Privacy Policy
Last updated 16 July 2026
This Privacy Policy explains how SMBEE PTE. LTD. (“we”, “us”, “our”) collects, uses, and protects your personal data when you use ReceiptVault (the “Service”). We are the data controller for the purposes of Singapore’s Personal Data Protection Act (PDPA) and, where it applies, the EU/UK General Data Protection Regulation (GDPR).
1. Who to contact
SMBEE PTE. LTD., 68 Circular Road, #02-01, Singapore 049422. For any privacy question, or to exercise your rights, email hello@smbee.me. This is also our data-protection contact.
2. What we collect
- Your email address — to create your account and send you one-time sign-in links.
- Your receipts — the images and files you upload, and the information we extract from them (such as merchant, date, total, currency, category, line items, and any notes or tags you add).
- Billing information — if you subscribe, our payment processor (Stripe) collects and stores your payment details. We never see or store your card number. We keep only your plan status and a Stripe customer reference.
- Basic technical data — standard server logs (such as IP address and request time) needed to run and secure the Service.
3. How we use your data
- to provide the Service — reading, organising, storing, and searching your receipts;
- to authenticate you and keep your account secure;
- to process your subscription and payments;
- to respond to your support requests;
- to meet our legal obligations.
We do not sell your personal data, and we do not use your receipts for advertising.
4. Automated processing with AI
To read your receipts, we send the receipt image or file, and the text on it, to a third-party artificial-intelligence provider (Anthropic) which extracts the structured details for you. This means the contents of your receipts leave our systems and are processed by that provider on our behalf, under their contractual confidentiality and security obligations, solely to provide this feature. Extraction is automated and may contain errors — please review the results before relying on them.
5. Who we share data with (sub-processors)
We share personal data only with service providers who help us run the Service, and only as needed to do so:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and receipt storage | Singapore |
| Vercel | Website and application hosting; cookieless visitor analytics | United States |
| Anthropic | AI reading of receipts to extract data | United States |
| Stripe | Payment processing and subscription billing | United States / global |
| Resend / Amazon SES | Sending sign-in and account emails | United States / Singapore |
Some of these providers are outside Singapore, so your data may be transferred internationally. Where that happens, we rely on the providers’ contractual safeguards and take reasonable steps to ensure a comparable standard of protection.
6. Cookies and analytics
Inside the app we use only strictly necessary cookies to keep you signed in. We do not use advertising or cross-site tracking cookies. On our public marketing pages we use Vercel Web Analytics, a privacy-friendly, cookieless tool that counts visits and page views in aggregate; it does not set cookies, does not track you across sites, and is not used inside the app. Because we do not use non-essential cookies, no cookie-consent banner is required.
7. How long we keep your data
We keep your data for as long as your account is active. If you delete your account or ask us to delete your data, we remove it from our live systems promptly and ensure it ages out of our backups within 30 days, except where we must keep certain records (for example, billing records) to meet legal obligations.
8. How we protect your data
Your receipts are stored in private storage that is not publicly accessible, and access is restricted to your own account through database-level security rules. Data is encrypted in transit. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
9. Your rights
You have the right to:
- access the personal data we hold about you;
- correct data that is inaccurate — much of which you can edit yourself in the app;
- delete your account and your data;
- withdraw consent to processing (note this may mean we can no longer provide the Service);
- where GDPR applies, request a portable copy of your data and object to certain processing.
To exercise any of these, email hello@smbee.me. You may also lodge a complaint with the Personal Data Protection Commission of Singapore, or your local data-protection authority.
10. Children
The Service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.
11. Changes to this policy
We may update this Policy from time to time. If we make material changes, we will update the date above and, where appropriate, notify you.
12. Contact
Questions about your privacy? Email us at hello@smbee.me.