Privacy Policy

1. Who is responsible

The data controller for Sliparo is Controller: legal name (or natural person), registered address, and company code if any. You can reach us about anything in this policy at Contact email address for privacy requests.

Sliparo is currently invite-only and free of charge while it is being built. This policy already describes the shared price-comparison feature (section 10) even though it is switched off for every account today, so that nothing changes silently when it is turned on.

2. Where your data lives

Your account, receipts and everything derived from them are stored in a Postgres database and a private file store hosted by Supabase in the AWS eu-north-1 region (Stockholm, Sweden). The application itself runs on Vercel. Receipt images are read by an AI model from Anthropic. Errors are reported to Sentry. Each of these is described in section 5, and what leaves the EEA in section 6.

Sliparo has no analytics, advertising or tracking scripts of any kind, and no data broker, marketing or profiling use of your data. The only cookies are the ones the app needs to keep you signed in and remember your language (section 3.9).

3. What we collect, why, and on what legal basis

3.1 Asking for access

The request-access form on sliparo.com stores your email address and the language the site was in when you sent it, so we can reply in that language. Nothing else is recorded — no IP address, no browser details. The form's hidden anti-spam field is checked and discarded. An administrator either approves the request, which moves your email onto the sign-in allow-list and deletes the request, or dismisses it, which deletes the request outright.

Legal basis: steps taken at your request before entering into a contract (GDPR Article 6(1)(b)).

3.2 Signing in

You can sign in with Google or with an email magic link. Both are checked against the allow-list first; an address that is not on it cannot sign in and no account is created for it.

• With Google, we receive your email address, your name and confirmation that Google has verified the address. We store the email and the name. We never see your Google password and we do not store your profile picture or anything else from your Google account.
• With a magic link, you type your email address and Supabase Auth emails you a single-use link. Supabase Auth keeps its own record of that email address and when the link was used. We store the email address as your account's identity; the name on the account is the email address itself until you sign in with Google.
• Either way, a person who uses both methods with the same email lands on the same account — accounts are keyed on email.

Your session is a signed token held in a cookie on your device. Sliparo keeps no server-side session list. Legal basis: performance of the contract with you (Article 6(1)(b)).

3.3 Your account settings

Your account row holds your display language, the currency your reports are converted into (base currency), whether projects are switched on, which plan you are on and the monthly extraction limit that goes with it, any per-account override of that limit set by an administrator, the project you last saved a receipt to (a prefill only), and a flag for the shared price engine, which is off for every account and cannot currently be switched on by anyone (section 10). Legal basis: contract.

3.4 Receipts you capture

This is the core of the product and most of the data we hold about you. When you photograph a receipt, upload a PDF, or paste receipt text:

• The image or PDF is stored in a private file store under a random filename. It is never publicly reachable; when the app shows it back to you it generates a link valid for 60 seconds.
• Pasted text and the text layer of a PDF are scrubbed on our server before anything else happens: lines that look like card numbers, terminal identifiers or authorisation codes are removed. The scrubbed text is what is stored and what the model sees.
• The image or scrubbed text is sent to the AI model (section 4), which returns a draft: supplier, date, total, currency, receipt number, and every line — description, quantity, unit price, discount, deposit, a suggested category, and where it can tell, the product's brand, model and package size and a typical warranty length for durable goods.
• The model's raw answer is kept permanently alongside the receipt it produced, together with the model name, the number of tokens used, the cost of the call in US dollars, and a note of the image resizing that was applied. This is the record of what the AI actually said, separate from what you confirmed.
• Nothing is saved as a receipt until you review the draft and press save. You can change every field. What you save — the receipt, its lines, and how you allocate them to projects and areas — is your confirmed record.
• If the receipt is in a currency other than your base currency, we convert it using European Central Bank reference rates and store the rate and date used.

Everything you then add on top — projects, areas, categories, suppliers, budgets, warranty periods, return deadlines, product names — is stored under your account. Names you type are yours: a project called after a person or an address is personal data, and we treat it as such. Legal basis: contract.

3.5 Learning from your corrections

Every time you save a receipt, Sliparo records, for each line, the description the model read, which category it suggested, which category you left the line in, and the receipt's supplier. These correction records are used to pre-fill categories on your future receipts, and a bounded selection of them (description, your category, supplier name) is included as hints in later requests to the AI model for your account only. They are deliberately kept as standalone records, so they survive editing or deleting the receipt they came from; they are deleted with your account. Legal basis: contract — this is how the product gets better at your receipts specifically.

3.6 Your own products and price history

Sliparo builds a private catalogue of products from your line items, so it can show you what you paid for the same thing last time. Where a receipt prints an item code, the same code from the same supplier is linked automatically; otherwise a match is proposed and you accept or reject it, and your answer is remembered. Cross-shop identities (brand + model + size) are recorded in a shared, global list of product facts that contains no purchase or account information. Your own price history is computed only from your own receipts. Legal basis: contract.

3.7 When something goes wrong

Failed extractions. When a capture fails or produces something unusable — the model could not read it, the lines do not add up, the date is implausible, and similar — Sliparo keeps a copy of the image or scrubbed text, the model's output, and the error, in a separate diagnostics store that only the operator can see, so the failure can be understood and fixed. These diagnostics are deleted after 30 days by a scheduled job that runs daily.

Error reports. If the app crashes, on our server or in your browser, an error report is sent to Sentry containing the error message and stack trace, the page or API route involved, your browser and operating system versions, and your internal account identifier so we can tell whose session broke. Request bodies, cookies and headers are stripped from every report before it is sent, and IP addresses are not collected, so a report never contains a receipt, an image, an amount or your email. Extraction warnings sent to Sentry say only what kind of problem occurred (for example "line items do not reconcile with the total"), never the values. Legal basis: our legitimate interest in keeping the service working (Article 6(1)(f)).

3.8 Currency conversion

To convert a foreign-currency receipt into your base currency, our server asks the European Central Bank's public data service for reference rates. That request contains only currency codes and a date range — no personal data of any kind leaves Sliparo in it.

3.9 Cookies

• A session cookie that keeps you signed in (HttpOnly; not readable by scripts).
• A CSRF protection cookie used by the sign-in flow.
• NEXT_LOCALE, which remembers the language you picked.

That is the complete list. There are no analytics, advertising or third-party cookies, so no cookie banner is needed: all three are strictly necessary for the service you asked for.

3.10 Server logs

Like any web host, Vercel sees the IP address, browser identification and URL of every request to the site and the app in order to serve it, and keeps request logs for a short period under its own policy. Sliparo never writes IP addresses or browser details into its own database. Confirm Vercel's log-retention period for this project's plan and state it here. Legal basis: legitimate interest in operating and securing the service.

4. How the AI reading works

Receipts are read by Claude models from Anthropic PBC, called from our server only — the credentials never reach your browser. Image and PDF captures use claude-opus-5; pasted text uses claude-haiku-4-5. What Anthropic receives for each capture is:

• the receipt image, after our server has resized it and applied contrast and orientation fixes (or the pages of a PDF rendered to images), or the scrubbed receipt text;
• the names of the categories you use, so the model can suggest one;
• a bounded set of hints from your correction history (section 3.5): past line descriptions, the category you chose for them and the supplier name.

Anthropic does not receive your name, email address, account identifier, or any other receipt. Under Anthropic's commercial API terms, inputs and outputs are not used to train its models. Confirm the retention period Anthropic applies to API inputs and outputs for this account, and whether a zero-data-retention arrangement is in place, and state it here.

The model only ever produces a draft. It cannot write to your confirmed records; you do. Its output is stored as described in section 3.4 so that there is always a record of what it actually returned.

5. Who processes your data on our behalf

Each provider acts on our instructions under a data-processing agreement. Confirm that a DPA is accepted/signed with each of Supabase, Vercel, Anthropic and Sentry, and keep copies. The European Central Bank is not a processor: it receives no personal data (section 3.8).

6. Transfers outside the EEA

Your stored data stays in the EU (Supabase, Stockholm). Three providers are US companies and do process data in the United States: Anthropic (every receipt image or text you capture is sent there to be read), Vercel (the application runs there unless the region is changed) and Sentry (error reports). Google may process the sign-in exchange in the US.

These transfers rely on the safeguards in each provider's data-processing agreement: the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. Verify, per provider, which mechanism applies (SCCs and/or DPF certification) and name it here for each.

7. How long we keep things

8. Deleting a receipt, and deleting your account

Deleting a receipt removes the receipt, its lines and allocations, and its image from the file store, and clears the model's stored output, any stored receipt text, and the receipt number the model read. What remains is a cost record of the AI call (model, tokens, cost, date) labelled with the supplier name the model read, plus any warranty entries and correction records that came from it, as described above.

You can delete your account yourself: Configuration → Delete account, then type DELETE to confirm. It runs immediately and signs you out. It removes your receipts, line items, images, model outputs and cost records, diagnostics, products, warranties, suppliers, projects, categories, areas, budgets, correction records, your account row, your allow-list entry (signing in again would need a new invitation), and your Supabase Auth sign-in record if you used magic links. If you would rather not do it yourself, or can no longer sign in, email contact email from the address on the account and we will run the same deletion and confirm to you when it is done, within deletion turnaround — e.g. 30 days.

Two things cannot be deleted per person because they are not linked to a person: shared price observations you contributed while opted in (section 10), and the global list of product identities (brand, model, size). Error reports already sent to Sentry are deleted on Sentry's own schedule (section 7).

9. Your rights

Under the GDPR you can ask us to access, correct, delete, or restrict the use of your personal data, object to processing based on our legitimate interests, withdraw consent where consent is the basis (the shared price engine, when it exists), and receive your data in a portable form. How that works in Sliparo:

• Access and correction: everything you have saved is visible and editable in the app.
• Portability: Configuration → Export gives you your complete data — receipts, lines, projects, categories, areas, suppliers, budgets — as JSON or a spreadsheet, and the same file can be imported again.
• Deletion: section 8.
• Anything else, or if you cannot sign in: email contact email. We may ask you to confirm from the address on the account.

You also have the right to complain to a supervisory authority. If Sliparo's controller is established in Lithuania, that is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt). Confirm the controller's country and name the corresponding authority.

10. The shared price engine (switched off)

Sliparo is built to be able to show price comparisons across shops using purchases from many accounts. This feature is off: the setting that would enable it is off for every account, no screen or API can turn it on, and the shared store is empty. This section describes exactly what it will do so that switching it on later is not a surprise.

• It is opt-in (recommended, and what the code implements: off by default, contribution only while the flag is on) — or opt-out. Nothing is shared until you choose to.
• While you are opted in, each line you save that has a printed unit price adds one record to a shared store: supplier name, product name, unit price, currency, and purchase date. Nothing else. The record has no account identifier, no receipt identifier, and no link to any of your other data — the design makes it impossible for the app to find your records again once written.
• Because of that, opting out stops future contributions immediately but cannot withdraw records already shared: there is nothing to find. This is the trade-off you accept by opting in.
• Products from different shops are only grouped under one shared identity once at least two independent accounts have each confirmed the same brand, model and size, so one person's confirmation can never mislabel what everyone else sees.
• Comparisons will only be shown for a product and supplier once a minimum number of observations exist (the code defines 5; confirm). Even so, a rare product at a rare supplier could in principle be inferable from a single observation. Decide whether non-contributing accounts can see comparisons, or see them with a prompt to contribute.
• Legal basis: your consent, given by opting in and withdrawable at any time for future purchases.

When this feature is turned on, this policy's "last updated" date will change and the setting will be presented to you in the app before anything is shared.

11. Security

• All traffic is encrypted in transit (HTTPS). Receipt images are in a private bucket and are only ever served through links that expire after 60 seconds.
• Every stored record is scoped to one account and every read is checked against the signed-in account on the server; there is no way to reach another account's data through the app.
• Keys for the AI provider, the database and the file store exist only on the server and never reach your browser.
• Card numbers and authorisation codes are stripped from pasted or PDF receipt text before storage and before the model sees it.
• Sign-in is only possible for allow-listed addresses, and Google sign-in additionally requires a verified email.

12. Who at Sliparo can see your data

Sliparo is operated by the controller / a single person. The operator's administration screens show every account's email, plan and monthly extraction count, the AI cost per extraction labelled with the supplier name the model read, pending access requests and the allow-list, and the failed-capture diagnostics described in section 3.7, including the receipt image that failed. The operator does not browse confirmed receipts and has no screen for doing so; direct database access is used only for the maintenance and deletion tasks described in this policy.

13. Changes to this policy

When the software changes in a way that changes what happens to your data — a new provider, a new retention period, the price engine being switched on — this page is updated and the date at the top changes. For a change that affects you materially we will also tell you in the app or by email before it takes effect.

14. Contact

Controller name, postal address, contact email. Please write from the email address on your account when asking about it.