Privacy Policy

Deduxe ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Deduxe application and related services (the "Service"). By using the Service, you consent to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• First and last name
• Email address
• Password (stored in hashed form; we never store plain-text passwords)
• Account creation date
• Subscription plan and billing status

1.2 Financial and Expense Data

When you use the Service, you may provide:

• Expense descriptions, amounts, dates, and categories
• Business entity names and types
• Mileage logs (origin, destination, distance, purpose)
• Work hours logs (hours, type, description)
• Participant/contact names associated with expenses
• Location information you manually enter for expenses

1.3 Voice Data

1.4 Receipt Images

When you attach receipt photos to expense entries, the images are compressed client-side and stored as part of your expense data. Receipt images are processed by AI to extract vendor names, amounts, dates, and categories. The images are stored securely in your account and are accessible only to you.

1.5 Anonymized Usage Data

We may collect anonymized, non-personally-identifiable usage data to improve the Service, including:

• Feature usage patterns (which features are used most frequently)
• Application performance metrics (load times, error rates)
• Device type and browser information
• General geographic region (country-level only)

This data is aggregated and cannot be used to identify individual users.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process and organize your expense, mileage, and hours data
• Generate reports and PDF exports at your request
• Authenticate your identity and secure your account
• Process subscription payments and manage billing
• Send transactional emails (account verification, password resets, billing receipts)
• Improve the Service based on anonymized usage patterns
• Respond to customer support inquiries
• Comply with legal obligations

3. What We Do NOT Do

• No advertising: We do not serve advertisements or use your data for ad targeting
• No data brokering: We do not share your financial data with data brokers or analytics companies
• No AI training: Your expense data, voice transcripts, and receipt images are not used to train AI models
• No third-party analytics tracking: We do not embed third-party tracking scripts (Google Analytics, Facebook Pixel, etc.) in the application

4. Data Storage and Security

Your data is stored using Supabase, a secure, enterprise-grade database platform. Security measures include:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security)
• Encryption at rest: Your data is encrypted at rest on Supabase's infrastructure
• Row-Level Security (RLS): Database access is enforced at the row level, ensuring users can only access their own data
• Secure authentication: Passwords are hashed using industry-standard algorithms; we never store plain-text passwords
• Access controls: Administrative access to the database is limited to authorized personnel only

While we implement robust security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data.

5. Third-Party Services

We use the following third-party services to operate Deduxe:

Service	Purpose	Data Shared
Supabase	Authentication and database storage	Account info, expense data, entity data
Stripe	Payment processing	Payment method details, billing address (handled directly by Stripe; we do not store card numbers)
Resend	Transactional email delivery	Email address, name (for sending account-related emails only)

Each third-party service is bound by their own privacy policies and data protection obligations. We only share the minimum data necessary for each service to function.

6. Data Retention

We retain your data for as long as your account is active and as needed to provide the Service. Upon account deletion:

• Your expense entries, entity data, receipt images, and account information will be permanently deleted within 30 days
• Anonymized, aggregated data that cannot identify you may be retained for analytical purposes
• We may retain certain information as required by law (e.g., billing records for tax compliance)
• Backup systems may retain encrypted copies for up to 30 additional days before automatic purging

You may request immediate deletion of your data by contacting privacy@deduxe.app.

7. Your Rights

You have the following rights regarding your personal data:

7.1 Right to Access

You may request a copy of all personal data we hold about you. You can export your data at any time using the "Download My Data" feature in Settings, which generates a comprehensive PDF of all your entries organized by entity.

7.2 Right to Correct

You may update or correct your personal information at any time through the application. This includes editing expense entries, updating your profile, and modifying entity information.

7.3 Right to Delete

You may delete your account and all associated data at any time through Settings > Your Data > Delete My Account. You may also request deletion by emailing privacy@deduxe.app.

7.4 Right to Opt-Out

You may opt out of:

• Non-essential emails by adjusting notification preferences in Settings
• Anonymized usage data collection by contacting us at privacy@deduxe.app

8. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a person under 18, we will take steps to delete that information promptly. If you believe a minor has provided us with personal information, please contact us at privacy@deduxe.app.

9. Cookies and Local Storage

Deduxe uses localStorage (not cookies) to store certain preferences and application state on your device, including:

• Authentication session tokens
• Theme preferences (dark/light mode)
• Tutorial completion status
• Notification dismissal states
• Recurring expense configurations

This data is stored locally on your device and is not transmitted to our servers. You can clear this data at any time by clearing your browser's site data for Deduxe.

We do not use third-party cookies, tracking cookies, or advertising cookies.

10. California Consumer Privacy Act (CCPA) Disclosures

If you are a California resident, you have additional rights under the CCPA:

10.1 Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which your information was collected, the business purpose for collecting your information, and the categories of third parties with whom we share your information.

10.2 Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions permitted by law.

10.3 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. We will not deny you the Service, charge you different prices, provide a different quality of service, or suggest any of these actions as a consequence of exercising your rights.

10.4 No Sale of Personal Information

We do not sell personal information as defined by the CCPA. We have not sold personal information in the preceding 12 months and have no plans to do so.

To exercise your CCPA rights, contact us at privacy@deduxe.app. We will verify your identity before processing any request and respond within 45 days as required by law.

11. International Users

The Service is operated from the United States. If you access the Service from outside the United States, please be aware that your data may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to such transfers.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. The "Last Updated" date at the top of this page indicates when the policy was last revised. Your continued use of the Service after the effective date constitutes your acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: privacy@deduxe.app

We aim to respond to all inquiries within 5 business days.