Privacy Policy
What we collect, the legal basis for each use, who else processes it, how long it stays, and the rights the GDPR gives you over all of it.
Updated September 1, 202614 sectionsoperated from the European Union
On this page
The short version
The full detail is below, but this is the shape of it:
- You can build and preview a receipt without an account and without telling us who you are.
- Receipts are drawn on our servers, so the content you type is sent to us to produce the image or PDF. The rendered file is not kept.
- The content itself is stored only if you choose to save the receipt to your account. You can delete it whenever you like.
- We do not sell your data, we do not build advertising profiles, and we do not use your receipts to train models.
- Receipt Maker is operated from the European Union. The GDPR applies to everything here.
Who is responsible for your data
The operator of Receipt Maker (receiptsmaker.com) is the data controller for the personal data described in this policy. We are established in, and operate from, the European Union.
For any privacy matter — a question, a request to exercise your rights, or a complaint — write to [email protected]. We will provide our full legal entity details and registered postal address on request.
What we collect
Account data
Your email address, any name you give, and the records needed to keep you signed in: verification tokens, session identifiers, and the dates your account was created and last used.
Receipts you save
If you save a receipt, we store its contents — the business details, line items, amounts, dates and any custom text you entered — against your account, along with the name you gave it. Whatever you type into a receipt ends up here, so do not put anything on a receipt that you would not want stored.
Logos and images you upload
Uploaded logo files are stored in our object storage so they can be drawn onto your receipts. We accept PNG, JPG, GIF, SVG and WebP files up to 5 MB.
Receipt rendering (not retained)
Every time you preview or download, the receipt content is sent to our server, rendered into an image or PDF, and returned to you. That transfer is necessary for the tool to work at all. The rendered file is not written to storage, and unsaved receipt content is not kept after the request completes.
Email receipts
If you use our email receipt tool, we store the form data you entered, the generated message, the recipient’s email address and the time it was sent. Only send email receipts to people who are expecting them.
Messages you send us
When you email support or write to us, we keep the message and your address so we can reply and keep track of the issue.
Technical and log data
Our servers record IP address, browser and device type, pages requested, timestamps, and errors. We also keep short-lived rate-limit records tied to IP address, which is how we stop the tool being driven in automated bulk.
Analytics
We use Google Analytics to understand which pages people use and where they run into trouble. It sets cookies and processes an identifier and approximate location. See the cookies section below for how to turn it off.
Why we use it, and our legal basis
Under Article 6 of the GDPR every use of personal data needs a lawful basis. Ours are:
- Running the tool
- Rendering your receipts, producing your files, storing what you save. Performance of our contract with you — Article 6(1)(b).
- Your account
- Creating it, verifying your email address, signing you in, replying to support requests. Performance of our contract with you — Article 6(1)(b).
- Sending email receipts
- Delivering a message you asked us to send. Performance of our contract with you — Article 6(1)(b).
- Security and abuse prevention
- Rate limiting, blocking automated bulk generation, investigating misuse of the tool. Our legitimate interest in a service that is not overrun — Article 6(1)(f).
- Keeping the service working
- Error logs, diagnosing faults, capacity planning. Our legitimate interest in a reliable service — Article 6(1)(f).
- Analytics
- Understanding how the site is used so we can improve it. Your consent, where consent is required for the cookies involved — Article 6(1)(a).
- Legal obligations
- Responding to lawful requests and meeting obligations that apply to us. Article 6(1)(c).
Where we rely on legitimate interests, we have weighed them against your rights and freedoms, and you can object — see your rights below.
What we do not do
- We do not sell or rent your personal data to anyone.
- We do not use your data for advertising, and we do not build advertising profiles.
- We do not use the contents of your receipts to train machine learning models.
- We do not read your saved receipts, except where we genuinely need to in order to fix a fault you have reported, to investigate a security problem, or because the law requires it.
- We do not make decisions about you by automated means that produce legal or similarly significant effects.
Transfers outside the EEA
We are established in the European Union and keep processing within the European Economic Area wherever we reasonably can.
Some providers — Google Analytics in particular, and parts of some content delivery and storage networks — involve processing in the United States or elsewhere outside the EEA. Where that happens we rely on an adequacy decision of the European Commission where one covers the provider, and otherwise on the Commission’s Standard Contractual Clauses together with additional safeguards. You can ask us at [email protected] which safeguard applies to a particular transfer.
How long we keep it
- Account data
- For as long as your account exists. Deleted when you close it, or after a long period of complete inactivity.
- Saved receipts and uploaded logos
- Until you delete them, or until your account is closed — whichever comes first.
- Unsaved receipt content
- Not retained. It exists only for as long as the render request takes.
- Email receipt records
- Kept with your account so you have a record of what was sent, and deleted with it.
- Support correspondence
- Up to 24 months after the matter is closed, so we have context if you write again.
- Server and security logs
- Up to 12 months, and longer only where a specific security or legal matter requires it.
- Analytics data
- Retained by Google Analytics for up to 14 months.
Where we are required to keep something longer to meet a legal obligation or to defend a legal claim, we keep only what is necessary for that purpose.
Your rights
The GDPR gives you the following rights over your personal data. They are free to exercise, and you do not have to explain why.
- Access — a copy of the personal data we hold about you, and an explanation of how we use it.
- Rectification — correction of anything inaccurate or incomplete.
- Erasure — deletion of your data, including your account and everything saved on it.
- Restriction — to have us pause processing while a dispute about accuracy or lawfulness is resolved.
- Portability — your data in a structured, commonly used, machine-readable format, for you or for another provider.
- Objection — to object to processing we base on legitimate interests, on grounds relating to your situation.
- Withdrawing consent — where we rely on consent, such as analytics cookies, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.
How to exercise them
Email [email protected] from the address on your account, or use the contact form. We respond within one month, and will tell you if a complex request needs longer — the GDPR allows up to two further months, and we will explain why.
How we protect it
- All traffic to and from the site is encrypted with TLS, and data at rest is held on managed infrastructure with encryption enabled.
- Access to production data is limited to the people who need it to run the service.
- Sign-in is by emailed link or code, so there is no password of yours for us to lose.
- Uploads are checked for type and size before they are accepted, and requests are rate limited.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours as required by Article 33, and tell you directly where Article 34 requires it.
If you have found a security problem, please report it to [email protected] before disclosing it elsewhere.
Children
Receipt Maker is a business and bookkeeping tool. It is not directed at children, we do not market it to them, and we do not knowingly collect personal data from them.
If you believe a child has given us personal data, tell us at [email protected] and we will delete it.
Changes to this policy
We update this policy when the service changes or when the law does. The date at the top is the date of the current version. Where a change materially affects how we use your data, we will give notice — by email if you have an account, or through a notice on the site — before it takes effect.
This policy is written to be read alongside our Terms of Service and Acceptable Use Policy. For how the tool works in practice, see the Help Center.
Contact
Privacy questions and rights requests: [email protected].
Anything else — a problem with the tool, an account question — goes to [email protected] or through the contact form.
The rest of the rulebook
These documents are written to be read together. Each one assumes you have the others to hand.
Help Center
Find a download that vanished, fix one that will not start, pick a file format, print at the right width.
Read it →Terms of Service
The agreement between you and Receipt Maker: what the tool does, what it does not promise, and who is responsible for what.
Read it →Acceptable Use Policy
The line between recreating a receipt you lost and forging one you never had. Read this before you make anything.
Read it →