Privacy Policy

This policy applies to personal information we process in connection with the Service. It does not govern third-party sites or services that we link to or that you use with the Service (for example, app stores, social login providers, or your bank); those providers have their own policies.

Depending on how you use the Service, we may collect:

• Account & profile: name, email address, password hash (if you register with email/password), profile details you choose to provide, authentication identifiers, and security settings (such as two-factor status where enabled).
• Receipt & expense data: images you capture or upload, extracted or entered fields (merchant, amounts, tax, dates, categories, notes, payment method labels, and similar), duplicate-detection or integrity signals we derive, and related metadata (timestamps, device or app version where logged).
• Usage & diagnostics: feature usage, API interactions, subscription tier, quota consumption, crash or error reports, and performance logs. We may use Firebase or similar platforms for push delivery and, where enabled, analytics or crash reporting.
• Device & technical data: device type, operating system, app version, language, IP address, push notification tokens, and cookies or similar technologies on web properties we operate for Receni.
• Payment-related data: subscriptions and purchases are typically processed by app stores or payment partners (for example, Apple, Google, Stripe, RevenueCat). We receive limited transactional or entitlement information (such as subscription status, product identifiers, and event timestamps), not your full card number.
• Communications: messages you send us (support requests), and email delivery or engagement metadata when we send service or marketing messages.
• Marketing preferences: whether you opted in to marketing communications at signup or in settings, and related timestamps.
• Social sign-in: if you use Google, Apple, Facebook, or similar, we receive information from that provider as permitted by your settings (for example, name, email, and provider subject identifier).
• Location information (mileage tracking): if you turn on automatic mileage tracking, we collect precise location data from your device — including while the Receni app is closed or not in use — in order to detect when a drive begins and ends, measure its distance, and record where it started and finished. We collect this only while automatic tracking is switched on, and only within the days and hours you have chosen. We do not collect location data if you do not enable this feature, and you can turn it off at any time in the app or in your device settings. You can use mileage tracking without granting location access by entering trips manually. You can also choose to keep the detailed route of each drive on your device only, in which case we receive the trip record (times, distance, start and end point, classification and purpose) but not the route between those points. Location data is used only to build your own mileage records; it is not used for advertising, is not sold, and is not shared with data brokers.

We use personal information to:

• Provide, operate, maintain, and improve the Service (including AI-assisted extraction, storage, search, dashboards, budgets, notifications, and account management).
• Authenticate users, prevent fraud and abuse, enforce our Terms, and protect security.
• Process subscriptions, entitlements, usage limits, and billing events through our payment and subscription partners.
• Communicate with you about the Service, security, and (where permitted) marketing.
• Comply with legal obligations and respond to lawful requests.
• Analyze usage in aggregated or de-identified form to understand product performance.
• Provide data export, import, or portability features where available in the Service.
• Record business journeys, calculate distance and claimable mileage at published rates, and produce mileage logs for your tax records where you enable mileage tracking.

To interpret receipt images and generate structured fields, we may send images or derived representations and minimal context to AI vendors (for example, OpenAI). Outputs are used to present suggested fields for your review. We do not permit our AI vendors to use your content to train their general models for their own products where we can contractually prohibit that; vendor practices may still be described in their policies.

We use vendors who process personal information on our behalf or receive it as part of integrated services. This list is representative and may change; we will update this policy or an online page for material changes where appropriate.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on one or more of the following legal bases:

• Contract: processing necessary to provide the Service you request.
• Legitimate interests: securing the Service, improving features, fraud prevention, and internal analytics, balanced against your rights.
• Consent: where required (for example, certain marketing cookies or non-essential communications). Automatic mileage tracking is switched on only with your consent, given through the device permission prompt and the in-app disclosure, and you can withdraw it at any time.
• Legal obligation: compliance with law, regulatory requests, and tax or accounting obligations.

You may withdraw consent where processing is consent-based, without affecting prior processing’s lawfulness.

We may disclose personal information:

• To service providers and subprocessors under written terms requiring appropriate protection.
• To professional advisers (lawyers, auditors) under confidentiality obligations.
• In connection with a merger, financing, or sale of assets, subject to safeguards.
• To comply with law, regulation, legal process, or governmental requests, or to protect rights, safety, and security.
• With your direction or consent.

We do not sell personal information in the traditional sense of selling lists for money. We may use or disclose aggregated or de-identified information that cannot reasonably identify you.

We are primarily located in Ontario, Canada, but vendors may process data in Canada, the United States, the European Union, the United Kingdom, and other countries. Where required, we implement appropriate safeguards (such as standard contractual clauses or comparable mechanisms) for transfers from the EEA, UK, or Switzerland. By using the Service, you understand your information may be processed outside your country of residence.

We retain personal information for as long as your account is active and as needed to provide the Service, comply with law, resolve disputes, and enforce agreements. Receipt images and structured data are kept until you delete them (where the Service allows) or delete your account, subject to backup and logging retention for a limited period. Usage logs and security records may be retained longer where justified by security or legal needs. Marketing consents and suppression lists may be retained to honor opt-outs.

Mileage data. We apply two different retention periods, because two different kinds of data are involved.

Trip records — the date, start and end address, distance, vehicle, purpose, and business or personal classification of each journey — are your tax records. We retain them for up to seven years to support your tax filings and any subsequent enquiry, which reflects the record-keeping periods expected by HM Revenue & Customs in the United Kingdom, the Internal Revenue Service in the United States, and the Canada Revenue Agency. They are deleted sooner if you delete the trip or your account.

Route traces — the detailed sequence of location points recorded between a journey’s start and end — are deleted automatically 30 days after the journey. No tax authority requires a route trace, so removing it does not affect your ability to produce a mileage log: your year-end export is built entirely from the trip records above, which are retained. The 30-day period may be adjusted, and we will update this policy if it changes materially. If you choose to keep routes on your device only, no route trace is stored on our servers at all, and switching that setting on also deletes any route traces we already hold. You can delete stored route traces at any time from mileage settings in the app without affecting your trip records.

We implement technical and organizational measures designed to protect personal information (including encryption in transit, access controls, and vendor diligence). No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Subject to applicable law, Canadian users may request access to their personal information we hold and ask for correction where inaccurate. You may also raise concerns with us at support@candev.agency. You may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) or your provincial privacy commissioner where applicable.

If GDPR or UK GDPR applies, you may have the right to access, rectify, erase, restrict, or object to certain processing, and to data portability where technically feasible. You may lodge a complaint with your local supervisory authority. To exercise rights, contact support@candev.agency. We may verify your identity before responding.

Residents of certain US states (including California, Colorado, Virginia, and others with comprehensive privacy laws) may have additional rights, such as to know, access, delete, correct, or opt out of certain processing (including, where applicable, “sale,” “sharing,” or targeted advertising as defined by those laws). We do not discriminate against you for exercising rights. To submit a request, contact support@candev.agency. We may need to verify your identity. You may use an authorized agent where permitted by law.

California “Shine the Light”: California residents may request certain information about disclosure of personal information to third parties for direct marketing; submit requests to support@candev.agency.

We send transactional and service-related messages as needed. If you opt in to marketing, we may send promotional communications. You can opt out of marketing via the unsubscribe link in emails or in-app settings where available. Opting out does not affect non-promotional notices (for example, billing or security alerts).

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact support@candev.agency and we will take appropriate steps to delete it.

If we operate web pages for Receni, we may use cookies and similar technologies for essential operation, preferences, analytics, or advertising where permitted. You can control cookies through browser settings and any consent banner we provide.

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, where appropriate, provide additional notice. Continued use after the effective date constitutes acknowledgment of the update, subject to legal requirements.

CanDev Agency Inc.
Toronto, ON, Canada
Email: support@candev.agency