Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Full name
• Organisation name and details
• Password (encrypted)
• Billing information (processed securely via Stripe)

1.2 Receipt Data

When you upload receipts for processing, we collect:

• Receipt images (temporarily stored for processing)
• Extracted data including vendor names, amounts, dates, and tax information
• Metadata such as upload timestamps and batch identifiers

1.3 Usage Data

We automatically collect certain information when you use our service:

• IP address and device information
• Browser type and version
• Pages visited and features used
• Time and date of access

2. How We Use Your Information

We use the collected information to:

• Provide our services: Process receipts, extract data, and generate reports
• Improve our AI: Enhance OCR accuracy and data extraction capabilities
• Communicate with you: Send service updates, security alerts, and support messages
• Process payments: Handle subscription billing and invoicing
• Ensure security: Detect and prevent fraud, abuse, and unauthorized access
• Comply with laws: Meet legal obligations and respond to lawful requests

3. Data Storage and Security

3.1 Data Location

Your data is stored on secure servers located in the European Union (Frankfurt, Germany) using AWS infrastructure. We use Supabase for database services, which provides enterprise-grade security and compliance.

3.2 Security Measures

• End-to-end encryption for data in transit (TLS 1.3)
• AES-256 encryption for data at rest
• Multi-tenant architecture with row-level security
• Regular security audits and penetration testing
• Two-factor authentication (2FA) support
• SOC 2 Type II compliant infrastructure

3.3 Data Retention

Receipt images are temporarily stored for processing and automatically deleted within 30 days. Extracted data is retained for the duration of your subscription plus 90 days for account recovery purposes. You can request immediate deletion at any time.

4. Data Sharing

We do not sell your personal data. We may share information with:

• Service providers: Trusted partners who assist in operating our service (Clerk for authentication, Stripe for payments, Mistral AI for OCR processing)
• Legal authorities: When required by law or to protect our rights
• Business transfers: In connection with a merger, acquisition, or sale of assets

All third-party providers are contractually bound to protect your data and use it only for specified purposes.

5. Your Rights (GDPR & KVKK Compliance)

Under GDPR (EU) and KVKK (Turkey), you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Revoke previously given consent at any time

To exercise these rights, contact us at recipo@recipo.cloud

6. Cookies and Tracking

We use essential cookies to:

• Maintain your session and authentication status
• Remember your preferences
• Ensure security and prevent fraud

We use Vercel Analytics for performance monitoring, which collects anonymized usage data. We do not use third-party advertising cookies.

7. International Transfers

Your data may be processed in countries outside your residence. When transferring data outside the EU/Turkey, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all service providers
• Compliance with GDPR Article 46 requirements

8. Children's Privacy

Recipo is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a minor, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or through a prominent notice on our website. Continued use of our service after changes constitutes acceptance of the updated policy.

10. Contact Us

For privacy-related inquiries or to exercise your data rights: