Privacy Policy

1. Who we are

Traackly is a brand of Anyphorel LLC, a Delaware limited liability company, which is the controller of your personal data. This policy covers everything we offer under the Traackly name. Our contact details are at the end of this policy.

2. Your right to object

Where we use your data on the basis of our legitimate interests, listed in section 4, you can object at any time, on grounds relating to your situation, by writing to privacy@traackly.com. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data to establish or defend legal claims.

3. What we collect

• Data you give us: identity and contact data; account login data; profile data; the content you add, including anything written or printed in it; and your communications and requests to us.
• Data collected automatically: technical data, meaning online identifiers and device information; usage data; records of the terms and policies you accepted; security and anti-fraud data; email delivery data; and server logs. A photo we cannot convert to a standard format keeps any location data stored in it.
• Data from others: transaction data from Stripe; profile data from Google, if you sign in with it; and data about other people contained in the content you add.

To use our service you must give us your contact, login and profile data, or sign in with Google, and subscribe through Stripe. Without these we cannot provide it. Everything else is up to you.

Our service is not meant for anyone under 18.

If you are not one of our users and a customer adds a receipt or email with your details, we hold them as part of that customer's records, for as long as that customer keeps them. Anyphorel LLC is the controller. Write to privacy@traackly.com to use your rights.

4. How we use your data, and why

In the EEA and the UK, we use your data on these legal bases:

• To provide our service, including AI receipt reading, billing and support: our contract with you.
• To meet legal obligations, such as tax records and data requests: the law, or, for laws outside the EEA and UK, our legitimate interest in following them.
• To keep our service secure and working: our legitimate interest in a safe, reliable service.
• To handle legal claims, such as payment disputes: our legitimate interest in protecting our rights.
• To improve our service: our legitimate interest in improving it, or your consent where the law requires it.
• To run and measure our ads: your consent.
• To show business customers' names and logos, as section 14 of our Terms describes: our legitimate interest in showing who uses our service.
• To keep complete expense records that include other people's details: our legitimate interest, and yours.
• In a merger or sale of our business: our legitimate interest in running our business.

5. AI and sensitive information

When you add content using our AI features, we send that content and the details needed to process it to our AI provider in the United States, which reads it and returns the expense details. It processes this on our behalf and keeps it for a period under its terms. We also use AI tools to help us answer the messages you send us.

The content you add can include health information, which the law treats as special category data. We use it to provide the service and process it only because you chose to add it. You can delete it at any time.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

6. Who receives your data

• Service providers that host, process, secure and analyze data on our behalf, under a duty of confidentiality.
• Stripe, which sells and bills your plan, under its own Privacy Policy.
• Google, if you sign in with Google, under its own Privacy Policy.
• Advertising partners, Google, Meta, TikTok, LinkedIn, Reddit and OpenAI, when Marketing cookies are on. They receive online identifiers and information about your visits to our website and, when you sign up or start a subscription, your contact details in hashed form and purchase information, so they can tell which ads led to it. They use this data under their own Privacy Policies: Google, Meta, TikTok, LinkedIn, Reddit and OpenAI. For what our website sends to Meta, Anyphorel LLC and Meta are joint controllers. Meta's Controller Addendum sets out who does what, and you can use your rights with either of us. For collecting and sending this data to TikTok and measuring our ads, Anyphorel LLC and TikTok are joint controllers. TikTok's Jurisdiction Specific Terms set out who does what, and you can use your rights with either of us. TikTok answers requests about the data it keeps after that, as its Privacy Policy explains.
• Others: our email provider, when you write to us; banks and card networks, through Stripe, if you dispute a payment; authorities where the law requires; our professional advisers; our EU and UK representative; and a buyer of our business in a merger or sale. When you use the API or export your data, it goes wherever you send it.

7. Where your data is stored

Your data is stored in the United States. Our providers also handle it through servers in other countries, and people who work on our service may access it from other countries. We protect transfers from the EEA, the UK and Switzerland with the European Commission's standard contractual clauses and their UK and Swiss versions. Stripe and Google use their own safeguards. Write to privacy@traackly.com for a copy of ours.

8. How long we keep your data

We keep personal data for as long as your account is active or as needed to provide our service, meet our legal obligations, resolve disputes and enforce our agreements. When it is no longer needed, we delete or anonymize it. Deletion does not always happen as soon as a period ends: our cleanups run periodically, at least once a year, and some data may be kept longer, for example during a legal dispute.

• Your account and everything in it: while you have a subscription, and for a period after it ends or after you delete your account, so you can come back or export your data. You can have it deleted sooner.
• Sign-in and activity records: as long as needed to protect your account and handle payment disputes.
• Records of your agreement to our terms: while your account exists. Stripe also keeps the version you accepted at checkout.
• Records of withdrawals, refunds and privacy requests: as long as needed to show how we handled them, including after your account is deleted.
• Support messages and the alerts we receive: as long as needed to handle them and keep a record.
• Billing and tax records: as long as tax and accounting laws require.
• Server logs: briefly, as long as needed to find and fix errors.

Deleted data may remain in our backups for a period. If we restore a backup, we delete that data again.

9. Your rights

You can access, correct and delete your data, restrict or object to how we use it, and receive it in a portable form. Much of this you can do in the app. For anything else, write to privacy@traackly.com. Where we rely on your consent, you can withdraw your consent at any time, without affecting what we did before. We reply within the time limits set by law, and we confirm it is you by asking you to write from, or reply to, the email address on your account. Using your rights is free, and we will not treat you differently for using them.

Complaints. Write to privacy@traackly.com. You can also complain to a data protection authority where you live.

10. EU/EEA & UK GDPR Representatives (Article 27)

If you are located in the EU or UK and have questions or concerns regarding your personal data, you may contact our appointed GDPR representative:

EU Representative:
Euverify Limited (Ireland)
Unit 3D North Point House
North Point Business Park
New Mallow Road, Cork
T23 AT2P, Ireland
Email: gdpr@euverify.com

UK Representative:
Euverify Ltd (UK)
3rd Floor, 86-90 Paul Street
London, EC2A 4NE
United Kingdom
Email: gdpr@euverify.com

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, please use our secure portal.
This link allows you to verify our appointed representative and submit GDPR requests directly. Requests submitted through this portal are logged and tracked to ensure timely response and compliance.

11. Cookies

We use the cookies and similar technologies listed in our Cookie Policy. Stripe and Google set their own cookies on their pages. The badge in the footer of our public pages is loaded from our EU and UK representative, Euverify, so it receives technical data, meaning online identifiers and device information.

Do Not Track and Global Privacy Control. Do Not Track signals have no common standard, so we do not respond to them. Where the law requires it, we treat a Global Privacy Control signal as a request to opt out of selling or sharing your personal information.

12. If you are in the United States

Depending on your state, you may have the right to know, access, correct, delete and get a copy of your personal information.

• Categories we collect: identifiers, commercial information, internet activity, professional information, visual information, and sensitive information, meaning your account login data and any sensitive details in the content you add. Section 3 describes them and section 4 explains why we use them.
• Sources: you, your browser, our service providers, Stripe, Google and the emails you forward.
• Disclosures: in the past 12 months we disclosed each category for business purposes to our service providers, Stripe and Google, described in section 6.
• Selling and sharing: we share identifiers, internet activity and commercial information with advertising partners to show and measure our ads, which some state laws call selling or sharing. You can opt out at any time by turning off Marketing in Your Privacy Choices at the bottom of our pages, or with a Global Privacy Control signal. We have no actual knowledge of selling or sharing the data of anyone under 16. We use sensitive information only to provide the service and keep it secure.
• Retention: section 8.

To use your rights, write to privacy@traackly.com, yourself or through an authorized agent. If we decline your request, you can appeal by replying to our decision.

13. Changes to this policy

We update this policy when our practices change, and the date at the top shows the current version. We tell you by email or in the app before a significant change takes effect, and we will not use data we already hold in a materially different way unless you agree. Earlier versions are listed at the end of this page.

14. Contact

Anyphorel LLC, 8 The Green, Suite R, Dover, DE 19901, United States
Privacy questions and requests: privacy@traackly.com
Security problems: security@traackly.com
Everything else: support@traackly.com