Privacy Policy
Data controller: Kinedi Ltd, a limited company registered in Scotland with company number SC888521, whose registered office is at 3 Hill Street, Edinburgh EH2 3JP.
Contact: privacy@billspike.app
ICO registration: ZC140144
Last updated: 2026-08-06
1. Overview
BillSpike ("the Service") is a mobile application that lets you photograph receipts and have their contents extracted, organised, split with other people, and searched using AI.
This policy explains what personal data we collect, why we collect it, who we share it with, where it goes, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
In short: we do not sell your personal data. We do not share it with anyone for their own purposes. We do not profile you for advertising, and we run no advertising. The only third parties who see your data are the service providers listed in section 5, each acting on our instructions.
2. Data We Collect
Every category of personal data the Service processes, and where it is held.
Account and identity
| Data | What it includes | Where held |
|---|---|---|
| Authentication credentials | Email address, hashed password (managed by Supabase), session tokens | Supabase Auth |
| User profile | Display name, email address, preferred currency, onboarding state, RevenueCat app user ID | Our PostgreSQL database |
| Quota cycle settings | The IANA timezone used to decide when your scan day resets (defaults to Europe/London) |
Our PostgreSQL database |
| Marketing and lifecycle contact record | Email address, signup date, contact source | Brevo |
| Transactional email audit | Which lifecycle emails were sent to you, when, their delivery status, and the recipient address | Our PostgreSQL database |
Receipts and their contents
| Data | What it includes | Where held |
|---|---|---|
| Receipt images | The photograph you take or upload | AWS S3 |
| Receipt thumbnails | A small preview generated from your image | AWS S3 |
| Extracted receipt data | Merchant name and type, purchase date and time, line items, quantities, prices, discounts, totals, tax, currency, tags | Our PostgreSQL database |
| Raw AI extraction output | The complete JSON response returned by the analysis model, kept so extraction problems can be diagnosed without re-processing your image | AWS S3 (separate bucket) |
| Extraction run records | Processing status, model identifier, error messages, the OpenRouter session identifier used to trace the request, and the UTC offset your device reported so purchase times are interpreted correctly | Our PostgreSQL database |
| Image fingerprint | A SHA-256 hash of the image file, used to recognise a receipt you have already uploaded | Our PostgreSQL database |
Splitting receipts with other people
| Data | What it includes | Where held |
|---|---|---|
| Split participants | Names, colours and emoji you assign to the people you split bills with | Our PostgreSQL database |
| Split records | How a receipt was divided, each participant's share, and payments you record against it | Our PostgreSQL database |
The people you add are your contacts, entered by you. They have no BillSpike account and are not notified. You are responsible for having a proper basis to record their names — in practice this means a personal or household context, which is outside the scope of UK GDPR for you, though we still process the data as controller. If someone you have added asks us to remove their name, contact us and we will.
Subscription and payment
| Data | What it includes | Where held |
|---|---|---|
| Subscription and entitlement state | Tier, product IDs, purchase and expiry dates, renewal status, store (Google Play) | RevenueCat, and cached in our PostgreSQL database |
| Webhook audit records | Subscription events received from RevenueCat against your user ID | Our PostgreSQL database |
| Payment details | Card details and transaction records | Google Play only. We never see, handle or store card data |
Usage and diagnostics
| Data | What it includes | Where held |
|---|---|---|
| Quota and usage data | Receipts scanned per period, reservations, quota overrides | Our PostgreSQL database |
| Crash and error diagnostics | Stack traces, device model, OS version, app version and a Firebase installation identifier when the app crashes | Firebase Crashlytics (Google) |
| Server logs | Request paths, timing, error detail, and your user ID where you are signed in | Our infrastructure |
| IP address | Used transiently to rate-limit receipt uploads when a request arrives without a signed-in user. Not stored against your account | In-memory only, not persisted |
| Website analytics | Pages viewed on billspike.app, approximate location derived from a truncated IP address, browser, device type and how you arrived. Collected only if you accept analytics cookies on the site, and never linked to your BillSpike account | Google Analytics |
Crashlytics collection is enabled in released builds and disabled in debug builds.
On your device
The app keeps an encrypted, per-user cache so it works offline and starts quickly:
- Receipt lists, statistics and split data
- Images of receipts you have taken, retained for 7 days after processing completes, then removed automatically
- Your theme, currency and handedness preferences
This cache is encrypted, scoped to your account, and purged when you sign out. It stays on your device — we cannot read it.
3. How We Use Your Data
| Purpose | Lawful basis | Data used |
|---|---|---|
| Creating and maintaining your account | Contract performance — Article 6(1)(b) | Authentication credentials, user profile |
| Processing receipt images with AI | Contract performance | Receipt images, extracted data, raw AI output |
| Organising, searching and splitting receipts | Contract performance | Extracted data, split participants and splits |
| Enforcing subscription entitlements | Contract performance | Subscription and entitlement data |
| Metering your scan allowance | Contract performance | Quota and usage data, quota timezone |
| Sending service emails (sign-in confirmation, password change, account deletion) | Contract performance | Email address, transactional email audit |
| Sending launch or product announcements | Consent — Article 6(1)(a). Withdraw at any time via the unsubscribe link | Email address, Brevo contact record |
| Measuring how our website is used | Consent — Article 6(1)(a). Withdraw at any time via Cookie settings in the site footer | Website analytics |
| Preventing duplicate processing and abuse | Legitimate interest — Article 6(1)(f), keeping the Service functioning and cost-bounded | Image fingerprint, IP address, rate-limit counters |
| Diagnosing crashes and improving reliability | Legitimate interest | Crash diagnostics, server logs |
| Responding to support requests | Legitimate interest | Email address and the account data relevant to your query |
| Meeting financial record-keeping duties | Legal obligation — Article 6(1)(c) | Subscription and purchase history |
Where we rely on legitimate interest, we have considered the impact on you and limited the processing accordingly. You can object at any time (section 7).
4. AI Processing
Your receipt image is processed by third-party AI models reached through OpenRouter (openrouter.ai), which routes each request to an underlying model provider.
Two model calls are made:
- A guard model checks that the image is actually a receipt, so images that are not receipts do not consume your scan allowance or reach the extraction step.
- A vision language model reads the receipt and returns structured data — merchant, date, line items, totals, currency and tags.
What you should know:
- Your receipt image and the text extracted from it are transmitted to OpenRouter and on to the underlying model provider in order to fulfil your request.
- Your data is not used to train AI models. Our OpenRouter account is configured to exclude any provider endpoint that trains on inputs, so requests are never routed to one. OpenRouter itself does not store the content of our prompts, because we decline the data-logging option they offer in exchange for discounted inference.
- This is not zero retention. Providers that remain in the routing pool may still hold inputs for a limited period under their own abuse-monitoring and operational terms. We have deliberately not enabled OpenRouter's zero-data-retention mode, because doing so narrows the available providers too far to run the Service reliably. We would rather state this plainly than imply a guarantee we have not bought.
- No user identifier, receipt identifier or account data is sent with the request. A random session identifier is attached so a single extraction can be traced end to end.
- Receipt images can contain financial information about you and, if the receipt covers a shared purchase, about other people. Please do not upload receipts containing data you are not entitled to share.
- No decision with a legal or similarly significant effect is made about you by automated means. The AI reads a receipt; it does not assess, score or rank you. See section 7.
Review OpenRouter's privacy policy for their side of this.
5. Third-Party Data Processors
Each of the following processes personal data only on our documented instructions, under a data processing agreement.
| Processor | Purpose | Privacy policy |
|---|---|---|
| Supabase, Inc. | User authentication and session management | supabase.com/privacy |
| Amazon Web Services, Inc. | S3 storage for receipt images, thumbnails and raw analysis output; SQS and Lambda for receipt processing; managed PostgreSQL | aws.amazon.com/privacy |
| OpenRouter, Inc. | AI model routing for receipt reading and extraction | openrouter.ai/privacy |
| RevenueCat, Inc. | Subscription and entitlement management | revenuecat.com/privacy |
| Sendinblue SAS (Brevo) | Transactional and lifecycle email; marketing contact list | brevo.com/legal/privacypolicy |
| Google LLC — Google Play | Payment processing and subscription billing | policies.google.com/privacy |
| Google LLC — Firebase Crashlytics | Crash and error diagnostics | firebase.google.com/support/privacy |
| Google LLC — Google Analytics | Website usage measurement, only where you have accepted analytics cookies | policies.google.com/privacy |
6. Where Your Data Goes
Your data is stored in the UK and the EEA. Some of our providers are US companies, and some processing genuinely takes place in the United States. This section sets out which is which, because the distinction matters.
Stored in the United Kingdom
AWS region eu-west-2 (London) holds your receipt images, thumbnails, raw analysis output, the processing queue, and our PostgreSQL database.
Stored in the EEA
- Supabase — region
eu-west-1(Ireland). Authentication data. - Brevo — France. Email contact records and send logs.
The EEA is covered by the UK's adequacy regulations, so no additional transfer safeguard is required for the storage location itself.
Processed in the United States
- OpenRouter — AI model routing.
- RevenueCat — subscription management.
- Google — Play billing, Crashlytics, and Google Analytics where you have accepted analytics cookies on our website.
These transfers are made under the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, in each provider's data processing agreement.
One point worth stating plainly
Supabase and AWS are US-incorporated companies, even though your data resides in Ireland and the UK respectively. That means support and engineering access from the United States is possible. It is covered by the transfer terms in their data processing agreements, and we mention it here rather than leave the "stored in the UK/EEA" description to imply more than it does.
7. Your Rights
Under UK GDPR you have the rights below. To exercise any of them, email privacy@billspike.app from the address associated with your account. We respond within one calendar month.
| Right | How it works in practice |
|---|---|
| Access (Subject Access Request) | Email us with the subject line "Subject Access Request". We compile and send your data manually. There is currently no self-service export in the app |
| Portability | Also fulfilled manually, by email, in a structured machine-readable format |
| Erasure ("right to be forgotten") | Self-service. Delete your account in the app under Profile → Delete account, and everything described in section 8 is removed. You can also email us |
| Rectification | Edit your profile, receipts, tags and split participants directly in the app. For anything you cannot reach, email us |
| Restriction | Email us. We will restrict processing while a dispute or accuracy question is resolved |
| Objection | Email us to object to any processing we carry out on the basis of legitimate interest |
| Withdraw consent | Product and launch emails are sent on the basis of consent. Use the unsubscribe link in any such email, or email us. Withdrawing consent does not affect sends made before you withdrew, and does not stop service emails you need to receive as an account holder |
Automated decision-making
We do not make decisions about you solely by automated means that produce legal effects or similarly significantly affect you, within the meaning of Article 22. The AI reads receipt images and returns structured data; it does not evaluate, score, rank or make decisions about you.
8. Data Retention and Deletion
While your account is open
Your receipts, extracted data, splits and profile are kept for the life of your account. We do not delete them on a timer, and we do not have a shorter retention period for free accounts.
When you delete your account
Deletion is immediate, permanent and irreversible. It removes:
- Every receipt image, thumbnail and raw analysis output from AWS S3
- Every receipt, line item, tag, extraction run, split, split participant, payment, person, quota record and quota override from our database
- Your user profile and cached entitlement state
- Your Supabase authentication record
- Your RevenueCat subscriber record
- Your Brevo contact record
- The audit rows recording which lifecycle emails we sent you
Deletion also cancels an auto-renewing Google Play subscription, via RevenueCat, as part of the same process.
Two things are deliberately not removed, and you should know about both:
Financial records. Subscription and purchase history is retained for 7 years to meet UK tax and financial record-keeping duties. This is permitted under Article 17(3)(b) — a legal obligation overriding erasure. It covers the fact and value of transactions, not your receipts.
Anonymous statistics. We retain aggregate, population-level statistics — scan volumes, extraction accuracy rates, currency mix and similar — indefinitely, to understand how the product performs. These aggregates carry no identifier of any kind: no user ID, no pseudonym, no random surrogate. They describe a population over a period and cannot be linked back to you or to any individual. Because they are genuinely anonymous under Recital 26, they are not personal data and fall outside this policy's scope. They contain no receipt text, no merchant-level detail about you, and no image fingerprints.
Google Play retains its own purchase records under its own policy, which we cannot control or override.
On your device
The local cache is purged when you sign out. Cached receipt images are removed automatically 7 days after processing. Uninstalling the app removes everything held locally.
9. Our Website
billspike.app is a static marketing site.
- Analytics only if you accept. We use Google Analytics to measure how the site is used — pages viewed, approximate location from a truncated IP address, browser and device type, and how visitors arrive. Nothing loads until you press Accept on the cookie banner. Until then, and permanently if you press Reject, no Google script runs, no analytics cookie is set, and no request is made to Google. There is no advertising script and no tag manager. Our lawful basis for the analytics cookies is your consent (Regulation 6 of the Privacy and Electronic Communications Regulations, and Article 6(1)(a) UK GDPR), which you may withdraw at any time via Cookie settings in the site footer.
- Cookies. If you accept analytics, Google Analytics sets its own cookies to distinguish visitors between page views and sessions. If you reject, the site sets no cookies at all. Separately, and regardless of your choice, the site stores two items in your browser's local storage:
bs-theme, remembering whether you chose light or dark, andbs-analytics-consent, remembering the answer you gave on the banner. Both are preferences, not identifiers, and neither leaves your browser. - Self-hosted fonts. Typefaces are served from our own domain, so no font provider sees your visit.
- Waitlist. If you join the pre-launch waitlist, we store the email address you give us, along with the marketing consent you tick, in Brevo. We use it to tell you when BillSpike launches. Unsubscribe at any time via the link in any email, or email privacy@billspike.app. The list is deleted once the waitlist closes.
10. Data Security
- All data in transit is protected by TLS 1.2 or higher.
- Receipt images and analysis output in AWS S3 are encrypted at rest and are not publicly accessible.
- PostgreSQL runs on secured infrastructure with access restricted to the application and its operators.
- Every receipt request is scoped to the authenticated user at the database query level. One account cannot reach another's data.
- The on-device cache is encrypted and scoped per user.
- We maintain an incident response plan. In the event of a personal data breach we will notify the ICO within 72 hours of becoming aware, and will notify affected users without undue delay where there is a high risk to their rights and freedoms.
11. Children
The Service is not directed at, and may not be used by, anyone under 18. This matches the age requirement in our Terms of Service. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact privacy@billspike.app and we will delete it.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be notified by email to the address on your account, at least 14 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
13. Complaints
If you are unhappy with how we handle your personal data, please contact us first at privacy@billspike.app so we have a chance to put it right.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at any time:
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
14. Contact
| Purpose | Address |
|---|---|
| Privacy queries, Subject Access Requests, deletion requests | privacy@billspike.app |
| General support | support@billspike.app |
| Legal and contractual matters | legal@billspike.app |
Post: Kinedi Ltd, 3 Hill Street, Edinburgh EH2 3JP, United Kingdom.
Governing law: Scotland.