Thank you for using SpendFlow (“we,” “us,” or “our”), a receipt scanning and spending report service operated by OneSoftWay. This Privacy Policy explains how we collect, use, and protect your personal information when you use our website and mobile app. By using SpendFlow, you consent to the practices described here.
Information we collect
- Account information: your name, email address, and optionally your phone number, plus a securely hashed password if you choose to sign in with one.
- Receipts you scan or upload: the receipt image or PDF, and the details read from it — merchant, receipt number, date and time, subtotal, tax, total, currency, payment method, card type, the last four digits of the card, line items, and any notes, companies, or groups you add.
- Settings: preferences such as your default currency, default company, appearance, and whether AI reading is turned on.
- Automatically collected information: when you visit our website or use the app, we may collect technical information such as your IP address, browser or device type, and the pages you visit, to operate and secure the service.
Card data
SpendFlow never stores a full payment card number. Only the last four digits of a card are kept, even when a full number is printed on a receipt, and any long number in our copy of the AI’s response is masked. Names you give your cards in the app are stored on your device only.
AI processing
When AI reading is on, the receipt image is sent to Google’s Gemini service to extract the details listed above. Your company and group names are included so a receipt can be filed correctly. We send only what is needed to read the receipt. You can turn AI reading off in the app’s settings; receipts are then stored without being read.
How we use your information
- Provide, operate, and maintain SpendFlow — reading, filing, searching, and reporting on your receipts
- Sign you in, including by one-time email links, and keep your account secure
- Send account emails such as confirmation, sign-in, and password reset links
- Respond to inquiries and provide customer support
- Improve and fix the service, and find and prevent fraud and abuse
We do not sell your personal information or your receipts.
Who can see your receipts
Your receipts, cards, companies, groups, and reports are tied to your account and shown only to you. Receipt files are kept in private storage and are never published on a public link.
Information sharing and disclosure
- Service providers: we use trusted providers to run SpendFlow, including Google (AI receipt reading), Microsoft Azure (hosting and file storage), and email delivery providers. They may process information only as needed to provide their services to us.
- Legal compliance: we may disclose information if required by law or in response to valid legal requests.
- Business transfers: in a merger, acquisition, or sale of assets, information may be transferred as part of the transaction.
Data security
We use reasonable measures to protect your information, including encrypted connections, hashed passwords, rotating session tokens, and single-use, expiring links for sign-in and password reset. Resetting your password signs out every device. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Retention and deletion
We keep your receipts until you delete them or your account. You can delete your account from the app’s profile screen, which permanently removes your receipts and reports, or ask us at contact@onesoftway.com. Some information may be retained where required by law or for security.
Cookies
Our website uses only what is needed for it to work. The app keeps your session on your device so you stay signed in.
International data transfers
Your information may be processed and stored in Canada, the United States, or other countries where our service providers operate. Privacy laws there may differ from those where you live.
Children’s privacy
SpendFlow is not intended for individuals under the age of 13. We do not knowingly collect personal information from children. If you believe we have, please contact us and we will delete it.
Your rights
Depending on where you live — including under PIPEDA in Canada, the CCPA in California, and the GDPR in the EU — you may have the right to access, correct, delete, or export your personal information, and to object to or restrict its processing. To exercise any of these rights, contact us; we respond within one month.
Changes to this privacy policy
We may update this Privacy Policy from time to time. We will post the updated version here and, for significant changes, notify you by other means. Continued use of SpendFlow after a change means you accept the revised policy.
Contact us
Questions or requests about this Privacy Policy: contact@onesoftway.com.