Receipt AI

GDPR overview

There is no GDPR implementation to report. The words GDPR and General Data Protection Regulation appear nowhere on the site — not in the privacy policy, not in the terms, not in the help centre. No legal basis for processing is stated, no data subject rights (access, rectification, erasure, portability) are described, no Article 27 EU representative and no Data Protection Officer are designated, no Data Processing Agreement is published or offered, no subprocessor list exists, no retention period is given and no international transfer safeguards are mentioned. The publisher is a Delaware C-Corporation and the terms are governed by Delaware law. The only privacy contact is info@receipt-ai.com. The policy does set a minimum age of 18 and states that data is not knowingly collected from children. European buyers should treat this silence as a gap to raise with the vendor.

Who owns the data?

The published documents never state outright who owns an uploaded receipt. The terms assign ownership of the Service and its original content, features and functionality to Big Green Company, and make the user solely responsible for anything they upload, submit or transmit — a responsibility framing rather than an ownership grant. The privacy policy lists what is collected: name, phone number, email address, banking and payment information, receipts, accounting software details, plus usage data such as IP address, browser and operating system. Nothing in either document describes a right to retrieve, export or have that data deleted on request.

Reuse rights

Receipt AI states that it uses collected information to deliver and improve the service, answer enquiries and personalise the experience. Email addresses may also carry service announcements, updates and promotional material, with an unsubscribe link; phone numbers are restricted to essential messages about receipt handling, security alerts and access to the service. Personal information may be shared with unnamed third-party service providers, described as bound by confidentiality agreements and barred from any other use, and may be disclosed where the law, a court order or a public authority requires it. On the customer's side, nothing in the documents restricts what users do with their own extracted data, which they can export as CSV or push into QuickBooks Online and Xero without asking permission. Whether customer data feeds AI model training is never addressed, in either direction.

Data retention & training

Hosting summary

Receipt AI discloses nothing about where customer data is stored. The terms of service mention cloud technologies without naming a provider, and the security article describes receipts and account information as encrypted and securely stored without stating a region, a datacentre or a jurisdiction. No data-residency option is offered and no commitment to EU storage exists. What can be established is jurisdictional rather than technical: the publisher, Big Green Company, is incorporated in Delaware as a C-Corporation, and the terms are governed by the laws of the State of Delaware, with exclusive jurisdiction given to Delaware courts. Any dispute over stored data would therefore be settled under US law. The website itself is served from behind Cloudflare on an anycast address, which says something about content delivery and nothing about where receipts are actually processed or retained; it should not be read as a hosting location. Buyers with a data-residency requirement will need to ask the vendor directly, because the published documents do not answer the question.