Privacy notice

The data controller is Angela Iurlo (Fattoabyte). For any question or request about your data, write to info@fattoabyte.it.

• Account: your email address and, if you add it, your name.
• Trips and receipts: what you enter or what the scan reads — trip name, destination, dates, notes, receipt date, vendor, category, amounts, currencies and exchange rates.
• Receipt photos: the images you upload. A receipt can show other information (for example part of a card number or the name of the person who paid): please crop or avoid photos that show more than you need.
• Technical and security data: login events, IP address and browser information recorded by our providers to keep the service secure, and the anti-bot check on the login page (Cloudflare Turnstile).
• Error reports: when something goes wrong in the app we record the error message, the page, the action you were doing and the browser type, linked to your account, so we can fix problems. They never contain the content of your receipts.

We do not use your data for advertising, we do not sell it and we do not profile you.

• To provide the service you asked for: store your expenses, read receipts automatically, convert amounts to EUR and create your expense report (legal basis: performance of the service, art. 6(1)(b) GDPR).
• To keep the service secure and to fix problems found during the beta (legal basis: legitimate interest, art. 6(1)(f) GDPR).

• Supabase — database, login and photo storage, hosted in the European Union.
• Automation server (n8n) on Oracle Cloud in Milan, Italy — receives the photo only to read it and does not keep it, except in error logs used to fix problems, which are deleted automatically within 14 days.
• Google Gemini — reads the text of the receipt photo when you add a photo to a receipt. We use the paid API: Google does not use your images to train its models. Google may process the data outside the EU under the safeguards provided by the GDPR (EU Standard Contractual Clauses / EU-US Data Privacy Framework). Gemini also summarises the daily error reports for us, without any user identifier.
• Cloudflare — hosts the app, protects it from attacks and provides the anti-bot check.
• Frankfurter (public exchange-rate service) — receives only a currency and a date, never your personal data.
• Aruba (Italy) — sends the invitation and password-reset emails.

• Receipts and photos stay until you delete them. Deleting a receipt deletes its photo; deleting a trip deletes all its receipts and photos.
• Archiving a trip keeps the receipt data and can also delete the photos (you choose). Photos uploaded for a scan but never saved are deleted automatically.
• Error reports are deleted automatically after 30 days.
• Your account stays until you ask us to delete it. At the end of the beta we will tell you in advance what happens to your data.

Tip: use Download to keep your own copy (Excel + photos) before deleting a trip.

You can ask to access, correct or delete your data, to receive a copy of it, to limit or object to its use. Write to info@fattoabyte.it: we answer within 30 days. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).

Access is by invitation only. Each user can see only their own data, photos are stored privately and shown through temporary links, and all connections are encrypted.