Privacy Policy

Effective date: August 11th 2026 Last updated: August 26th 2026

This Privacy Policy explains how InfinitiAi LLC ("we", "us", "Receipt Buddy", "the Service") collects, uses, shares, and protects your information when you use the Receipt Buddy application and related services.

By using Receipt Buddy you agree to the practices described here. If you do not agree, please do not use the Service.

1. Information we collect

1.1 Information you provide

• Account information. When you create an account we collect your email address and authentication credentials, managed through our authentication provider (Supabase Auth).
• Receipts and proof-of-purchase documents. Images, photos, PDFs, and email-derived content you upload or forward to the Service, and any structured data contained in them (for example merchant name, date, amount, and line-item detail).
• Corrections and edits. Changes you make to AI-generated data. We may use your corrections to improve the accuracy of future categorization for your account.

1.2 Information collected automatically

• Usage and diagnostic data. Basic operational and error/diagnostic information generated as you use the Service, used to keep the Service running and to diagnose problems.

1.3 Bank and transaction information (if you connect an account)

If and when you choose to connect a supported bank or payment account, the Service imports transaction records (such as date, amount, and merchant) from that account to help you reconcile spending against your Receipts. We access this data only with your authorization and only to provide the reconciliation feature. We do not receive or store your online banking credentials — bank connections are handled by a specialized third-party provider (see Section 4).

Note: bank/transaction connectivity may not be available in all tiers or regions, and may be offered only for certain account types.

2. How we use your information

We use the information we collect to:

• Provide, operate, and maintain the Service (store your Receipts, extract and categorize data, and — where enabled — reconcile transactions).
• Improve the accuracy of automated categorization for your account based on your corrections.
• Communicate with you about your account, including transactional email (for example sign-in, account, and service notices).
• Maintain the security, integrity, and reliability of the Service, and comply with legal obligations.

We do not sell your personal information.

3. Automated processing (AI)

Receipt Buddy uses artificial intelligence to extract structured data from your Receipts and to categorize spending. To do this, the content of a Receipt you upload is transmitted to a third-party AI processing provider that performs the extraction and returns structured results. This processing is necessary to provide the core functionality of the Service.

The active AI provider may change over time as we improve the Service. Current and potential providers are listed in Section 4. We select providers that process this data on our behalf to deliver the extraction feature and do not authorize them to use your Receipt content to train their own general models, except as permitted by our agreements with them. The AI components may process user data to deliver personalized content, recommendations, or automated functionalities. All AI processing is performed in accordance with this privacy policy and applicable laws. If you have questions about the AI features or data processing, please contact the Service Provider.

You may review, edit, or correct any AI-generated data.

4. How we share information (third-party processors)

We share information with service providers ("processors") who perform functions on our behalf. These include:

• Supabase — database, file storage, and authentication (stores your account data and uploaded Receipts).
• Cloudflare — application hosting and delivery.
• AI extraction provider — receives Receipt content to perform data extraction. Depending on configuration this may be the Lovable AI gateway, OpenAI, OpenRouter, Anthropic, or a self-hosted model service.
• Email delivery provider — sends transactional email on our behalf.
• Bank connectivity provider — if you connect a bank/payment account, a specialized aggregator (PLAID) securely establishes and manages that connection.

We may also disclose information if required by law, to protect our rights or the safety of users, or in connection with a business transfer (such as a merger or acquisition).

Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:

• Google Play Services
• Google Analytics for Firebase
• Firebase Crashlytics
• Facebook

We/us may disclose User Provided and Automatically Collected Information:

• as required by law, such as to comply with a subpoena, or similar legal process;
• when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.

5. Data retention

The Service Provider retains personal data based on its necessity for the stated purposes:

• User Provided Data: Retained for the duration of your use of the Application plus 12 months thereafter, unless longer retention is required by law
• Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance
• Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you
• Data required for legal compliance: Retained as long as required by applicable law

We retain your Receipts and account data for as long as your account is active or as needed to provide the Service. When you delete a Receipt, it is removed from your account. When you delete your account, we delete or de-identify your personal data within 30 days, except where we must retain it to comply with legal obligations or resolve disputes.

Data Breach Notification

If a data breach occurs that affects your personal data, the Service Provider will notify you in accordance with applicable legal requirements, including, where required, providing information about the nature of the breach and the steps being taken to address it.

6. Your rights and choices

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing.

Opt-Out Rights

You can stop further collection of information from your mobile device by uninstalling the Application. Uninstalling will stop the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties.

To request deletion of your personal data, to withdraw consent, or to exercise any of your rights, contact the Service Provider at infinitiAiLLC@gmail.com.

• Access and correction. You can view and edit your Receipts and the extracted data directly in the app.
• Account deletion. You may delete your account from your profile in the app. This removes your personal data as described in Section 5.
• Requests. To exercise other rights, contact us at info@infinitiaillc.com.

7. Security

We use industry-standard measures to protect your information, including encryption in transit and access controls enforced at the database level (row-level security). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Children's privacy

Receipt Buddy is not directed to children under 13 years for age, or such higher age as required by applicable law, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. We/Us do not knowingly collect personally identifiable information from children under 13 years of age in violation of applicable law. In the event the Service Provider discovers that a child has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (infinitiAiLLC@gmail.com) so that they will be able to take the necessary actions.

9. International users

The Service Provider or its third-party service providers may transfer personal data to countries outside your country of residence, including outside the European Economic Area (EEA). Where applicable law requires safeguards for international transfers, the Service Provider will use appropriate mechanisms.

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions or other legally recognized transfer mechanisms
• Your consent, where required and legally permitted

Data protection laws in other countries may differ from those in your jurisdiction. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Your Consent

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases is carried out as described above.

12. Contact us

If you have questions or requests regarding this Privacy Policy or your data, contact us at:

info@infinitiaillc.com