Privacy Policy

Receiptile Pty Ltd (ACN 696 486 674) · Last updated: 8 July 2026

1. About this policy

This Privacy Policy explains how Receiptile Pty Ltd ("Receiptile", "we", "us", "our") collects, uses, stores, and shares information when you use the Receiptile website, mobile application, hardware device, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information we collect

2.1 Account information

When you create a Receiptile account, we collect your name, email address, and authentication credentials (via Google, Apple, or Microsoft sign-in).

2.2 Receipt data

When a Receiptile device captures a receipt from a point-of-sale system, we collect and process the transaction data contained in that receipt, including merchant name, items purchased, quantities, prices, tax amounts, payment method (type only, not full card numbers), date, and time.

2.3 Device information

We collect information about the Receiptile hardware device, including device identifiers, WiFi connection status, firmware version, and operational logs.

2.4 Email receipt data (Gmail integration)

If you choose to connect your Google account to Receiptile, we access your Gmail inbox using the Google Gmail API with the gmail.readonly scope. This access is used solely to scan your inbox for email receipts and transaction confirmations, extract receipt data from those emails, and add them to your Receiptile receipt history.

Receiptile's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We only read emails that match receipt and transaction patterns. We do not read, store, or process the contents of your other emails.
  • We do not use Gmail data for advertising, market research, or any purpose unrelated to providing the Receiptile receipt management service to you.
  • We do not allow humans to read your email data unless (a) you give us affirmative consent, (b) it is necessary for security purposes such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) our use is limited to internal operations and the data has been aggregated and anonymised.
  • We do not transfer Gmail data to third parties except as necessary to provide or improve the Service, to comply with applicable law, or as part of a merger, acquisition, or asset sale with prior notice to users.
  • Gmail data is stored on our servers using encryption in transit (TLS 1.2+) and encryption at rest (AES-256).
  • You can disconnect your Gmail account at any time from your Receiptile account settings. Upon disconnection, we will delete all stored Gmail-derived receipt data within 30 days.

2.5 Camera and file uploads

If you use the camera or file upload feature to photograph or upload a receipt, we process the image to extract receipt data. Images are processed and then deleted; we retain only the extracted structured data.

2.6 Usage information

We collect information about how you use the Service, including pages visited, features used, timestamps, and device type (browser, operating system).

2.7 Tap data

When a consumer taps a Receiptile device to retrieve a receipt, we collect the timestamp of the tap and basic device information (browser user agent). We do not collect the consumer's identity, name, email, phone number, or any personal information from the tap interaction.

3. How we use your information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Process and display digital receipts
  • Generate receipt analytics for merchants
  • Enable receipt export to accounting software (e.g., Xero, Dext)
  • Send you service-related notifications (e.g., receipt ready, account updates)
  • Ensure the security and integrity of the Service
  • Comply with legal obligations

We do not sell your personal information to third parties. We do not use your data for advertising or marketing by third parties.

4. How we store and protect your information

  • All data is transmitted over HTTPS with TLS 1.2 or higher
  • Receipt data is stored on servers with encryption at rest
  • Each receipt is cryptographically signed using Ed25519 to ensure data integrity
  • Hardware device authentication uses unique device secrets
  • We retain receipt data for as long as your account is active or as needed to provide the Service

Our servers and service providers are located in the United States (application hosting, database, AI processing, and payments). Section 8 describes the safeguards that apply to international transfers for UK and EU users.

If you close your account, we delete your personal information within 90 days, except where we must keep specific records for longer to meet legal obligations (for example, tax and accounting records), to resolve disputes, or to enforce our agreements. You can export your receipt data at any time before closing your account.

5. Third-party services

We use the following third-party services to operate the Service:

  • Auth0: authentication and identity management
  • Google Gmail API: email receipt scanning (only with your explicit consent)
  • OpenAI API: receipt data extraction and normalisation (receipt data only, not personal information, is sent for processing)
  • Apple Push Notification Service (APNs): push notifications on iOS
  • Stripe: payment processing for subscriptions

Each third-party service is governed by its own privacy policy, and we only share the minimum data necessary for each service to function.

6. Your rights

You have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate information
  • Delete your account and associated data
  • Object to, or ask us to restrict, certain processing
  • Receive a copy of your data in a structured, machine-readable format (data portability)
  • Disconnect third-party integrations (e.g., Gmail) at any time
  • Export your receipt data
  • Opt out of non-essential communications

To exercise any of these rights, contact us at info@receiptile.com. We respond to requests within 30 days and may need to verify your identity first.

7. Australian Privacy Act

We comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). If you believe we have breached the APPs, you may lodge a complaint with us at info@receiptile.com. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

8. United Kingdom and European Union users

If you are in the United Kingdom or the European Economic Area, the UK GDPR or EU GDPR applies to our processing of your personal information, and this section applies to you.

8.1 Legal bases for processing

  • Contract: creating and administering your account, capturing and delivering receipts, and billing.
  • Consent: Gmail receipt scanning, and non-essential cookies and analytics. You can withdraw consent at any time.
  • Legitimate interests: securing the Service, preventing fraud and abuse, and responding to enquiries.
  • Legal obligation: retaining tax and accounting records.

8.2 Your rights

All of the rights in section 6 apply, including objection, restriction, and data portability. We do not use your personal data for automated decision-making that produces legal or similarly significant effects.

8.3 International transfers

Receiptile is an Australian company and our service providers process data in the United States. Where personal data of UK or EEA users is transferred outside the UK or EEA, we rely on providers certified under the EU-US Data Privacy Framework (and the UK Extension), or on standard contractual clauses approved by the UK and EU authorities.

8.4 UK and EU representative

We are in the process of appointing a UK and EU representative. Their details will be published on this page once appointed. In the meantime, please direct all UK and EU privacy matters to info@receiptile.com.

8.5 Complaints

You may lodge a complaint with the UK Information Commissioner's Office at ico.org.uk or with your local EU data protection authority. We would welcome the chance to address your concern first at info@receiptile.com.

9. United States users

We do not sell your personal information, and we do not share it with third parties for cross-context behavioural advertising. If you are a resident of California or another US state with a consumer privacy law, you can exercise the rights in section 6 (access, correction, deletion, and portability) by emailing info@receiptile.com, and you can manage advertising preferences on our Your Privacy Choices page. We will not discriminate against you for exercising your privacy rights, and we extend these rights to all users regardless of location.

10. Cookies and analytics

We use essential cookies to operate the site, analytics tools (including Microsoft Clarity) to understand how the site is used, and advertising tools (including Meta) to measure our marketing. For visitors in the UK and EEA, non-essential cookies and similar technologies are used only with your consent, which you can give or withdraw through the cookie banner. You can also control cookies through your browser settings.

11. Children's privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.