Privacy Policy

Last updated 2026-06-27

This policy explains what personal data Receva processes, why, and the rights you have over it. Receva is an invoicing and e-invoicing service for freelancers and small businesses.

1. Controller

The controller responsible for your personal data is the operator of Receva (receva.app). For any privacy question or request, contact us at the address in the Contact section below.

2. Data we collect

• Account data — your name, email address, and password (stored only as a salted hash).
• Company profile — your business name, address, VAT ID, and contact phone and email used on your documents.
• Invoicing data you enter — your customers, invoices, estimates, credit notes, expenses, and related financial data.
• Payment data — when you accept card payments, these are processed by Stripe Connect. We never see or store full card numbers.
• Receipts and OCR — receipts you upload or forward by email are stored and processed by an AI assistant to extract expense data.
• Logs — technical logs including your IP address, used to operate the service, apply rate limiting, and detect abuse. Login-alert and account-erasure signals are stored in a pseudonymized (one-way HMAC) form rather than as raw IP or email.

3. How we use AI

Receipts and text you submit to the AI assistant are sent to our AI sub-processors to extract or suggest invoice and expense data. No automated decision with legal or similarly significant effect is made about you. The output is always a suggestion you review.

4. Sub-processors

We rely on the following service providers:

• Cloudflare — hosting, database, and file storage.
• Stripe — card payment processing.
• Amazon SES — transactional email (verification, reminders, notifications).
• AI Gateway providers (Google Gemini, OpenAI, Cloudflare Workers AI) — receipt OCR and invoice suggestion.

5. Retention and deletion

We keep your data for as long as your account is active. You can delete your account at any time from the in-app account settings. Deletion runs on a 7-day grace period during which you can cancel and recover the account; after that, your data is permanently purged. A minimal erasure record (a tombstone holding no readable personal data) is retained to evidence that the deletion took place.

6. Your rights

Under the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR), you have the right to access, rectify, and erase your personal data, and to restrict or object to certain processing. You can exercise access and erasure directly through the in-app account settings, or by contacting us. You also have the right to lodge a complaint with the competent supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), and in the EU your local Data Protection Authority.

7. Cookies

We use a single session cookie to keep you signed in. We do not use tracking, advertising, or analytics cookies.

8. International transfers

Our sub-processors operate infrastructure in Switzerland, the EU, and the United States, so your data may be transferred and processed in those regions under appropriate safeguards.

9. Contact

For any privacy request or question, contact us at privacy@receva.app.