ReceipTap Privacy Policy
ReceipTap is the technology behind the NFC tap that gives you a digital receipt instead of a paper one. This page explains what happens to personal information depending on how you use ReceipTap — as a shopper who tapped a receipt, or as a business using ReceipTap at your register. It's published by J.A.C. GLOBAL APPROACH LTD. (), and is governed by the laws of Ontario, Canada.
If you got a receipt from a business
Tapping your phone on a ReceipTap puck and viewing your receipt doesn't require an account and doesn't collect anything about you personally — the receipt just displays. This section only applies once you choose to save a receipt, by entering your email or signing in with Google.
What we collect, and why
- Your email address — only if you choose to save a receipt. This is how we know which receipts are yours.
- Your name — only if you save a receipt by signing in with Google (we get it from your Google account). If you save with just an email, we don't ask for a name.
- The receipts you save — which business, what you bought, how much, and when — so we can show them to you in one place and let you search or export them later.
- The IP address your device connects from — only at the moment you tap a consent checkbox (like agreeing to receive marketing emails from a business). This is kept as proof of that specific choice, not to track you.
We use this to build your receipt wallet, automatically sort your purchases into spending categories, and let you download a copy whenever you need one — for a return, a warranty claim, or your own records.
The business gets your email too
When you save a receipt, the business you bought from receives your email address as well. They collected it through ReceipTap, but once they have it, it's theirs to use — not ours. Whether they email you about sales, loyalty offers, or anything else is their decision, and following the law when they do is their responsibility (see the business section below for what we require of them). If you'd rather a specific business not have your email, contact them directly, or see "How to unsubscribe" below.
AI category suggestions
To sort a purchase into a spending category (like "Food & Drink" or "Office Supplies") and flag whether it might be tax-deductible, we send the business's name and a short list of what you bought — just item names and how many of each, like "2x Coffee, 1x Muffin" — to Anthropic, an AI company that provides this feature for us.
We do not send Anthropic your name, your email, the price of anything you bought, or the total amount — only the business name and that item list.
How long we keep your data
Our policy is to keep your saved receipts, and your account itself, for 7 years, and then delete them. We keep them that long on purpose: the Canada Revenue Agency expects business records to be kept for six years after the end of the tax year they belong to, and US limitation periods can run to seven. Deleting sooner would take your receipts away while you might still need them.
Getting a copy, deleting your data, or unsubscribing
- Get a copy: log into your wallet and export your receipts anytime.
- Delete your data: ask the business directly (they can look you up by email and remove your data from their own records), or email us at privacy@receiptap.com and we'll help.
- Unsubscribe from marketing:
Where your data is stored
Your ReceipTap data is stored in Canada. A few features briefly send part of it outside Canada: Google, to confirm your identity if you sign in with Google; Anthropic, for the category suggestion described above (using only the business name and item list, never your name, email, prices, or total); and Resend, if you ever request a password-reset email from us.
If you're a business using ReceipTap
Account data we hold
We hold your business name, your own name, your email, your login (a securely hashed password, or a linked Google account), your uploaded logo and receipt design choices, and the connection details for the point-of-sale system you connect (Square or Clover) — never your customers' card numbers, which don't pass through our systems.
Billing
Your payment details are held by Stripe, our payment processor — they never reach our own servers. We keep Stripe's own reference IDs for your account and subscription so we can manage your billing with you.
Our role for your customers' data
When your customers tap and save a receipt, you decide why their email is being collected and what happens with it — that's your call, not ours. ReceipTap acts as a processor: we handle that data on your instructions, as your service provider, not as the party deciding its purpose. Our Data Processing Agreement covers this relationship in detail.
Your responsibilities
You're responsible for having a lawful reason to email the customers whose addresses you collect through ReceipTap, and — if you plan to send them promotional or marketing messages — for getting their express consent, as required by Canada's Anti-Spam Legislation (CASL). ReceipTap's tap-screen checkbox is built to capture and record that choice accurately, but making sure you only market to customers who said yes, and honoring anyone who said no, is your responsibility, not ours.
Subprocessors
We use the following subprocessors to run ReceipTap:
- Supabase — our database, hosted in Canada
- Stripe — payment processing, for your subscription and for affiliate payouts
- Anthropic — the AI category-suggestion feature described above
- Google — sign-in verification only (not the "Rate us on Google" link, which is just a URL you provide, not a data integration)
- Square, Clover, Lightspeed, Shopify — whichever point-of-sale system you connect
- Resend — password-reset emails
If you close your account
Our policy is to keep your business data for 90 days after you close your account, in case you want to come back or need help with something, and then remove or de-identify it. Records proving you accepted our Terms, Privacy Policy, and Data Processing Agreement are the one exception — we keep those permanently, even after your account is closed, since they're our own compliance record and not something we're able to delete on request.