Privacy & Data Policy

We collect only what is necessary to provide the service:

• Account information: your name and email address, provided at registration.
• Receipt images and extracted data: files you upload and the structured data our AI extracts (vendor, date, amounts, tax lines).
• Usage data: receipt count, category corrections, and feature usage — used to improve AI accuracy and calculate billing.
• Country / jurisdiction: selected at signup to apply the correct tax profile. Not linked to geolocation.

We never connect to your bank accounts, credit card portals, or financial institutions. Zero bank connections — ever.

• To extract, categorize, and store your expense receipts on your behalf.
• To generate reports and exports you request.
• To send transactional and retention-related emails (trial reminders, deletion notices).
• To calculate platform usage for billing purposes.
• To improve AI extraction accuracy using aggregated, anonymized patterns — never individual receipt content.

We do not sell your data. We do not share receipt content with third parties except AI processing providers bound by data processing agreements.

Free trial accounts are subject to the following retention schedule:

Upgrading to a paid plan at any point before deletion resets the clock — your data is retained for as long as your subscription remains active.

Our promise: Cancel anytime — your data stays exportable for 12 months.

⚠️ Canadian businesses: CRA requires retention of business records for 6 years from the end of the relevant tax year. RecSync retains your data for 12 months post-cancellation. It is your responsibility to export and maintain records that fall within CRA's 6-year requirement. Use our one-click export before your deletion date.

You may request permanent deletion of all your personal data at any time from Settings → Data & Privacy → Request Data Deletion.

• We will process your request and delete all receipts, images, categories, and personal information within 30 days.
• You will receive a confirmation email once deletion is complete.
• Only the anonymized statistical record (no personal information) is retained for platform metrics.
• This right is provided in accordance with PIPEDA (Canada's Personal Information Protection and Electronic Documents Act) and the principles of GDPR (EU General Data Protection Regulation).

To exercise this right by email: support@recsync.ai

You can export a full CSV of all your receipts at any time from Settings → Data & Privacy → Export My Data. This export is available even on locked trial accounts and cancelled paid accounts, up to the deletion date.

The export includes: date, vendor, category, all tax amounts, total, payment method, notes, and a direct link to each receipt image.

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Receipt images are stored in private object storage — not publicly accessible by URL alone.
• Access is authenticated and scoped: you can only access your own data.

We use the following sub-processors to operate the service:

• AI extraction provider — receipt images are sent for OCR and data extraction. Images are not stored or used for training by the provider under our DPA.
• Email provider — for transactional emails (receipts, reminders, deletion notices).
• Cloud infrastructure — for database and file storage, located in Canada or the United States.

We use session cookies strictly necessary for authentication. We do not use advertising trackers, cross-site tracking, or analytics cookies that identify individuals.

For privacy-related questions, access requests, or complaints:

If you are located in Canada and believe your privacy rights have been violated, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.