Privacy Policy

Alcheta · Last updated 27 July 2026

This policy explains what personal data the Alcheta app and service collect, why, and the choices you have. Alcheta lets you photograph receipts, have their details extracted, review and approve them, and export them.

1. Who is responsible

The controller of your data is alcheta.com, Uferstrasse 70, 4057 Basel, Switzerland (CHE-320.331.298). Contact: info@alcheta.com.

2. What we collect

• Account data — your email address, a securely hashed password where you set one, and the one-time sign-in codes we send to that address.
• Receipts you upload — the receipt photos/PDFs and the fields extracted from them (merchant, date, totals, VAT, line items, currency, and any notes you add).
• Approximate location — only if you grant the permission, and only to help detect a receipt's country and currency. We do not build a location history.
• Technical & security data — the address a request comes from and the app version, used to operate the service, prevent abuse, and secure your account. An address is kept in our records only while it is blocked for behaving like an attacker; the app version is counted per API route (no account, no address) so that old versions can be retired safely.
• Anonymous device statistics — the phone's model, its operating-system version and the app version, counted per day. No account, address or identifier of any kind is stored with these counts: they can say which phones run the app, never who.
• Purchases — if you buy credits or a plan, the payment is processed by Apple, Google, or Stripe. We receive a confirmation of the purchase, not your card details.

3. How your receipt data is processed

To turn a photo into structured fields, the receipt image is processed by an automated extraction model running on infrastructure we operate. Extraction is automated; you always review and approve the result before it is stored. If you configure your own model endpoint, the image is sent to the endpoint you choose.

4. How we protect your data

• Encrypted at rest — receipt photos are encrypted on our servers under a key tied to your account; an operator with database or disk access sees only ciphertext.
• Encrypted in transit — all traffic to alcheta.com uses HTTPS/TLS.
• Region-pinned — your data is stored in the region for your account and is not replicated to other regions.
• Deletion is a crypto-shred — deleting your account destroys the key that unlocks your receipt photos, rendering them permanently unrecoverable.

5. Why we use it (legal bases)

• To provide the service (create your account, store and export your receipts) — performance of our contract with you.
• Security, abuse prevention, and rate limiting — our legitimate interests.
• Anonymous device and usage statistics (which phones and app versions are in use) — our legitimate interest in supporting the devices people actually have; the counts contain no personal data.
• Account emails (verification, password reset) — performance of our contract.
• Tax/accounting or other legal retention where required — legal obligation.

6. Who we share it with

We do not sell your data. We share it only with service providers acting on our behalf: hosting/infrastructure, transactional email delivery (Google), and payment providers (Apple, Google, Stripe). Currency-conversion rates are fetched from third-party sources using only currency codes and dates — no personal data is sent. If your account is assigned to a company group, that group's administrators may access the account's receipts, and you will see the group's name and logo in the app.

7. How long we keep it

We keep your data while your account is active. When you delete your account, your receipt photos are crypto-shredded and your personal data is deleted, except where we must retain certain records to meet a legal obligation. Backups are rotated and expire on a schedule.

8. Your rights

Subject to applicable law (EU GDPR, Swiss FADP), you may request access to, correction of, deletion of, or a portable copy of your data, and you may object to or restrict certain processing. You can delete your account and its data at any time from within the app (Account → Delete account), or contact us at info@alcheta.com. You also have the right to lodge a complaint with your data protection authority (in Switzerland, the FDPIC).

9. International transfers

Your data is stored in your account's region and is not transferred across regions by us. Where a provider processes data outside your region, appropriate safeguards apply.

10. Children

Alcheta is not directed to children under 16, and we do not knowingly collect their data.

11. Changes

We may update this policy; we will change the date above and, for material changes, notify you in the app or by email.

12. Contact

Questions or requests: info@alcheta.com.