Your business records deserve clear privacy rules.

1. Scope and accountability

This notice applies to the Receiptly website, Receiptly Field mobile app, public document links, and support interactions. Receiptly is accountable for personal information under its control.

The Receiptly Privacy Officer receives privacy questions, access or correction requests, deletion requests, and complaints at support@receiptlyapp.ca.

2. Information we collect

We collect information you provide, information added by authorized workspace members, and limited technical information created while the service is used.

• Account and profile details, including names, email addresses, optional phone numbers, login records, and workspace roles.
• Business and workspace records, including clients, projects, budgets, schedules, receipts and receipt images, project media, time and labor entries, estimates, invoices, and recorded external payments.
• Location attached to a time punch only when a user enables location access and uses a location-enabled time feature.
• Subscription and billing information from Stripe, such as plan, subscription status, invoices, and payment status. Receiptly does not store full payment-card numbers.
• Support messages, requested email delivery records, notification preferences, device notification tokens, IP address, device or browser details, and security diagnostics.
• Essential browser or device storage used to keep a session active, remember preferences, and support offline or faster loading where available.

3. Why we use information

Receiptly uses information only for identified business and service purposes, or as otherwise permitted or required by law.

• Authenticate users, secure accounts, and enforce workspace roles and project assignments.
• Store, synchronize, organize, calculate, display, export, and delete the records a workspace chooses to keep.
• Extract proposed receipt details, support address search, generate requested documents, and deliver estimate links or invoice PDFs.
• Operate subscriptions, enforce plan limits, provide support, deliver requested notifications, investigate misuse, and maintain service reliability.
• Meet legal, accounting, security, fraud-prevention, and dispute-resolution obligations where they apply.

4. Workspace access and customer responsibilities

Workspace owners and administrators decide who is invited, which role each person receives, and which projects or records they may access. Authorized workspace members may see personal information according to those permissions.

A business that adds employee, client, or other third-party information is responsible for having the authority to do so, providing any required notice, and responding to requests for records it controls. Receiptly supports the workspace in carrying out those instructions.

5. Service providers and processing locations

Receiptly uses service providers to operate the product. They receive only the information needed for their assigned function and process it under their own security and privacy commitments.

Depending on provider infrastructure and configuration, information may be processed outside your province or outside Canada and may be subject to the laws of that location.

• Supabase for authentication, database, realtime features, and file storage.
• Netlify for website hosting and server functions.
• Google services for receipt-detail extraction and address lookup when those features are used.
• Stripe for subscription checkout, billing, and payment processing.
• Resend and device notification providers for requested email and push delivery.
• Professional advisers, regulators, law enforcement, or a successor to the business when disclosure is lawfully required or reasonably necessary.

6. Consent and your choices

Core account and workspace information is necessary to provide the service. Optional camera, photo-library, location, and notification permissions are requested in context and can be declined or withdrawn in browser or device settings.

Withdrawing a permission may prevent the related feature from working, but it does not remove records that were already saved. An authorized user can delete those records separately where the product allows it.

7. Retention, export, and deletion

Workspace records remain while the workspace is active or until an authorized user deletes them. Before closing an account, owners should export any records their business must retain.

Deleted data may remain for a limited period in protected backups or logs before normal deletion cycles complete. Receiptly may retain limited billing, security, fraud-prevention, dispute, or legal records for as long as reasonably required for those purposes.

8. Security

Receiptly uses encrypted network connections, role-based workspace access, restricted service credentials, and provider security controls appropriate to the information handled. No online service can guarantee absolute security.

If a privacy breach creates a legal notification obligation, Receiptly will notify affected people and regulators as required.

9. Access, correction, and complaints

You may ask to access, correct, export, or delete personal information under Receiptly’s control, or withdraw consent where applicable. We may need to verify identity and authority before acting on a request, and legal exceptions may apply.

For records controlled by a customer workspace, start with that workspace owner. You may also contact the Receiptly Privacy Officer. If a concern is not resolved, you may contact the privacy regulator that applies in your jurisdiction.

10. Service and marketing communications

Receiptly sends account verification, security, billing, support, document-delivery, and notification messages needed to provide requested features. Some service messages cannot be disabled while an account remains active.

If Receiptly introduces optional marketing messages, they will use applicable consent, sender identification, and unsubscribe controls.

11. Minors and changes to this notice

Receiptly is a business service intended for people aged 18 and over. It is not directed to children.

We may update this notice as the product, providers, or legal obligations change. The current version and update date will remain available here, and material changes will be communicated through an appropriate service notice.