Privacy Policy

1. What we collect

• Account: email address, a securely hashed password (we never see the actual password), language preference, business type.
• Receipts: the photos you upload and the data extracted from them (vendor, date, amount, currency, receipt number, category).
• Usage: basic technical analytics from our hosting provider, from Google Analytics (GA4), and from the Meta (Facebook) Pixel — pages visited, device type, approximate location — used to understand and improve the service and to measure our ads and site visits on Facebook. IP addresses are processed by these providers as part of their standard behavior. No cross-site advertising trackers beyond the Meta Pixel described here.

2. How AI processing works

When you scan a receipt, the image is transmitted securely to an AI model (currently Google's Gemini, accessed through our infrastructure provider Lovable) solely to extract the receipt's details for you. The extraction result is stored in your account. We do not use your receipts to train AI models.

3. Where your data lives

Data is stored with our cloud infrastructure providers (Supabase/Lovable Cloud), encrypted in transit and at rest. Receipt images are stored in private storage accessible only to your account (and an accountant you explicitly authorize).

4. Who can see your data

Nobody but: (a) you; (b) an accountant you explicitly authorize (read-only, revocable); (c) our infrastructure and AI service providers strictly as needed to operate the service; (d) authorities if the law requires it. We never sell personal data and we show no ads.

5. Your rights

You may request access to, correction of, or deletion of your data at any time via support@contapic.com. California residents have additional rights under the CCPA, including the right to know, delete, and non-discrimination; we do not "sell" or "share" personal information as the CCPA defines those terms.

6. Retention

Your data is retained while your account is active. When you delete a receipt it is removed immediately from your workspace; account deletion removes your data from active systems within 30 days (backup copies expire on a rolling basis thereafter).

7. Children

ContaPic is not directed to children under 18 and we do not knowingly collect their data.

8. Cookies

We use essential cookies/tokens to keep you signed in, plus Google Analytics cookies (_ga and related) for anonymous usage statistics, and the Meta (Facebook) Pixel cookie (_fbp) which helps us measure our ads and site visits on Facebook. We do not sell or share personal data, and we never send emails or other personal identifiers to these analytics providers. See Google's Privacy Policy and Meta's Privacy Policy for how those providers handle this data.

9. Changes

We will post any changes here and update the effective date; material changes will be announced in the app or by email.

10. Contact

Privacy questions: support@contapic.com — RoTeix Inc, California, USA.