This Privacy Policy explains how JnDee Tech Limited (company number 16666978, registered office Unit 10 Vally Point Industrial Estate, Beddington Farm Road, Croydon, Surrey, United Kingdom, CR0 4WP) ("we", "us") handles personal data when you visit or use ReceiptTidy (the "Service").
We act as controller for information used to manage accounts, bill customers, answer enquiries, improve and secure the Service, and meet our own legal obligations. When we handle receipts, invoices, bank statements and bookkeeping records on a customer's instructions, that customer is normally the controller and we act as its processor under the data-processing instructions governing that relationship. The linked Data Processing Agreement is the proposed form for the planned external-customer service and is not incorporated merely because it is published or linked. If you use ReceiptTidy through an employer or another organisation, that organisation's privacy information also applies to its use of your data.
1. Information we collect
- Account and organisation information: name, business email address, hashed password, organisation, role, consent records and connected sign-in provider identifiers. We may receive this from you, an organisation administrator, Google sign-in or an invitation.
- Billing information: plan, subscription status, invoices and limited payment metadata. Stripe handles card details; we do not store full card numbers.
- Customer content: receipts, invoices, bank statements, email attachments, WhatsApp media, extracted text and bookkeeping data. These records may contain names, contact details, transaction information, tax identifiers and incidental sensitive information.
- Inbound communications: sending address or phone number, email subject/body, support and sales messages, attachments and delivery metadata.
- Connected-service information: encrypted OAuth tokens, provider account identifiers and data exchanged with accounting platforms you choose to connect.
- AI suggestion records: suggested and final values, confidence/model metadata, relevant receipt, supplier or customer references, and the user's acceptance, correction or feedback. Receipt images are not placed in this learning log.
- Technical and security information: session identifiers, IP address, browser/device data, timestamps, audit events and diagnostic information.
Account and contact information marked as required is needed to create and secure an account, provide the Service and communicate about it. Without it, we may be unable to provide the requested account or feature.
2. Why we use controller data
| Purpose | Information | Lawful basis |
|---|---|---|
| Create and administer an individual or sole-trader account | Account and organisation information | Contract |
| Administer business-customer users and contacts | Account and organisation information | Legitimate interests in providing and managing a business service |
| Billing, tax and financial administration | Account and billing information | Contract and legal obligations |
| Answer enquiries and provide support | Account, contact and communication information | Contract or legitimate interests in supporting users and prospective customers |
| Secure the Service, prevent abuse and keep an audit trail | Account, technical and security information | Legitimate interests in protecting users, the Service and our legal rights; legal obligations where applicable |
| Improve AI suggestions and evaluate accuracy | Pseudonymised suggestion and human-feedback records | Legitimate interests in improving bookkeeping suggestions, subject to an organisation-level opt-out and the right to object |
| Send verification, security, service and legal notices | Account and contact information | Contract, legal obligations and legitimate interests in operating the Service |
For customer content processed on a customer's instructions, the customer determines the lawful basis. We provide the contracted processing service and follow the customer's documented instructions.
3. OCR, AI and automated publishing
We use OCR and AI to extract, classify and suggest bookkeeping information. Your organisation can review and correct results. If an administrator enables automatic publishing for trusted suppliers or customers, eligible documents may be approved and sent to a connected accounting platform without a separate review of each document. Your organisation controls those settings and remains responsible for checking its accounting records.
We may also use AI to interpret receipt-email instructions, route WhatsApp receipts, summarise company information and answer support or sales questions. These tools support bookkeeping and communications; they are not intended to make decisions with legal or similarly significant effects about individuals.
Unless an administrator opts the organisation out in Settings → AI learning, we record selected AI suggestions and users' subsequent choices to improve suggestions across the Service. Opting out stops new learning records and marks existing records as excluded from future training use. It does not erase operational bookkeeping records; those can be addressed through a deletion request.
4. Service providers and recipients
We use the following providers for the stated purposes:
| Provider/category | Purpose and data involved |
|---|---|
| Google Cloud | Vision OCR receives pre-processed document images; embedding services may receive extracted text and business vocabulary. |
| Firebase Cloud Messaging | Relays push notifications to the native app on devices where you have opted in, using the device's push token. Relay-only — no receipt content is included in the notification payload. |
| AI service providers | Text entered into sales/support tools, extracted text, prompts and business vocabulary may be processed to generate answers and structured bookkeeping suggestions. |
| Cloudflare | DNS, content delivery, security, email routing and R2 document storage. |
| Hetzner Online | EU-hosted application, database, backups and self-hosted support infrastructure. |
| Resend | Transactional account and service email, including recipient address and message content. |
| Meta WhatsApp Cloud API | Optional WhatsApp receipt capture and related messaging metadata. |
| Stripe | Optional checkout, payment and fraud-prevention services. |
| Accounting platforms selected by you | QuickBooks Online, Xero, FreeAgent, Sage or Zoho Books receive the records you direct us to publish. |
We do not sell personal data. We may disclose information where required by law or to establish, exercise or defend legal claims.
5. International transfers
Some providers may process data outside the UK or permit remote access from another country. Depending on the provider and data flow, the relevant safeguard may be a UK adequacy regulation, the UK International Data Transfer Agreement, or EU Standard Contractual Clauses with the UK Addendum, together with a transfer assessment and additional safeguards where required. We are completing and recording the supplier assessment for the planned external-customer service before that service opens.
Contact [email protected] for information about safeguards applying to your data or a copy of the relevant terms, subject to necessary redactions.
6. Retention
We keep information only for the period needed for its purpose, taking account of the account lifecycle, security and dispute requirements, legal obligations and customer instructions. The category-by-category schedule and deletion process are in our Data Deletion & Retention policy. Production backups normally age out within 30 days.
7. Your rights
Subject to the conditions in UK data-protection law, you may have rights to access, rectify or erase your data; restrict processing; receive portable data; and object to processing based on legitimate interests. You may object at any time to processing based on our legitimate interests; we will assess the objection as the law requires. Where we rely on consent, you may withdraw it without affecting earlier lawful processing.
You can object to AI-learning use through an organisation administrator or by contacting us. If your request concerns records controlled by your employer, accountant or another ReceiptTidy customer, we will normally refer the request to that controller and assist them.
Contact [email protected]. You do not need a particular form or subject line. We respond without undue delay and normally within one month. Where the law permits, the time limit may be affected by necessary identity checks, may pause while we await clarification of an access request, or may be extended by up to two further months for a complex or multiple request. We will explain any applicable pause or extension and the response deadline.
8. Complaints
If you are unhappy with how we handle personal data, complain to [email protected] or our postal address below. We will acknowledge a data-protection complaint within 30 days, investigate it without undue delay, keep you informed and explain the outcome.
You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. You do not have to complain to us first.
9. Security
Our measures include TLS encryption in transit, encryption of accounting connection credentials, protected document storage, tenant isolation using database row-level security, role-based access controls, audit logging, restricted backups and security monitoring. The exact measure depends on the system and risk; we do not claim that every record in every store uses the same form of at-rest encryption. We notify customers, affected people and the ICO of qualifying personal-data breaches as required.
10. Sensitive information and children
ReceiptTidy business accounts are for people aged 18 or over. Documents may incidentally mention children or reveal health, religious or other sensitive information. Customers must minimise this data, avoid uploading it where unnecessary and ensure they have an appropriate lawful basis and, where required, an Article 9 condition. We do not use incidental sensitive information for advertising or profiling.
11. Cookies
See our Cookie Policy for the current cookie and browser-storage inventory.
12. Changes and contact
We may update this Policy and will notify account holders of material changes in-app or by email where appropriate.
Contact [email protected] or write to JnDee Tech Limited, Unit 10 Vally Point Industrial Estate, Beddington Farm Road, Croydon, Surrey, United Kingdom, CR0 4WP.
Revision 2026-09-22.2, published 22 September 2026.