Privacy policy
Last updated 1 October 2026
This policy explains what QR&Receipt (the iPhone and Android apps and qrandreceipt.com) does with your data, why, and what you can do about it.
Who is responsible
QR&Receipt is run by UAB SmartOn Systems, Lithuania, the data controller for the data described here. To ask about your data or use any of your rights, write to us through the contact form.
What we collect and why
| Data | Why |
|---|---|
| Your account: e-mail address, or the ID that Apple or Google gives us when you sign in with them | To sign you in and keep your receipts in your account |
| Receipts: shop, date, items, VAT, total and payment method (card or cash, and the last four digits of the card if the receipt shows them), plus anything you add: category, notes, return and warranty dates | To keep your receipts, search them and show return and warranty dates |
| Scanned receipts: the photo you take or choose, and the text your phone reads from it | To read the receipt for you. Location data stored in the photo is removed before it leaves your phone and again on our server |
| Photos and corrections for improving scanning: the photo of a receipt you save, what was read from it and the corrections you made | To make receipt reading more accurate. On unless you turn off "Help improve scanning" in Settings; turning it off deletes the photos already sent |
| Location: the shop's address shown on a map; your phone's position when you scan, only if you turn on "Save where I scan receipts" (rounded to about 10 m) | To show where a purchase happened. Your scan position is never collected unless you switch it on |
| Receipts from partner shops: when you tap your phone or open a receipt link, the sale from that shop's till | To give you the receipt you asked for. A tap shows only the sale just closed on that till, once, to one phone |
| Website forms: your e-mail when you join the early-access list; name, e-mail, company and message when you contact us | To tell you about the launch and answer you |
| Technical data: IP address, device ID, and request logs on our server | To keep the service secure and working, and to stop abuse |
We don't show ads, use advertising or analytics SDKs, track you across other apps and websites, or sell your data. A partner shop sees nothing about you beyond its own sale.
Legal basis
- Providing the service you signed up for (contract): your account, receipts, scanning and reading receipts, partner-shop receipts.
- Your consent, which you can withdraw in Settings at any time: saving where you scan receipts.
- Our legitimate interest in a secure and better service: technical logs, and keeping photos and corrections to improve scanning. You can object at any time by turning off "Help improve scanning", which also deletes the photos already sent.
- Answering you: contact messages and the early-access list.
Who processes data for us
We use these services to run QR&Receipt. They process data only on our instructions.
- Our server host, in the EU: the app, the website and the database with your account and receipts.
- Cloudflare: delivers qrandreceipt.com and protects it from attacks; all traffic to the site passes through it.
- OpenAI: reads scanned receipts (the photo and its text) and returns what's on them. Under its terms for business customers, OpenAI does not use this data to train its models.
- Apple and Google: only if you choose to sign in with them.
- Google (Gmail): sends our e-mails, such as sign-in links.
- OpenStreetMap: turns shops' addresses into map points. Only the shop's address is sent, nothing about you.
Some of these companies are based outside the EU. Where your data leaves the EU, it is protected by the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
- Your account and receipts: until you delete them, or your account.
- Photos and corrections kept to improve scanning: until you delete the receipt, turn off "Help improve scanning" or delete your account.
- Scans you don't save: deleted within a day.
- Sign-in links: valid for 15 minutes.
- Receipt links from partner shops that nobody collects: can no longer be opened after 30 days.
- Contact messages and the early-access list: until the matter is dealt with, or you ask us to delete them.
Your rights
You can ask to see, correct or delete your data, to receive it in a portable format, and to restrict or object to how we use it. In the app you can do much of this yourself:
- Export all your receipts: Settings → Export all receipts (CSV).
- Delete your account and everything in it: Settings → Delete account.
- Turn off photo sharing and scan location at any time in Settings.
For anything else, use the contact form. If you think we handle your data wrongly, you can complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt) or the data protection authority where you live.
Children
QR&Receipt is not meant for children under 14.
Changes
If we change this policy, we'll update the date at the top and, for important changes, tell you in the app before they apply.