Draft. This page describes what the service actually does technically today — it has not been legally reviewed and shouldn't be shown to real users until a lawyer has looked it over. Treat it as a technical source of truth to build from, not a finished privacy notice.
Privacy policy
Last updated: 3 September 2026
Data controller: P721 Väst AB (org. no. 556944-7443), Industrivägen 6, 455 35 Munkedal, Sweden.
What data is stored
Email address, and your password — it is always stored encrypted (hashed); we can never see it in plain text. Plus the receipts you enter yourself: the receipt image, the details interpreted from it (e.g. merchant, date, and amount), and calculated reminder dates.
Why
To be able to show you your receipts, calculate complaint-right/warranty dates, and (if you choose to) share a receipt via a link.
Legal basis
Your account and receipt storage are processed under contract as the legal basis (GDPR art. 6.1 b) — it's the service itself you're using. Sharing a receipt via a link is instead processed under your consent (GDPR art. 6.1 a); you can withdraw that consent at any time by revoking the share link.
Where the data is processed
All storage and hosting is with Google Cloud, on servers within the EU (Belgium). No data is stored outside the EU/EEA, except for the processing by the subprocessors described below.
Sharing with third parties (data processors)
- Google Cloud (Google Ireland Ltd.) — Purpose: hosting the application and database. Data: all data stored in the service.
- Mistral AI — Purpose: reading (interpreting) the receipt on upload — current default provider. Data: the receipt image, or the text interpreted from it. The data is never used to train AI models and is deleted by the subprocessor within 30 days. Region: France, EU.
- Anthropic — Purpose: same as above — may be used as an alternative provider. Data: same as above. The data is never used to train AI models and is deleted by the subprocessor within 30 days. Region: USA — the data transfer relies on the EU's Standard Contractual Clauses (SCC) under GDPR Article 46.
- Brevo — Purpose: sending transactional emails (account confirmation, password reset, and reminders about complaint rights/warranty/open purchase). Data: email address and the content of the email. Region: EU (Brevo is a French company).
How long the data is kept
For as long as the account is active. If you delete your account, all associated data (receipts, images, account details) is removed shortly after, within 30 days at the latest.
Your rights
Under GDPR you have the right to access your data, correct inaccurate data, delete your data, receive it in a portable format, and object to processing. You can export all your data (JSON) or permanently delete your account and all associated data at any time — see the Security page once you're logged in.
To exercise any of these rights another way, or if you have questions about how your data is processed, contact us at info@rceep.ai. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).