SpendX

Privacy Policy

Last Updated: October 13, 2026

1. Introduction

SpendX ("we," "our," or "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Phone number (required), name, email address
  • Financial Data: Bank account connections via Plaid (read-only access)
  • Receipt Images: Photos you upload for analysis
  • Communication Preferences: Notification settings, quiet hours, timezone

2.2 Information Collected Automatically

  • Transaction Data: Purchase history, merchant names, amounts, dates
  • Usage Data: Features used, pages visited, time spent
  • Device Information: IP address, browser type, device ID
  • Log Data: Access times, error logs, API calls

2.3 Information from Third Parties

  • Plaid: Bank transaction data, account balances, institution information
  • Stripe: Payment processing and subscription status
  • OpenAI: Receipt text extraction (images processed, not stored by OpenAI)

3. How We Use Your Information

We use your information to:

  • Provide and maintain the Service
  • Analyze spending patterns and generate insights
  • Match receipts to transactions
  • Identify savings opportunities and swap suggestions
  • Send notifications about receipt requests and insights
  • Generate weekly digest emails
  • Process payments and manage subscriptions
  • Improve our Service and develop new features
  • Detect and prevent fraud or abuse
  • Comply with legal obligations

4. Data Sharing and Disclosure

We share your information with:

4.1 Service Providers

  • Plaid: For bank connection and transaction sync
  • Stripe: For payment processing
  • OpenAI: For receipt image analysis (temporary processing only)
  • Twilio: For SMS notifications (if enabled)
  • Resend/SMTP Provider: For email delivery
  • Neon/Database Provider: For data storage

4.2 Household Members

If you're part of a household plan, certain information (transactions, receipts, insights) is shared with other household members.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental request, or to protect our rights and safety.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

We do NOT sell your personal information to third parties.

5. Data Security

We implement security measures including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Secure storage of bank access tokens (encrypted)
  • JWT-based authentication with expiring tokens
  • Regular security audits and updates
  • Access controls and logging

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide services. Specifically:

  • Transaction Data: Retained for the life of your account plus 7 years (tax purposes)
  • Receipt Images: Retained until you delete them or close your account
  • Account Data: Retained for 90 days after account deletion, then anonymized
  • Legal/Compliance Records: Retained as required by law

7. Your Rights and Choices

You have the right to:

  • Access: Request a copy of your personal data (Settings → Download My Data)
  • Correction: Update your profile information at any time
  • Deletion: Delete your account and data (Settings → Account → Delete Account)
  • Portability: Export your data in machine-readable format
  • Opt-Out: Unsubscribe from marketing emails or adjust notification preferences
  • Disconnect Banks: Revoke Plaid access at any time

California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected and to opt-out of sales (we don't sell your data).

European Residents (GDPR)

If you're in the EU/EEA, you have rights under GDPR including data portability, erasure, and the right to object to processing. Contact us to exercise these rights.

8. Children's Privacy

Our Service is not intended for users under 18. We do not knowingly collect information from children. If you believe a child has provided us with information, please contact us immediately.

9. Cookies and Tracking

We use essential cookies for authentication and session management. We do not use third-party advertising or tracking cookies.

10. International Data Transfers

Your information may be transferred to and processed in the United States or other countries where our service providers operate. We ensure appropriate safeguards are in place for international transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. The "Last Updated" date at the top indicates when changes were made.

12. Contact Us

For questions about this Privacy Policy or to exercise your rights, contact us at:

Email: privacy@spendx.si
Address: SpendX, Inc., [Address to be added]
Data Protection Officer: dpo@spendx.si

View Terms of Service