1. Who processes your data
Receyo is a service for managing work trips, expenses and reimbursement claims. The data controller is identified below. Where a Data Protection Officer (DPO) has been appointed, their contact is shown in the same box.
2. Data we process
We process only the data needed to provide, secure and administer Receyo. Depending on the features you use, this may include:
- Account and authentication: first and last name, login email, password hash, language, account status, temporary verification codes and session information.
- Profile and reimbursement data: phone, reimbursement email, address, tax code, bank details such as IBAN/BIC/account holder, publication, press card and saved signature. Personal profile fields designated by Receyo are encrypted at application level.
- Billing data: billing identity, address, tax/VAT details and electronic invoicing information where applicable.
- Trips and expenses: dates, destinations, brands/events, amounts, currencies, merchants, receipts, invoices, PDFs, photos, routes, vehicles, plates and mileage rates.
- Reimbursement documents: original documents, working documents, field mappings and final signed documents.
- Subscriptions and payments: plan, status, billing periods, PayPal identifiers, payments and invoices.
- AI credits and technical usage: operation, AI model, token counts, costs, credits used, duration, outcome and technical response identifiers.
- Referrals: referral codes, invitations, discounts and related credits.
- Security and audit logs: events needed to prevent abuse, diagnose errors and reconstruct relevant actions.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and operate your account, trips, expenses, documents, signature, exports and core features. | Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR). |
| Manage subscriptions, payments, invoices and accounting/tax obligations. | Contract performance and legal obligations (Art. 6(1)(b) and (c)). |
| Protect the service, prevent fraud/abuse, maintain technical logs, continuity and security. | Legitimate interests in service security and protection (Art. 6(1)(f)), balanced against user rights. |
| Provide optional AI features for receipt reading and document preparation. | Performance of the requested service (Art. 6(1)(b)). Users can continue manually when AI is unavailable. |
| Send operational communications, authentication codes, security alerts and service notifications. | Contract performance and service security. |
Receyo currently does not use personal data for behavioural advertising or commercial profiling. Any future optional processing based on consent will be presented separately.
4. Artificial intelligence
When you use AI features, Receyo may send the document or image being analysed and the minimum necessary contextual data to OpenAI through its API. AI features propose extraction, classification and field mapping. They do not make decisions that produce legal or similarly significant effects, and results can be reviewed and corrected manually.
Compatible requests are configured with store: false. OpenAI states that API Platform customer data is not used to train models by default; the provider’s technical and abuse-monitoring retention rules may still apply.
5. Providers and recipients
Receyo may rely on service providers acting on our behalf or as independent controllers for their own activities. The service currently may involve:
- Airtable — operational database and attachments.
- Hetzner — server/VPS infrastructure.
- OpenAI — AI features through the API.
- PayPal — payments and subscriptions.
- Postmark — transactional and security email, when enabled.
- Google Maps Platform — addresses, routes, distances and maps when used.
We do not sell personal data to advertisers or data brokers.
6. International transfers
Some providers may process data outside the EEA. Where required, transfers rely on a GDPR-recognised mechanism such as an adequacy decision, European Commission Standard Contractual Clauses or other applicable safeguards. More information can be requested from the privacy contact above.
7. Retention and deletion
We retain data for as long as necessary to provide the service and for the purposes described above.
- Operational account data, expenses and documents remain available while the account is active or until deleted by the user.
- Drafts and temporary files are removed when no longer needed; asynchronous account exports expire automatically.
- Sessions are time-limited and can be revoked; verification codes are temporary.
- When an account is permanently deleted, Receyo deletes operational data that can be erased and retains only data that must be kept for legal, tax, accounting or legal-claims purposes, restricting its use accordingly.
8. Cookies and local storage
Receyo currently uses only technical or functional storage required for the service: an authentication session cookie, a language preference and a local device preference for the selected camera. These are not used for behavioural advertising.
If non-essential cookies or tracking tools are introduced in the future, this notice will be updated and consent will be requested before activation where required.
9. Security
Receyo applies technical and organisational measures intended to protect data, including authentication, password hashing, application-level encryption of designated personal profile data, HttpOnly session cookies, authorisation controls, audit logging and separation of secrets/keys from source code. No information system can guarantee zero risk.
10. Your rights
Where provided by the GDPR, you may request access, rectification, erasure, restriction, portability and objection, and withdraw any consent without affecting prior lawful processing. Receyo also provides tools to export documents and start account deletion.
You may exercise your rights through the privacy contact shown above. You also have the right to lodge a complaint with the competent supervisory authority.
11. Data about other people
If you upload documents containing personal data about other people, you must have a lawful basis to do so and use Receyo consistently with applicable rules. Do not upload data that is unnecessary for the reimbursement process.
12. Changes
We may update this notice when the service, providers or legal requirements change. Material changes will be communicated appropriately. The latest update date appears at the top of this page.
How do testimonials work?
After submitting a claim, you can leave feedback once. The 20% reward refund on the next eligible subscription payment after PayPal collection for individual accounts does not depend on stars or publication. Your abbreviated name and text are published only with consent; statistics need an additional choice. You can withdraw consent in Account and privacy without losing the reward.
Once submitted, the rating and text cannot be edited. Do not include sensitive information or other people’s details. An AI system checks the text before possible publication.
Selected testimonials in their original language. They do not represent all feedback received.
Thank you for your time: you’ll receive a 20% reward refund on your next eligible subscription payment after PayPal collects it. Any rating qualifies, including private feedback. Upgrade adjustments are excluded.
Your feedback