Legal
Privacy Policy
Last updated: September 2, 2026
1. What We Collect
| Category | Examples |
|---|---|
| Account data | Name, email, phone, company, designation, country, password (hashed) |
| Receipt content | Uploaded receipt images/PDFs and the data extracted from them (merchant, amount, date, line items) |
| Payment data | Transaction records from M-Pesa/Stripe (we do not store full card numbers — these are handled by the payment processor) |
| Business/team data | Business name, domain, team member roles and activity within a business account |
| Usage data | Login activity, IP address (for rate limiting/fraud prevention), device/browser information |
2. How We Use It
- To extract structured data from receipts you upload (sent to our AI providers for processing — see §3).
- To operate your account: authentication, token balance, billing history, team membership.
- To send transactional emails (verification, receipts, business invites) and, where you've agreed, product updates.
- To prevent abuse — rate limiting, fraud detection on the free tier and payments.
3. AI Providers and Third Parties
To extract data from a receipt, the image/document is sent to a third-party AI provider (Google Gemini, OpenAI, or Google Cloud Vision, depending on configuration) for that single extraction request. We do not sell your receipt data. Payment processing is handled by Safaricom M-Pesa and Stripe, who receive only the data needed to process that transaction.
4. Data Retention
Receipt data is retained for as long as your account is active, so you can access your processing history and exports. Uploaded files for anonymous (not-logged-in) trial scans are deleted automatically after processing. You can archive receipts you no longer want to see in your active lists at any time; archived receipts remain recoverable unless you request permanent deletion.
5. Your Rights
You can request a copy of your data, correction of inaccurate data (e.g. editing an extracted receipt's fields), or deletion of your account and associated data, by contacting us at the address below. Business account data may also be subject to the business owner's data-retention decisions for that account.
6. Security
See our dedicated Data & Security page for details on how receipt files and account data are protected.
7. Changes to This Policy
We may update this policy from time to time; material changes will be communicated via email or an in-app notice where practical.
8. Contact
Questions about this policy, or requests relating to your data, can be sent to support@tafity.com.