Privacy Policy
Last updated: June 23, 2026
This Privacy Policy describes how ReceiptBay ("we", "us", or "our") collects, uses, and shares information when you use our websites, mobile applications, and services (collectively, the "Services").
1. Information We Collect
We collect the following categories of information:
- Account information — name, email address, and authentication identifiers.
- Receipt and transaction data — merchant, items, amounts, dates, and payment metadata you submit or that is captured on your behalf.
- Usage data — device information, log data, and interactions with the Services.
2. How We Use Information
- To provide, maintain, and improve the Services.
- To centralize and organize your receipts and transaction history.
- To deliver relevant offers and loyalty features where applicable.
- To detect, prevent, and address fraud, security, and technical issues.
3. How We Share Information
We share information with service providers, business partners, and as required by law.
⚠️ [TODO] Detail B2B2C data-sharing relationships (banks, fintechs, manufacturers) and the legal basis for each.4. Data Retention
We retain personal information for as long as necessary to provide the Services and as required by applicable law.
5. Your Rights
Depending on your location, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing.
⚠️ [TODO] Add GDPR (EEA/UK) and CCPA/CPRA (California) specific rights and request mechanisms.6. Security
We use enterprise-grade, PCI-compliant infrastructure and apply technical and organizational measures designed to protect your information.
7. Children's Privacy
The Services are not directed to children under the age required by applicable law.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version and revise the "Last updated" date above.
9. Contact Us
Questions about this Privacy Policy can be sent to privacy@receiptbay.com.
⚠️ [TODO] Add legal entity name, registered address, and EU/UK representative or DPO if required.