Privacy Policy
Last updated: March 31, 2026
ricevuta.ai ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our expense management platform ("the Service").
We act as a data processor on behalf of the companies that use our Service. The company Admin who creates a workspace acts as the data controller for their organisation's data.
1. Data We Collect
1.1. Account Data
When you register, we collect your email address and full name. If you are an Admin, we also collect your company name.
1.2. Expense Data
When you submit expenses, we collect: receipt images (photographs of physical or digital receipts), extracted data (vendor name, amount, currency, date, VAT amount, description, category), and any notes or descriptions you provide.
1.3. AI Processing Data
When you use the AI extraction feature, your receipt image is sent to Google Gemini (operated by Google LLC) for processing. The image is processed in memory and immediately discarded — Google does not store or retain your receipt images after extraction. The AI-generated extraction results are returned to our servers and stored alongside your expense records. We use the Google Gemini API with data governance settings that prevent your data from being used to train or improve Google's models.
1.4. Usage Data
We collect standard usage data including: pages visited, features used, device type, browser type, IP address, and access times. This is used solely for improving the Service and diagnosing issues.
1.5. Communication Data
If you contact us via email, we retain the correspondence including your email address and message content.
2. How We Use Your Data
- Providing the Service: Processing your expense submissions, managing your account, enabling AI receipt extraction, and generating exports.
- Authentication: Sending one-time verification codes to your email address via our email provider.
- Communication: Sending you service-related notifications such as expense approval/rejection updates, and responding to your enquiries.
- Improvement: Analysing usage patterns to improve the Service. We do not use your expense data or receipt images for this purpose.
- Legal compliance: Meeting our obligations under applicable laws, including tax and financial record-keeping requirements.
3. Legal Basis for Processing (GDPR)
- Performance of a contract: Processing necessary to provide the Service you have signed up for.
- Legitimate interests: Usage analytics to improve the Service, provided this does not override your rights.
- Legal obligation: Retention of certain records as required by law.
- Consent: Where required, such as for optional communications. You may withdraw consent at any time.
4. Third-Party Services
| Service | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account data, expense data, receipt images | EU (Zurich, Switzerland) |
| Google Gemini API | AI receipt data extraction | Receipt images (in-memory processing only) | US |
| Resend | Transactional email delivery (OTP codes, notifications) | Email addresses | US |
We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes. All third-party providers are bound by data processing agreements and are required to process data in accordance with GDPR requirements.
5. International Data Transfers
Some of our service providers are based in the United States. Where data is transferred outside the EEA/UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission. Our primary database is hosted in Zurich, Switzerland, which benefits from an EU adequacy decision for data protection.
6. Data Retention
| Data type | Retention period |
|---|---|
| Account data | Duration of account + 30 days after deletion |
| Expense data and receipt images | Duration of account + 30 days after deletion, or as required by applicable tax law (up to 10 years for Italian tax requirements, 6 years for UK HMRC requirements) |
| AI extraction responses | Same as expense data |
| Usage/analytics data | 12 months |
| Email correspondence | 24 months |
Upon account termination, we delete your data within 30 days unless retention is required by law.
7. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption in transit (TLS 1.2+) for all data transmission
- Encryption at rest for stored data
- Row-level security ensuring strict data isolation between companies
- Secure authentication via one-time email verification codes
- Regular security reviews and updates
- Access controls limiting employee access to data on a need-to-know basis
See our Security page for further details.
8. Your Rights
Under GDPR and UK GDPR, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of inaccurate personal data.
- Right to erasure: Request deletion of your personal data, subject to legal retention requirements.
- Right to restrict processing: Request that we limit how we use your data.
- Right to data portability: Receive your data in a structured, machine-readable format.
- Right to object: Object to our processing of your data based on legitimate interests.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, contact us at enrico@ricevuta.ai. We will respond within 30 days.
If you are a company employee whose expenses are processed through ricevuta.ai, please contact your company's Admin in the first instance, as they are the data controller for your data.
9. Cookies
The Service uses essential cookies and local storage for authentication session management and language/theme preferences. We do not use advertising or tracking cookies.
10. Children's Privacy
The Service is not intended for individuals under 18 years of age. We do not knowingly collect data from children.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The "Last updated" date at the top of this page indicates when the policy was last revised.
12. Contact and Complaints
For privacy-related questions or to exercise your rights:
Email: enrico@ricevuta.ai
If you are unsatisfied with our response, you have the right to lodge a complaint with:
- UK: Information Commissioner's Office (ICO) — ico.org.uk
- Italy: Garante per la protezione dei dati personali — garanteprivacy.it