PapeX, Inc. – Privacy Policy

1. Identity of the Controller

The data controller for purposes of this Policy is PapeX, Inc., a Texas S-Corporation with its principal place of business in Texas, United States. You may contact us at privacy@papex.app for general assistance.

2. Scope of Policy

This Policy applies to all users of the PapeX mobile application, website, and integrated services, including POS data feeds and third-party integrations. By using any of these services, you acknowledge and agree that this Policy governs our collection, use, and disclosure of personal data across all PapeX-related platforms.

3. Information Collected

We collect information you provide directly, information generated automatically through use of the Service, and information obtained from third parties. This may include your name, email address, identifiers (account ID, user ID, device ID) and user-generated content. It may also include optional profile details that you add, such as a phone number, a username and a profile photo.

We also collect financial information related to transaction receipts, including purchase details, merchant names, payment methods, transaction timestamps, and associated metadata obtained through integrated POS systems. PapeX does not collect or store payment card numbers or full banking credentials. Such data is processed externally by third-party POS systems.

When you scan or upload a receipt, we receive the photo or PDF and the text and details read from it (see Section 6 for the companies that read it), and we keep them with your account. Photos of coupons that you add are stored with your account in the same way.

We collect device identifiers and related data as described below and through our service providers (including Amazon Web Services and Google Firebase) for authentication, performance monitoring and security. We do not collect your phone’s advertising identifier.

Usage data

Unless you turn it off, the app sends us information about how it is used: which features you open (for example, that you viewed or saved a coupon), whether a scan or other action worked and how long it took, why it failed when it did not, the version of the app, whether your phone is an iPhone or an Android device and, in some reports, its operating-system version. Each report is linked to your PapeX account ID, and to a random identifier that the app creates on your phone. The app and our servers are built to leave out your name, your email address, the contents of your receipts, store names and the text of your emails.

This information goes to our own servers, which run on Amazon Web Services. It does not go to Google Analytics, Firebase Analytics or any advertising or analytics company. To turn it off, go to Settings > Advanced Settings > Privacy and turn off “Share usage data”; the app then stops sending reports and discards any it had not yet sent. We keep usage reports for 180 days (see Section 7).

Signing in

You can create an account with an email address and password, or sign in with Apple or Google. If you use an email address and password, your password goes to Google’s Firebase Authentication, which stores it; our own servers do not receive it. If you use Apple or Google, we receive the name and email address that they share with us (Apple may give us a private relay address instead of your real one); we do not receive your Apple or Google password. Sign-in is run by Google’s Firebase Authentication, which receives your email address or the token that Apple or Google issues.

Feedback and support

If you send feedback or a question through the app, we receive your message, your name and email address, your account ID, and your phone’s platform and operating-system version. We delete these when you delete your account.

Partner store offers

A partner store in the Coupons section may offer to send you rewards and offers by email if you choose to share your email address with it. If you agree, we store your email address, the store, the wording you agreed to and when you agreed, and we may give your email address to that store. You can withdraw in the app, which stops us including you in later transfers; we cannot take back an email address that we have already given to a store. We delete what we store when you delete your account.

Sharing with other PapeX users

If you share a receipt with another PapeX user, or you are in a group with them, they can see your name and your profile photo, for example as “Shared by” on a receipt and in the group’s list of members. When you add someone to share with by typing their email address or phone number, the app asks our servers whether it belongs to a PapeX account and, if it does, shows you that person’s name and profile photo and nothing else from their profile. The same applies to you: someone who types your email address or phone number can find out whether it belongs to a PapeX account and, if it does, sees your name and profile photo.

Your PapeX email address

If you use a PapeX email address, we receive the emails sent or forwarded to it, including the sender, subject, body and attachments, whoever sends them. We never access your personal email inbox: we receive only what is sent or forwarded to your PapeX address. We read these emails to find receipts, using the AI services described in Section 6. When we recognise an email as a sign-in or verification message and judge that it is not a receipt, we do not run it through receipt reading. Other emails are read: the text of the email, including any code, link or other personal detail in it, is sent to Google’s Gemini service, whether or not the email turns out to be a receipt. This includes receipts or order confirmations that happen to contain a code, and sign-in or verification messages that we do not recognise as such or that include an image or PDF file. Emails that contain something that looks like a code or a web link are also sorted for Important mail, which sends them to Gemini as well, with the codes we detect hidden (see “Important mail” below). Because most emails contain a web link, this covers most of the emails sent to your PapeX address, receipts included.

Emails that we judge are not receipts do not appear in your receipts. For each one that went through receipt reading, we keep a record separately, where you cannot see it, to check and improve this filtering (see Section 7). That record includes the email’s subject line and part of its text, so it can contain a code or other detail from the email.

When an email becomes a receipt, we keep a copy of the original email and its attachments (see Section 7). On an email receipt in the app, where the original is available, “View original email” shows a plain-text version of that email. Only the account that owns the receipt can open it; people you share the receipt with cannot.

Some store and payment providers send only a link to the receipt on their own website. For a short list of providers that we recognise, our servers open that link to fetch the receipt, and that provider’s website can see that the link was opened. In the same way, when you set up automatic forwarding from your own mail account to your PapeX address, our servers open the confirmation link that your mail provider sends, to confirm the forwarding.

Important mail

Some emails sent to your PapeX email address are not receipts but are something you need in order to use another service: a sign-in code, or a link to verify an account, reset a password or accept an invitation. Important mail is the part of the Inbox in the app that shows them to you, so that you can use them. Important mail is available for every account that has a PapeX email address.

• What mail is processed: the emails sent or forwarded to your PapeX email address, and only those. We look in each of them for a code or a web link. Because most emails contain a link, in practice this applies to most emails sent to your PapeX address, including receipts and marketing emails, not only sign-in emails. We show an item only when the sender’s email passes standard email authentication checks.
• Who processes it: our servers on Amazon Web Services, which receive and store the email; Google’s Gemini service, described in Section 6 (see “How we sort these emails” below); and Google (Firebase and Google Cloud), which stores the Important mail items.
• Why: to find the sign-in codes and verification links in your mail, to tell them apart from receipts and other mail, and to show them to you in the app so that you can use them. We do not use them to sign in to anything ourselves.
• Your choices: Important mail cannot be switched off for an account. You can turn off its notifications in Settings > Notifications (“Sign-in codes & verify links”), dismiss any item, or delete your account. Emails sent to your PapeX address are still received and read for receipts as described above, whether or not you use Important mail.
• What an item contains: the code or link, the subject line, the sender’s name and domain, and when the email arrived. It does not include the email’s body, its headers or the sender’s email address. In the item, where the code appears in the subject line or the sender’s name, we replace it with dots.
• How long it is shown: a sign-in code is shown for 24 hours. We then remove the code from the item, usually within 15 minutes, and keep showing a record of the email (the sender and when it arrived) until 30 days after it arrived. A sign-in or password-reset link is shown for 24 hours, and a verification or invitation link for 30 days; we remove the link from the item when that time is up. After that we stop showing the item. We do not delete items automatically: an item, without its code or link, stays stored with your account until you delete your account. Dismissing an item hides it.
• View original email: while an item is shown, you can open a plain-text copy of the email, in which links are replaced with “[link]” and the code appears only during its first 24 hours. We keep this copy, and the original message as we received it (which includes any code or link), for 90 days after the email arrives, and then delete them automatically. Dismissing the item or deleting your account does not delete them sooner.
• Other copies of the email: removing the code after 24 hours applies only to the Important mail item. Other copies of the same email that we keep may still contain the code until they are deleted: the original message as we received it (deleted after 90 days) and, if the email went through receipt reading (see “Your PapeX email address” above), the record our filter keeps (deleted after 87 days) or, if the email was saved as a receipt, that receipt and its original email, for as long as they are kept (see Section 7).
• Who can see it: only your account. Anyone who can open PapeX while you are signed in can see a code shown there, so treat it like a code in your email.
• How we sort these emails: to find these emails and decide what to show, we send emails that contain something that looks like a code or a link to Google’s Gemini service, described in Section 6. Before we do, we hide the codes we detect, and we remove the part of each web link in the email’s text after a “?” or “#”, which often carries a sign-in token. The rest of the email is sent to Gemini, including any code we do not detect. This hiding applies only to sorting: unless we recognise the email as a sign-in or verification message that is not a receipt, it is also read for receipts, codes and links included (see “Your PapeX email address” above).
• Notifications: if you allow notifications, we may tell you that a code or link has arrived. The notification can name the sender’s domain, for example “You got a code from example.com”, but it never shows the code, the subject line or the sender’s name.

Push notifications

Push notifications are optional, and we send them only if you allow notifications for PapeX on your phone. We may notify you when a receipt you scanned has been saved, when an email receipt arrives, when someone shares a receipt with you, and when a sign-in code or link arrives in Important mail.

A notification can show a receipt’s store name and total, for example “Store Name · $42.17”. Anyone who can see your phone’s lock screen may be able to read it. For receipts we identify as coming from a cannabis dispensary, notifications do not show the store name or the amount. To remove store names and amounts from all of your notifications, turn off “Show store and amount” in Settings > Notifications in the app; notifications about Important mail then do not name the sender either.

When you allow notifications, the app gets a push token from Expo, the notification service we use, and we store it with your PapeX account. We keep one token per account, so notifications go only to the phone that registered most recently. To send a notification, we give Expo the token and the notification: its title, its text and an internal reference that the app uses to open the right item when you tap it. Expo passes it to Apple’s or Google’s notification service, which delivers it to your phone.

Settings > Notifications in the app has a switch for each kind of notification; they are on by default once you allow notifications. You can also turn notifications off in your phone’s settings. We remove the push token from your account when you sign out of PapeX on that phone or delete your account. If your phone is offline when you sign out, the removal may not complete. Turning a switch off in the app stops us from sending that kind of notification; neither that nor turning notifications off on your phone removes the token.

4. Purpose of Processing

We process data to operate, maintain, and improve the Service; authenticate users; manage accounts; display and store digital receipts; read your receipts, photos and emails with the AI services described in Section 6; send the notifications you allow; share your email address with a partner store when you choose to; show you sign-in codes and verification links from emails sent to your PapeX email address; prevent abuse of the Service; conduct analytics and performance optimization; communicate service updates and security alerts; comply with legal obligations; and conduct research and development. We may also process anonymized or aggregated transaction data for market research, trend analysis, or commercial insights, provided it cannot reasonably identify an individual user.

To help prevent abuse, we measure how much file storage each account uses and flag accounts that use far more than usual for review by our team. This check is internal: it is not shown to you and it does not delete anything.

5. Legal Bases for Processing

Depending on the activity, we rely on one or more legal bases: performance of a contract; compliance with legal obligations; legitimate business interests (e.g., improving products, preventing fraud); and consent (e.g., beta testing or marketing communications).

6. Disclosure of Information

We do not sell personal identifying information. We may share aggregated or anonymized receipt data with business partners, POS vendors, and retailers for legitimate purposes. Data may be shared with financial management applications (e.g., QuickBooks, Plaid, Mint) only when authorized by you, under secure, tokenized connections. POS vendors accessing PapeX APIs must follow strict confidentiality, encryption, and least-privilege standards.

Service providers. We use other companies to run the Service. They receive personal information to provide their services to us:

• Google (Gemini). Every receipt photo or PDF you scan or upload is sent to Google’s Gemini AI service to check that it is a receipt and, when needed, to read it. The text of emails sent to your PapeX email address, whether or not they are receipts and including any codes or links in them, and their image or PDF attachments, are also sent to Gemini, except as described in Section 3: we do not run sign-in or verification emails that we recognise, and judge are not receipts, through receipt reading, and we hide the codes we detect before an email is sorted for Important mail. We use Gemini under Google’s paid service terms. Under those terms Google does not use this content to improve its products, but it logs requests for a limited period to detect abuse and to meet legal requirements, and it may process them in any country where it has facilities.
• Marvik (until October 15, 2026). Until October 15, 2026, our contractor Marvik ran an AI model, configured by PapeX, on a server that Marvik operates. It received receipt photos, and the text of receipts and of emails sent to your PapeX email address (whether or not they were receipts, and including any codes or links in them), to read and sort them and to check the results. We no longer send information to Marvik. Information it received before then may still be held on that server.
• Nanonets (until October 24, 2026). Until October 24, 2026, a receipt-reading service, Nanonets, could receive a receipt photo, including a photo attached to an email, when our other services could not read it. We no longer send information to Nanonets. Information it received before then may still be held by Nanonets.
• Anthropic (Claude) — an AI service that may receive a receipt photo, including a photo attached to an email, or the text of a receipt email, when our other services cannot read it. Anthropic processes this content under commercial terms that do not allow it to use the content to train its models.
• Google (Firebase and Google Cloud) signs you in, stores your account, receipts, receipt and coupon photos, settings, Important mail items and push token, runs parts of the Service, and holds our database backups.
• Apple and Google (sign-in). If you sign in with Apple or Google, they confirm your identity to us (see “Signing in” in Section 3).
• Amazon Web Services hosts the servers that process your scans and emails, receives and stores the emails sent to your PapeX email address, including the original emails we keep, and stores the usage reports described in Section 3.
• Expo, Apple and Google deliver push notifications (see “Push notifications” in Section 3). Expo also provides our software-update service: when the app checks for an update, Expo receives your device’s IP address, the app’s platform and version, and a random identifier that Expo’s update software creates for this installation of the app.
• Vercel hosts our website, including the pages that show receipt links (papex.app/r), so a receipt opened through a link passes through Vercel’s servers. Vercel also provides website analytics.
• Google Analytics measures use of our website. It receives your IP address, browser details and the address of each page you visit. Until October 15, 2026, the web address of a receipt page, an invitation page or a merchant page could itself be the link that gives access to it, and Google Analytics received that address. Since then, Google Analytics does not run on those pages and does not receive their addresses. Google may still hold the addresses it received before then until they are deleted or expire under the retention settings for our Google Analytics account.
• Partner stores. If you choose to share your email address with a partner store (see “Partner store offers” in Section 3), we may give it to that store, and the store’s own privacy practices then apply to it.
• logo.dev provides store logos. It receives store names from our servers and, when the app loads a logo, the store’s website address and your device’s IP address.
• Store image hosts. The Coupons section shows store logos and photos that your device loads directly from image servers run by other companies, for example Weedmaps, Jane, Leafly, Squarespace and Prismic, or by content-delivery services such as Amazon CloudFront and Imgix. Those servers receive your device’s IP address and device details, and can tell which images, and so which stores, you open. We do not control them.

Receipt links. You can create a link to a single receipt (papex.app/r). Anyone who has the link can view the receipt without signing in, including anyone it is forwarded to. The page shows the receipt’s details, such as the store, date, items, prices, totals, payment type and any card digits printed on the receipt, and the text read from it. If the receipt has a photo that you scanned or uploaded, the page also shows the photo, with location and camera details (EXIF and GPS data) removed, unless the receipt has been marked as not being a receipt, has been blocked by us, or has no store name, total or items that we could read. A photo shows everything printed on the receipt, which can include part of a card number, a loyalty number or your name. A link does not expire, and you cannot turn off a single link: it stops working only while the receipt is in Deleted Receipts and after the receipt is permanently deleted. Receipts that do not belong to a PapeX account cannot be viewed through a link. To report a shared receipt that should not be public, email privacy@papex.app.

Information may be disclosed to governmental or regulatory authorities if required by law or in connection with a merger, acquisition, reorganization, or sale of Company assets.

7. Data Retention

We retain personal and transactional data as long as necessary to fulfill the purposes in this Policy, subject to legal requirements. Receipt and account data may be retained indefinitely for archival, analytical, or operational purposes. You may request deletion of your account by contacting privacy@papex.app, subject to applicable retention requirements.

Some information has a specific retention period:

• Original emails that became receipts. We keep the original email and its attachments indefinitely, so that you can view the original later. This is a complete copy, so it contains anything the email contained, including any code or link. Deleting the receipt or your account does not delete this copy. To ask us to delete it, contact us as described in Section 13.
• Other emails sent to PapeX email addresses. We keep the original message as we received it, including any code or link in it, for 90 days after it arrives and then delete it automatically, including after you delete your account. When an email went through receipt reading and we judged it not to be a receipt (see Section 3), we also keep a record that includes its subject line and part of its text, so it can contain a code or other detail from the email; it is deleted automatically after 87 days. We keep no such record of a sign-in or verification email that we did not run through receipt reading.
• Important mail. See “Important mail” in Section 3.
• Deleted receipts and photos. A receipt you delete goes to Deleted Receipts in the app, where it stays until you delete it there for good or the app clears it after 30 days; the app does this clearing only when you open Deleted Receipts. Deleting a single receipt does not currently delete its photo from our file storage; to ask us to delete it, contact us as described in Section 13. Deleting your account deletes all of your photos immediately.
• Usage data. The usage reports described in Section 3 are deleted automatically 180 days after they are recorded. Deleting your account does not delete them sooner.
• Coupon testing. We are testing a feature, not yet shown in the app, that finds offers and coupon codes in emails sent to your PapeX email address. What it finds is deleted automatically after 45 days, or immediately when you delete your account.
• Database backups. Our database keeps recovery copies for 7 days and weekly backups for 90 days, and our file storage keeps deleted files recoverable for 7 days. Information that has been deleted or removed, such as a sign-in code removed from an Important mail item or an account you deleted, can remain in these copies until they expire.
• Anonymous statistics. Before we delete an account, we record a few facts about it, each only as a broad range or a yes/no: for example how long the account existed, roughly how many receipts, photos or emails it had, and which features it used. They contain nothing that identifies you or the account, we only look at them added up with at least four other deleted accounts, and we keep them.

Automatic deletions run on a schedule, so an item can remain for a day or more after the time stated above.

Deleting your account. You can delete your account in the app under Settings > Advanced Settings > Delete Account, or by contacting us as described in Section 13. Your account and the information stored with it in our app database and file storage are deleted immediately, including your receipts and their photos, your profile photo, your coupons and coupon photos, cards, Important mail items, settings, partner store sign-ups, feedback, and the records that link your email receipts to their original emails. The original emails of your email receipts (see above) and the usage reports described in Section 3 are not yet deleted with your account; usage reports are deleted 180 days after they were recorded, and you can ask us to delete the original emails as described in Section 13. Some copies are kept for a set time: emails sent to your PapeX email address (deleted 90 days after they arrived, as described above) and database backups and recovery copies (up to 90 days). We keep the anonymous statistics described above. Your PapeX email address is never given to anyone else: it stays reserved, with no link to you. Emails that reach it after your account is deleted are not added to any account, but until we stop accepting them we may keep them, unconnected to you.

8. Data Breach Notification

If a data breach affects your personal information, we will notify affected users without undue delay, in accordance with applicable laws, and provide details on the breach, likely consequences, and remedial actions.

9. International Data Transfers

Data is stored primarily within the United States. Some of our service providers, for example Google for its Gemini service, may process information in other countries. Users outside the U.S. consent to the transfer of their data to the U.S., which may have different data-protection laws. Continued use of the Service constitutes consent to such transfers.

10. Cookies and Tracking Technologies

On our website we use cookies and similar technologies for session management, authentication, analytics and security, including Google Analytics and Vercel Analytics (see Section 6). The PapeX app does not use advertising identifiers or advertising SDKs, and we do not track you across other companies’ apps or websites. You may manage cookie preferences through device or browser settings, though disabling cookies may limit functionality. We do not currently respond to “Do Not Track” signals.

11. Data Security

We implement commercially reasonable safeguards, including encryption in transit and at rest (TLS 1.2 and AES-256), restricted data access, and secure authentication protocols. While we strive to protect information, no method is infallible, and we cannot guarantee absolute security.

12. Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects. If such features are introduced, users will receive notice and the option to opt out.

13. Rights of Users

Depending on applicable laws, you may have rights to access, correct, delete, restrict, or object to processing of your data; request data portability; and exercise other rights without discrimination. Contact us at privacy@papex.app with “Privacy Request” in the subject line. We will acknowledge within 10 days and respond within 45 days, extendable once by 45 days if needed.

14. Sensitive Personal Data

We do not ask you for sensitive personal data such as race, health or biometric data. The emails and receipts that you send or scan can still contain private details, for example sign-in codes and verification links for other services, or what you bought and where. We process them only as described in this Policy (see Sections 3, 6 and 7). If we ever need to ask for sensitive personal data, we will request explicit, informed consent and provide opt-out options.

15. Children’s Privacy

The Service is not directed to children under 13. We do not knowingly collect data from children under that age. In jurisdictions with higher minimum ages (e.g., 16 in the EEA/UK), we require verifiable parental consent before use.

16. Financial Data Accuracy Disclaimer

We display receipt and transaction data as received from connected POS systems and do not independently verify merchant-provided information. Please contact merchants directly to resolve discrepancies.

17. Beta Program Notice

Users in the PapeX Beta Program acknowledge the Service is provided on a pre-release basis for testing and may contain defects or limited functionality. By participating, you consent to our collection of diagnostic and performance data for product improvement.

18. Third-Party Services and Links

The Service may include integrations or links to third-party applications or websites. We do not control and are not responsible for their content, security, or privacy practices. Review the privacy policies of each third-party service you access.

19. Amendments to this Policy

We may modify this Policy at any time without prior notice. Changes become effective upon posting in the Service or on our website. Continued use of the Service following an amendment constitutes acceptance of the revised Policy.

20. Governing Law

This Policy is governed by the laws of the State of Texas, without regard to conflict-of-law principles. Any dispute arising under or related to this Policy shall be subject to the exclusive jurisdiction of the state and federal courts in Travis County, Texas, unless otherwise required by law.

21. Contact Information