Privacy Policy — Kvitro

Your privacy is important to us. This Privacy Policy explains what data Kvitro ("the app") processes, how it is used, and the rights available to you. Kvitro is built on a simple principle: your receipts belong on your device. The only data that ever leaves your phone is the receipt you choose to scan — a photo you take, or a PDF you import — for the few seconds it takes to analyze it.

1. Data Controller

The data controller responsible for the app is SassaGold Studios. You can contact us at any time at [email protected].

2. Data Stored on Your Device

The app stores the following data locally on your device only:

• Receipt photos and PDFs — the pictures you take of your receipts, and any PDF receipts you import.
• Extracted receipt details — store name, purchase date, total amount, category, and item names.
• Warranty information — the warranty period you choose per receipt and any scheduled reminder.
• App preferences — language, default currency, and notification settings.

This data is never uploaded to our servers, is not backed up by us, and is deleted when you delete a receipt or uninstall the app. Warranty reminders are scheduled locally on your device — no server is involved in delivering them.

The app requires camera permission solely to photograph receipts. Importing a PDF uses the system file picker, which gives the app access only to the single file you pick and needs no storage permission. It has no account system and collects no names, email addresses, usage analytics, or crash reports. If you buy the one-time unlock, your purchase is processed by Google Play and RevenueCat as described in section 7 — this involves a purchase record and a randomly generated identifier, but never your name or email address.

3. Receipt Analysis (AI Scanning)

When you scan a receipt, the photo or PDF is sent over an encrypted connection (HTTPS/TLS) to our serverless function, which forwards it to Anthropic's Claude API for automated text extraction. The extracted details are returned to your device, where you can review and correct them before saving.

• Our server does not store your file or the extracted data. Processing is transient — the photo or PDF passes through and the result is returned; nothing is written to a database or log.
• Anthropic processes the photo or PDF as our data processor to perform the extraction. Anthropic does not use API inputs or outputs to train its models, and retains API data only for a limited period for trust-and-safety purposes in accordance with its Commercial Terms and Privacy Policy.
• Abuse prevention — to keep the scanning service available, our server processes your IP address transiently and keeps a short-lived request counter (automatically deleted within minutes). IP addresses are not stored with any receipt data and are not linked to you.

A PDF receipt usually contains more than a paper one. An emailed order confirmation may carry your name, a delivery address, the last digits of a card and an order number, where a till receipt carries none of that. Only the file you pick is sent, and only when you pick it — but it is worth knowing what is in a document before you send it. If you would rather not, photograph the paper receipt instead, or enter the details manually.

Scanning is always initiated by you. If you never tap "Scan" or "Import PDF", nothing ever leaves your device — you can also enter receipt details manually.

4. Legal Basis for Processing (GDPR)

Where the General Data Protection Regulation (EU) 2016/679 ("GDPR") applies, we rely on the following legal bases:

• Performance of a contract / consent (Art. 6(1)(b), 6(1)(a)) — transmitting a receipt photo or PDF for analysis when you actively choose to scan it, and processing your one-time purchase when you choose to buy the unlock.
• Legitimate interests (Art. 6(1)(f)) — transient IP-based rate limiting to protect the scanning service from abuse, and on-device storage of preferences needed for basic functionality.
• Consent (Art. 6(1)(a)) — waiting-list email collection, and notification permission for warranty reminders.

5. Data Retention

• On-device data — retained until you delete the receipt, clear the app's storage, or uninstall the app.
• Receipt photos and PDFs in transit — not retained by our server after the analysis response is returned.
• Anthropic API data — retained by Anthropic for a limited period (typically up to 30 days) for trust-and-safety purposes, then deleted, per its Commercial Terms. It is not used for model training.
• Rate-limit counters — automatically expire within minutes.
• Waiting-list emails — retained until the launch notification is sent or until you request deletion, whichever comes first.
• Purchase records — retained by Google Play and RevenueCat for as long as needed to keep your one-time unlock active (this is what lets you restore it after reinstalling or switching devices).

6. Data Storage and International Transfers

Receipt data lives on your device. Our scanning function and waiting-list storage run on infrastructure in the European Economic Area (EEA) or in countries providing an adequate level of data protection. Receipt photos and PDFs are processed by Anthropic in the United States; this transfer is safeguarded by appropriate mechanisms in accordance with GDPR Chapter V, as described in Anthropic's data processing terms.

7. Third-Party Services

• Anthropic (Claude API) — automated receipt text extraction. See Anthropic's Privacy Policy.
• Supabase — hosts the serverless scanning function. See Supabase's Privacy Policy.
• Cloudflare — serves this website and stores waiting-list emails. See Cloudflare's Privacy Policy.
• Google Play — may collect data when you download or update the app, and processes payment when you buy the one-time unlock, as governed by Google's Privacy Policy.
• RevenueCat — manages the one-time unlock purchase so it can be verified and restored across reinstalls and devices. RevenueCat receives the Google Play purchase token, a randomly generated app user ID (not linked to your name or email — the app has no accounts), and basic device information such as model and OS version. It does not receive your receipts, photos, PDFs, or any scanned data. See RevenueCat's Privacy Policy.

The app does not integrate analytics, advertising SDKs, or tracking services of any kind.

8. Cookies and Tracking

Kvitro does not use cookies or any equivalent tracking technologies. This website (sassagold.com) does not use analytics cookies, advertising cookies, or fingerprinting scripts.

9. Children's Privacy

Kvitro is not directed at children under the age of 13 (or 16 where required by local law). We do not knowingly collect any information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Your Rights

Depending on your location, you may have rights of access, rectification, erasure, restriction, portability, and objection regarding your personal data, and the right to withdraw consent at any time. Because receipt data is stored only on your device, the main areas where these rights apply are the waiting list and transient scan processing. To exercise any right, contact us at [email protected]. We will respond within 30 days.

California residents (CCPA/CPRA): We do not sell or share personal information as defined under the California Consumer Privacy Act. To exercise your rights to know, delete, or opt out, contact us at the address above.

11. Supervisory Authority

If you are located in the EEA and believe we have not handled your data in accordance with the GDPR, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu.

12. Security

All communication between the app, our server, and Anthropic uses encrypted connections (HTTPS/TLS). API credentials are held server-side only — the app contains no secret keys. Since receipt data is stored on your device, its security also depends on your device's own protection. For waiting-list emails, we use industry-standard access controls and encryption at rest and in transit.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date at the top of this page. Continued use of the app after an update constitutes acceptance of the revised policy.

15. Contact

For any questions or concerns about this Privacy Policy or your personal data:
[email protected]