Privacy Policy

1. Who we are

Nordic Expense ("we", "our", "us") is a personal finance tracking service. We are the data controller for the personal data described in this policy. Contact: [email protected]

2. Data we collect

• Account data: name, email address, hashed password.
• Financial data: expenses, budgets, categories, and notes you enter.
• Receipt images: photos you send for OCR scanning (stored encrypted).
• Messaging identifiers: Telegram user ID or WhatsApp phone number when you link a bot.
• Usage data: pages visited, feature usage, error logs (no advertising profiling).
• Cookies: session cookie (essential) and optional analytics cookies. See our Cookie Policy.

3. Why we process your data

4. Data sharing

We do not sell your personal data. We share data only with:

• Google Cloud Vision API — to extract text from receipt images you submit.
• OpenAI API — to parse extracted receipt text into structured fields.
• Hosting providers — servers and infrastructure needed to run the service.
• Law enforcement — only when legally required.

5. Retention

We keep your account data for as long as your account is active plus 30 days after deletion. Receipt images are deleted after 90 days. You can request earlier deletion at any time.

6. Your rights

Under GDPR you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Restrict or object to processing
• Data portability (export in JSON/CSV)
• Withdraw consent at any time

Email [email protected] to exercise any right. We respond within 30 days.

7. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Passwords are hashed with PBKDF2-HMAC-SHA256 (260,000 iterations). We conduct regular security reviews.

8. Changes

We may update this policy. Material changes will be notified by email and in-app banner at least 14 days before they take effect.