Privacy Policy

1. Who We Are

SnapReceipt AI is operated by Friction SDN BHD in Malaysia. In this policy, "SnapReceipt AI", "we", "us", and "our" refer to the team that provides and operates the SnapReceipt AI service. "You" means the person using the service, including account owners, administrators, branch staff, invited users, and internal testers.

Contact for privacy requests: jeevank1811@gmail.com.

2. Scope of This Policy

This policy applies to SnapReceipt AI at snapreceiptai.friction.com.my, the SnapReceipt AI Android app, the SnapReceipt Telegram bot, account onboarding, dashboard use, manual uploads, exports, review tools, support communications, and internal testing releases distributed through Google Play.

If SnapReceipt AI is customised for a business customer, that customer may also have its own internal policies for staff expense submission, reimbursement, accounting, and record retention. Those business policies are separate from this Privacy Policy.

3. Information We Collect

We collect information that is needed to provide receipt capture, expense review, and export features.

• Account information, such as name, email address, login credentials, role, company, branch, and account settings.
• Receipt images, uploaded files, Telegram images, and documents you submit for OCR or expense extraction.
• Expense records, such as merchant, amount, currency, tax, date, category, notes, payment status, reviewer status, and export history.
• Telegram information, such as Telegram chat identifiers, sender identifiers, message identifiers, file identifiers, and bot binding tokens needed to connect a Telegram chat to an account or branch.
• Google sign-in information, if enabled and used, such as your Google account email address, display name, and sign-in token response needed to create or access your SnapReceipt AI account.
• Usage and security information, such as device/browser type, IP address, request time, route, authentication failures, rate-limit events, and error diagnostics.
• Support and feedback information, such as messages you send to us and related contact details.

4. Sensitive Receipt and Financial Data

Receipts can contain personal, financial, tax, location, employee, customer, merchant, and business information. You should only upload receipts and documents that you are authorised to submit. You should avoid uploading documents containing unnecessary sensitive information unless it is required for expense processing.

SnapReceipt AI is designed for receipt and expense workflows. It is not intended for storing passwords, identity documents, medical records, full payment card numbers, or unrelated confidential files.

5. How We Use Information

• To receive receipt images and files from Telegram, the Android app, and the web dashboard.
• To extract receipt details using OCR and AI-assisted parsing.
• To create, display, edit, review, categorise, export, and delete expense records.
• To provide account login, branch access, administrator access, audit trails, and security controls.
• To detect duplicate receipts, suspicious entries, abuse, unauthorised access, and service errors.
• To provide customer support, respond to privacy requests, and improve reliability and usability.
• To comply with legal, tax, accounting, platform, security, and dispute-resolution obligations.

6. Legal Bases and Consent

We process personal data where it is necessary to provide the service, perform an agreement with you or your organisation, comply with legal obligations, protect legitimate business and security interests, or where consent is required by applicable law. Where consent is required, you may withdraw it by contacting us, but this may limit or stop features that depend on the relevant data.

7. AI and OCR Processing

SnapReceipt AI may send receipt images, document text, and related context to OCR or AI service providers, including Groq or another provider configured for a specific deployment, so that receipt fields can be extracted and categorised. We use these providers to process your requests and return structured expense data.

We do not sell receipt images or expense data. We do not use receipt images or expense data for advertising. Where provider settings and terms allow, we configure processing to limit retention and prevent training use. Provider terms, security controls, and data-processing arrangements may vary by deployment and customer requirements.

8. Storage and Service Providers

We use trusted service providers to operate SnapReceipt AI. These may include hosting providers, Supabase for database and storage services, Telegram for bot messaging and receipt delivery, Google for Google Play distribution and optional Google sign-in, email providers for account and support messages, and OCR or AI providers for document processing.

These providers process data only as needed to provide their services to us, subject to their own security controls, terms, and data-processing commitments.

9. Sharing and Disclosure

We may share information only in the following situations:

• With service providers that help us operate, secure, host, process, support, or improve SnapReceipt AI.
• With the account owner, administrator, or business customer that controls the workspace where a receipt is submitted.
• When required by law, regulation, court order, tax authority, law-enforcement request, or platform policy.
• To protect rights, safety, security, prevent fraud, enforce terms, or investigate abuse.
• In connection with a merger, acquisition, restructuring, sale of assets, financing, or transfer of the service, subject to appropriate safeguards.

We do not sell personal data. We do not share personal data with third parties for cross-context behavioural advertising.

10. Data Safety for Google Play

The Android app is a wrapper for SnapReceipt AI and uses internet access to connect to the SnapReceipt AI service. Data handled by the app may include account information, receipt images, uploaded files, expense records, user-generated notes, identifiers, diagnostics, and support communications. The app does not need camera, microphone, contacts, location, SMS, or background tracking permissions for the current release.

Google Play may require us to complete a Data Safety form. The answers in that form should match this policy and the actual features enabled in the live app.

11. Cookies, Local Storage, and Session Storage

SnapReceipt AI may use browser storage to keep session tokens, theme preferences, account mode, and user-interface preferences. Session tokens are used to keep you signed in during the current session. We do not use third-party advertising cookies in the current release.

12. Retention

We keep personal data, receipt images, expense records, exports, logs, and account records for as long as needed to provide the service, support accounting and audit workflows, comply with legal obligations, resolve disputes, maintain security, and enforce agreements. Retention periods may differ by customer configuration, feature, backup cycle, and legal requirement.

Deleted expense records may be soft-deleted first so that mistakes can be reviewed or restored during a limited period. Backups and logs may retain copies for a further limited period before they expire according to operational schedules.

13. Your Choices and Rights

Depending on applicable law and your relationship with SnapReceipt AI or a business customer, you may request access, correction, export, restriction, objection, portability, deletion, or withdrawal of consent for personal data. To make a request, contact us at jeevank1811@gmail.com.

If your account is managed by an employer, branch, or business customer, we may need to direct the request to that organisation or coordinate with them before acting.

14. Account Deletion and Data Export

SnapReceipt AI supports data export for expense records and related reports. Account deletion may remove or deactivate access, sessions, account records, Telegram bindings, and associated data, subject to legal, accounting, backup, fraud-prevention, and legitimate business retention needs.

To request account deletion or a data export, use the available in-app controls where provided or contact us by email. We may verify your identity and authority before fulfilling the request.

15. Security

We use reasonable technical and organisational measures designed to protect information, including HTTPS in production, authentication controls, server-side database access, restricted secrets, security headers, rate limits, logging that avoids receipt images and unnecessary personal data, and access controls for administrator and branch roles.

No internet service can guarantee perfect security. You are responsible for keeping your account, device, email, Telegram account, and login credentials secure, and for promptly telling us if you believe your account or data has been compromised.

16. International Transfers

SnapReceipt AI and its service providers may process and store information in Malaysia or other countries where our providers operate. Where required, we use contractual, technical, and organisational safeguards designed to protect personal data during cross-border processing.

17. Children

SnapReceipt AI is not intended for children and is not directed to users under 13 years old. We do not knowingly collect personal data from children. If you believe a child has provided personal data to SnapReceipt AI, contact us so we can review and take appropriate action.

18. Changes to This Policy

We may update this Privacy Policy when our service, providers, legal obligations, or data practices change. The updated version will be posted on this page with a new "Last updated" date. Material changes may also be communicated through the app, website, email, or another appropriate channel.

19. Contact

For privacy questions, data requests, account deletion, data export, or security concerns, contact: jeevank1811@gmail.com. For account deletion instructions, visit https://snapreceiptai.friction.com.my/accountdeletion.

This policy is intended to be clear and accurate for users and platform review. It is not a substitute for legal advice, and users retain any rights available under applicable law.