Privacy Policy – Cheqi

Cheqi ("we", "us", "our") provides digital receipt and payment-account–related services. This privacy policy explains how we collect, use, and protect personal data when you use our services.

Cheqi acts as the data controller for personal data processed through the platform.

Contact

📧 privacy@cheqi.io

🌐 https://cheqi.io

We collect only personal data that is necessary to operate our services.

2.1 User account data

When you create an account, we store basic account information, including:

• Your name and contact details (such as email address and optional phone number)
• Profile-related information you choose to provide
• Account configuration and status information required to operate the service
• Preferences related to your account
• Technical metadata such as account creation and update timestamps

2.2 Address data (optional)

If you choose to provide it, we may store:

• Postal address information linked to your account

2.3 Devices

To authenticate devices and deliver encrypted receipts and notifications, we store device-related information such as:

• Device identifiers, device name and platform
• Public encryption keys, key algorithm and key-rotation timestamps
• Push-notification tokens and device registration, update or revocation information

2.4 Companies

If applicable, we store:

• Company identifiers
• Your relationship to a company (such as membership or role)

2.5 Receipt contents and routing metadata

In the standard encrypted receipt-delivery flows, receipt contents, including purchased line items, are encrypted before reaching Cheqi’s core routing service. The core routing service stores and routes ciphertext and does not hold the private keys needed to read those contents. Authorized recipient devices and integrations decrypt their own copies.

Cheqi does process the identity and payment metadata needed to match and route receipts. Depending on the flow, this includes recipient and merchant identity, company and store references, card or payment-account references, payment method and display information, receipt identifiers, delivery status, timestamps and document hashes. Encrypting receipt contents does not make this routing metadata anonymous.

We receive this metadata from you, participating merchants and their software, payment providers, and authorized companies or applications. For browser receipt links, the receipt contents are encrypted before upload and the decryption key stays in the URL fragment, which is not sent to our backend.

2.6 Diagnostics, security and support data

We process technical request and security logs and use Sentry in our mobile apps for crash reports, error diagnostics and sampled performance monitoring. Diagnostics may include app version, platform, error codes, processing steps, timestamps, support correlation identifiers and hashed receipt, device, company or supplier identifiers.

Our mobile diagnostics are configured to disable screenshots, view-hierarchy capture and automatic inclusion of directly identifying data, and to filter sensitive diagnostic context. Receipt-processing identifiers included in diagnostic context are hashed. These hashes and correlation identifiers may still be personal data.

When you contact support, we process the contact details, messages, attachments and diagnostic information you choose to share so we can investigate and respond. Please share only information needed for your request.

We are explicitly privacy- and security-focused in how payment-related data is handled.

3.1 Cards

If you link a payment card for receipt matching and delivery, we store:

• Card provider and card type
• Cardholder name (if provided)
• Only the last four digits of the card
• A Payment Account Reference (PAR) or equivalent card token

We do NOT store:

• Full card numbers (PAN)
• CVV or CVC codes
• Magnetic stripe or chip data

We do not store card expiry dates as part of the normal flow for matching, delivering or receiving receipts. Storage of expiry month and year is limited to company and billing services, as described in section 3.3.

3.2 Payment accounts

If you link a payment account, we may store:

• IBAN
• BIC
• Payment account reference
• Account holder name
• Account type and description

We do not store banking login credentials or passwords.

3.3 Company and billing services

For company and billing services, we may separately store the information needed to charge for Cheqi services and administer the billing relationship, including:

• Billing contact details, invoices, usage, charges and payment status
• Payment-provider customer, payment-method and transaction references
• Card brand, last four digits, expiry month and expiry year for a company or billing payment method
• Direct-debit mandate references and records of billing authorization or consent, where applicable

Worldline processes payment verification and billing payments. We store the references and payment metadata needed to manage those services; we do not store full card numbers or card security codes. These billing records are separate from the normal receipt-matching and delivery flow.

We process personal data to:

• Create and manage user accounts
• Associate users with companies, cards, and payment accounts
• Enable receipt delivery and payment-related functionality
• Deliver receipts and permitted account information to applications and company destinations authorized by you or your company
• Administer company services, billing, payment verification and payment reconciliation
• Provide customer support
• Diagnose errors, monitor reliability and improve service performance
• Secure the platform and prevent abuse
• Comply with legal and regulatory obligations

We process personal data based on:

• Performance of a contract – to provide our services
• Legal obligations – where required by law
• Legitimate interests – such as platform security and service improvement
• Consent – where explicitly requested for optional features

We do not sell personal data.

We share personal data where needed to provide our services, carry out instructions authorized by you or your company, or comply with legal obligations.

6.1 Service providers

• Hosting, storage, content delivery and network security providers, including AWS and Cloudflare
• Worldline for payment verification and company billing
• SendGrid for service emails
• Apple Push Notification service and Google Firebase Cloud Messaging for device notifications
• Sentry for mobile error diagnostics and performance monitoring
• Zendesk for customer support communications

Where a service provider acts as our data processor, its processing is governed by a data-processing agreement in accordance with applicable data protection laws. A provider may have separate responsibilities for processing it carries out for its own purposes; the role depends on the service and applicable arrangements.

6.2 Authorized applications and company destinations

Receipt copies and delivery metadata may be shared with applications or receipt destinations authorized by you or your company, such as accounting and expense systems. Account, profile, company or payment-reference information may also be shared where covered by the permissions granted. Standard encrypted receipt copies can be decrypted only by recipients holding the keys to those copies.

If you submit a selected personal receipt as a business expense, the authorized employer or expense destination receives that receipt and the submission information needed to process it. Submitting one receipt does not automatically share your other personal receipts.

Authorized applications, companies and other recipients are not automatically Cheqi’s processors. They may act as separate data controllers and apply their own privacy policies and retention rules to the information they receive.

You or an authorized company administrator can revoke the relevant connection or permissions for future sharing. This does not automatically delete copies already received by another party.

Retention depends on the type of record, the service it supports, security and integrity needs, outstanding disputes, and applicable legal recordkeeping obligations. Different copies of a receipt may have different retention periods.

7.1 Receipt delivery and download copies

• Device delivery queues and encrypted generation inputs are removed by a daily cleanup once older than 60 days. Device generation inputs are aged from the generation job’s creation time; other device copies are aged from their queue creation time. Copies may be removed earlier when acknowledged or deleted through the service.
• Unacknowledged integration recovery-queue copies and receipt webhook delivery logs are removed by daily cleanup once older than 60 days. Acknowledgement removes the recipient’s queued copy. A successful webhook delivery removes the encrypted payload from that webhook log, while delivery metadata remains until cleanup.
• Client-encrypted browser receipt links expire 365 days after creation. Expired links cannot be used to download the receipt, and expired stored copies are removed by a daily cleanup.

The 60-day queue cleanup does not delete generation-job, routing-context or receipt-integrity records. Those records remain separately and may also remain after account deletion. They can include receipt identifiers, hashes, timestamps and references to the issuing company and recipient.

These server retention periods do not delete receipt copies already stored on your devices or received by an authorized application or company. Those copies are subject to the relevant device controls or recipient’s retention rules.

7.2 Account deletion

When you delete your account, we deactivate it, clear profile and contact information, revoke authentication sessions and delegated access, and remove your cards and their payment identifiers. Device push tokens are cleared. Payment accounts without another holder or remaining card are deleted.

Company-owned and shared payment accounts may remain for their company or other holders; your holder relationship is removed. Deleting your personal account does not delete another party’s company records or copies of receipts it has already received.

Some device, receipt, delivery, authorization-history, audit and billing records may remain for receipt integrity, security, dispute handling and legal recordkeeping. Retained records can still contain pseudonymous identifiers and are not necessarily anonymous. Account deletion therefore does not mean that every related record is immediately erased.

7.3 Operational logs and backups

Core API application logs have a configured retention period of 30 days. Production database automated backups are retained for 30 days, so data removed from the live database may remain in those backups until they expire. Other logs and diagnostic records are separate from these application logs and database backups.

For billing, audit, security, support and diagnostic records without a fixed period stated here, retention depends on the purpose of the record, the duration of the relevant account or company relationship, the time needed to resolve an incident or dispute, and any applicable legal obligation. Contact privacy@cheqi.io for information about records associated with you and requests to exercise your rights.

We implement appropriate technical and organizational security measures, including:

• Encryption of sensitive data
• Strict access controls
• Secure authentication mechanisms
• Logical separation of payment-related references from user contact and identity data

In our web portals, authentication session tokens are stored in secure, httpOnly cookies. These cookies are sent automatically with requests to Cheqi services and are not accessible to client-side JavaScript.

In our native mobile apps and API integrations, authentication tokens may be stored securely on the device or used in authorization headers. These tokens are used only for authentication, authorization, session management, and account security. They are not used for advertising or tracking.

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request deletion of your data
• Restrict or object to processing
• Request data portability

Requests can be made by contacting us at 📧 privacy@cheqi.io.

If personal data is processed outside the European Economic Area, appropriate safeguards are applied in accordance with GDPR requirements.

We use necessary cookies in our web portals to keep users signed in and to protect access to accounts. These include an access-token cookie and a refresh-token cookie. They are required for the service to function and are not used for advertising, profiling, or cross-site tracking.

We do not use non-essential marketing or tracking cookies on our website. If this changes, we will update this policy and request consent where required by law.

We may update this privacy policy from time to time. The most recent version will always be available on our website with an updated revision date.

For any questions or concerns regarding this privacy policy or your personal data, contact:

📧 privacy@cheqi.io