one month. This is also how to close your account and have your data deleted.

If you're unhappy with how we've handled your data, you can complain to the ICO. We'd appreciate the chance to put it right first.

Changes to this policy

If we change this policy in a way that affects you, we'll email you before the change takes effect. The date at the top shows when it was last updated. Our terms cover using the service.