Privacy Policy

Last updated: 30 June 2026

Aido Technology Pty Ltd (“we”, “us”, “our”) operates the Aido Receipts mobile application (“the App”). This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

Account Information

• Name, email address, and authentication provider (Apple, Google, or email) when you create an account via Firebase Authentication.

Receipt Data

• Photos of receipts and invoices you capture using the App.
• Extracted data including vendor name, tax ID (e.g. ABN, EIN, BN, IRD number, or VAT No), date, amounts, tax, and line items.

Usage Data

• Number of receipt scans per month for subscription tier enforcement.
• Subscription status and purchase history managed by the Apple App Store or Google Play, depending on where you installed the App.

2. How We Use Your Information

• Receipt Processing: When you tap the camera icon and take a photo, or choose an existing photo from your library, the App captures that image on your device. Only when you choose to scan a receipt is that image sent to our secure backend server, which forwards it to Google Gemini AI (primary) or Anthropic Claude AI (fallback) for data extraction. Images are processed in real-time and are not stored on our servers. Neither provider uses API data for model training on paid tiers. The App asks for your permission the first time you scan a receipt, before any photo is sent to these third-party AI services; if you decline, you can still enter receipt details manually.
• Account Management: Your account information is used to authenticate you and manage your subscription.
• Usage Tracking: Scan counts are tracked locally on your device to enforce subscription tier limits.

3. Data Storage

• On-Device Storage: All receipt data, extracted information, and receipt images are stored locally on your device using Apple’s SwiftData framework. We do not store your receipt data on our servers.
• Authentication: Account credentials are managed by Firebase Authentication (Google) and stored securely.
• Keychain: Security settings (PIN, Face ID preferences) are stored in the iOS Keychain on your device.

4. Third-Party Services

The App uses the following third-party services. Each provider listed below is contractually and technically required to provide the same or equal level of protection for your data as described in this Privacy Policy — none of them may use your receipt image for any purpose beyond returning the extracted data to us, and none retain it beyond the limited windows described here.

• Firebase Authentication (Google): For user account management. Subject to Google’s Privacy Policy.
• Google Gemini AI: Primary service for receipt data extraction. Receipt images are sent for processing on the paid API tier, not retained after the response is returned, and are not used for model training. Subject to Google’s Privacy Policy.
• Anthropic Claude AI: Fallback service for receipt data extraction. Receipt images are automatically deleted within 7 days and are not used for model training. Subject to Anthropic’s Privacy Policy.
• Apple StoreKit: For subscription management. Subject to Apple’s Privacy Policy.

Website analytics (aidoreceipts.com only): Separately from the App, this marketing website uses the Meta pixel and Meta Conversions API to measure how well our advertising works. These collect your IP address, browser user agent, which pages you view on this website, and Meta’s first-party cookies (_fbp and _fbc). They have no access to your receipts, expenses, or account data — that data stays on your device as described above, and is never sent to Meta. Subject to Meta’s Privacy Policy. You can block this with your browser’s tracking protection or an ad blocker without affecting the App.

5. Data Sharing

We do not sell, trade, or share your personal information with third parties except as described in this policy (third-party services for authentication and receipt processing).

6. International Data Transfers

Your receipt images are processed by AI services operated by Google (United States) and Anthropic (United States). By using the App, you consent to the transfer of receipt image data to servers located outside your country for the purpose of data extraction. These transfers are necessary to provide the core functionality of the App. We confirm that these third-party providers are required to provide the same or equal level of protection for your data as described in this Privacy Policy.

7. Data Security

• All communication between the App and our backend uses HTTPS encryption.
• API keys are stored on our backend server, never on your device.
• Backend requests are authenticated and rate-limited to prevent abuse.
• The App supports PIN and Face ID protection for local data access.

8. Data Retention

• Receipt Data: Stored locally on your device for as long as you keep the App installed. We do not retain receipt images or extracted data on our servers. On-device data is deleted the moment you delete that expense in the App, or automatically when you uninstall the App.
• Authentication Data: Your Firebase account is retained until you request deletion. Firebase stores your name, email, and authentication provider. We do not share this data with any other party. See Firebase’s Privacy Policy for how Firebase handles this information.
• Processing Data: Receipt images sent for AI extraction are processed in real-time and are not stored by our backend. Google Gemini (paid API tier): data is not retained after the response is returned (zero retention) and is not used for model training — see Google Gemini Data Governance. Anthropic Claude: all API data is automatically deleted within 7 days and is not used for model training — see Anthropic Data Retention Policy.

9. Data Breach Notification

In accordance with the Privacy Act 1988 (Cth) and the Notifiable Data Breaches (NDB) scheme, if we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

10. Your Rights Under Australian Privacy Law

Under the Australian Privacy Principles (APPs), you have the right to:

• Access: Request access to the personal information we hold about you.
• Correction: Request correction of any inaccurate or outdated personal information.
• Complaint: Lodge a complaint with us or the OAIC if you believe your privacy has been breached.
• Export: Export all your receipt data as CSV, PDF, or images at any time from the Summary tab.
• Deletion: Delete individual receipts within the App, or request full account deletion — see Section 16 below.
• Opt-out: You may stop using the App at any time. Deleting the App removes all locally stored data.

To exercise any of these rights, contact us at the email below. We will respond within 30 days.

11. Your Rights Under US Privacy Law (California)

If you are a California resident, under the California Consumer Privacy Act (CCPA) you have the right to:

• Know: Request disclosure of the personal information we collect, use, and share.
• Delete: Request deletion of your personal information, subject to certain exceptions.
• Opt-Out: We do not sell your personal information to third parties.
• Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at the email below. We will respond within 45 days.

12. Your Rights Under Other US State Privacy Laws

If you are a resident of Virginia, Colorado, Connecticut, Utah, or another US state with a comprehensive consumer privacy law, you may have similar rights, including the right to:

• Confirm and Access: Confirm whether we process your personal information and access that information.
• Correct: Request correction of inaccurate personal information.
• Delete: Request deletion of your personal information, subject to certain exceptions.
• Data Portability: Obtain a copy of your personal information in a portable format (see Export, above).
• Opt-Out: Opt out of the sale of personal information, targeted advertising, and profiling. We do not sell your personal information, use it for targeted advertising, or engage in profiling that produces legal or similarly significant effects.
• Appeal: Appeal our decision on a rights request.

To exercise these rights or to appeal a decision, contact us at the email below. We will respond within the timeframe required by applicable state law.

13. Your Rights Under Canadian Privacy Law

If you are a Canadian resident, under the Personal Information Protection and Electronic Documents Act (PIPEDA) you have the right to:

• Access: Request access to the personal information we hold about you and how it has been used or disclosed.
• Correction: Challenge the accuracy of your personal information and have it corrected.
• Withdraw Consent: Withdraw your consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions.
• Complaint: Lodge a complaint with us or the Office of the Privacy Commissioner of Canada (OPC) if you believe your privacy rights have been breached.

If you are a Quebec resident, you may have additional rights under Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25).

To exercise these rights, contact us at the email below. We will respond within 30 days.

14. Your Rights Under New Zealand Privacy Law

If you are a New Zealand resident, under the Privacy Act 2020 you have the right to:

• Access: Request access to the personal information we hold about you.
• Correction: Request correction of any inaccurate personal information.
• Breach Notification: Be notified if a privacy breach has occurred that is likely to cause you serious harm.
• Complaint: Lodge a complaint with us or New Zealand’s Office of the Privacy Commissioner if you believe your privacy rights have been breached.

To exercise these rights, contact us at the email below. We will respond within 20 working days.

15. Your Rights Under UK Privacy Law

If you are a UK resident, under the UK GDPR and the Data Protection Act 2018 you have the right to:

• Access: Request access to the personal information we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal information.
• Erasure: Request deletion of your personal information (the “right to be forgotten”), subject to certain exceptions.
• Restriction and Objection: Request that we restrict or stop processing your personal information in certain circumstances.
• Data Portability: Obtain a copy of your personal information in a portable format (see Export, above).
• Complaint: Lodge a complaint with us or the UK Information Commissioner’s Office (ICO) if you believe your privacy rights have been breached.

To exercise these rights, contact us at the email below. We will respond within one month.

16. Account Deletion

You may request deletion of your Aido Receipts account at any time by visiting aidoreceipts.com/delete-account and submitting the account email address you signed up with. This applies to both the iOS and Android apps, across all supported regions.

What gets deleted: your name, email address, and authentication record held in Firebase Authentication, along with any subscription tier/usage tracking tied to your account. We complete deletion within 10 business days of your request and send a confirmation email to the address on your account once it's done.

What is not affected: receipt photos and expense data are stored locally on your device, not on our servers, so account deletion does not remove them — uninstall the App to clear local data. Receipt images sent for AI extraction are processed in real-time and are not retained by us or, per their own data governance policies, by Google Gemini or Anthropic Claude beyond a short processing window (see Section 8, Data Retention).

Deleting your account does not automatically cancel an active subscription. Cancel separately from your Apple ID (App Store) or Google Play account settings to stop future billing.

17. Children’s Privacy

The App is not intended for use by children under 13. We do not knowingly collect information from children under 13.

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the “Last updated” date at the top of this page. Material changes will be communicated via the App.

19. Contact Us and Complaints

If you have any questions about this Privacy Policy or wish to make a complaint, please contact us at:

Aido Technology Pty Ltd
Email: support@aidoreceipts.com

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) (Australia), the Office of the Privacy Commissioner of Canada (OPC) (Canada), the Office of the Privacy Commissioner (New Zealand), or the Information Commissioner’s Office (ICO) (United Kingdom), as applicable.