receipt.love is operated by Zenta AB (org. no. 556835-6850), Oxtorget 4, 352 32 Växjö, Sweden. For any privacy matter, contact us at support@receipt.love.

To extract and classify receipts, apply your rules, generate expense reports, export vouchers to your accounting system, reconcile bank statements, provide and secure the service, handle billing, and respond to support requests.

We process data to perform our contract with you (providing the service), based on our legitimate interests (security and improving the service), with your consent where required (e.g. connecting a mailbox or your own calendar), and to meet legal obligations (e.g. bookkeeping records).

Receipts are analysed by third-party AI APIs — Google Gemini by default, and optionally OpenAI or Anthropic. Under these providers' standard API terms, data submitted via their APIs is not used to train their models. AI output can contain errors, so you remain responsible for reviewing receipts before relying on them.

Each person can connect their own calendar (Microsoft 365 / Outlook, or Google Calendar) so that a receipt for a business meal can be completed with who was there and what it was for, and a trip with why it was made. It is the person's own choice, made in their profile and turned on per workspace; nobody else can connect it for them, and it is never read in a workspace where they are an admin, bookkeeper or viewer.

• What we read: only the events of the person's primary calendar in a short window around a receipt's time (or a trip's dates): the subject, the start and end, the location, the organizer, and the attendees' names, full email addresses and answers. The addresses are used in memory to tell a colleague from a guest and to find a company's name, and are never stored. We never read what is written in an event, its attachments, or events marked private or confidential. For a Microsoft calendar we also read the person's own addresses (their sign-in name and aliases), so they are never counted as their own guest.
• What we keep: on the receipt, only the names, companies and purpose the person confirms (or that are filled in for them to confirm), and the start and end time of the event they came from. While a suggestion waits for the person's answer we keep the event's subject, time and the proposed names and companies, shown only to them; all of that is deleted when they answer or after 30 days. After an answer we keep only a one-way key of the event, so the same event is not suggested again. Other events and guests' email addresses are never stored. With the connection we keep its sign-in tokens and the account's own addresses, encrypted.
• No AI: calendar data is matched by our own code and is never sent to an AI provider.
• Purpose and basis: supporting the bookkeeping record of representation and travel. The workspace (your company) is the controller and receipt.love processes the data on its behalf, on the basis of legitimate interest in complete bookkeeping records.
• People named in a calendar: guests at a business meal are named on the receipt as the bookkeeping rules require. If you were a guest and have questions, contact the company that paid, or us at support@receipt.love.
• Retention: what is applied to a receipt is part of the bookkeeping record and is kept for seven years (the Swedish Bookkeeping Act).
• Withdrawing it: disconnecting the calendar in your profile deletes the stored tokens and addresses and every suggestion still waiting at once, and asks Google to revoke the access. Turning it off in a workspace deletes the suggestions waiting there. What you already confirmed on a receipt stays, as part of the bookkeeping record.

We do not sell your data. We share it only with the providers needed to run the service:

• Microsoft Azure — hosting, database and file storage (EU).
• Google, OpenAI, Anthropic — AI processing of receipt content.
• Stripe — subscription billing.
• Resend — transactional email (sign-in links, invites).
• Fortnox / Findity — accounting export, only when you connect them.
• Microsoft 365 — mailbox access, only when you connect it.
• Google (Gmail) — mailbox access, only when you connect it.
• Microsoft 365 and Google Calendar — reading your own calendar, only when you connect it (see section 6).

Your account data, receipts and files are stored in the EU (Microsoft Azure, Sweden). When data is processed by AI or other subprocessors, any transfer is governed by their data-processing agreements and, where applicable, EU Standard Contractual Clauses.

We keep your data while your account is active and for as long as needed to provide the service or to meet legal obligations (such as statutory bookkeeping retention). You can request deletion at any time, subject to those obligations.

Data is encrypted in transit (TLS) and at rest (AES-256). File storage is private and served only through an authenticated proxy. Access is restricted to you and the members you invite to your workspace.

Under the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your data, to data portability, and to withdraw consent at any time. You may also lodge a complaint with your supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (IMY). To exercise any right, contact support@receipt.love.

We use only essential cookies required for authentication and keeping you signed in. We do not use advertising or third-party tracking cookies.

receipt.love is a business tool and is not directed to anyone under 18. We do not knowingly collect data from children.

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.

Questions about this policy or your data? Email support@receipt.love.