Terrapin Software Inc. ("Terrapin", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, share, and safeguard your information when you use our services, including our website, mobile application, and any related services (collectively, the "Service").

1. Scope

This policy applies to users in the United States, Canada, and the United Kingdom. We comply with applicable privacy regulations, including the California Consumer Privacy Act (CCPA), UK General Data Protection Regulation (UK GDPR), and the EU GDPR where applicable.

2. Information We Collect

We collect the following types of information:

2.1 Information You Provide

• Name, email address, and account details

• Receipt and invoice data, including merchant names, itemized expenses, payment details, and potentially sensitive data (at user discretion)

• Communications with support (e.g., Intercom chat)

2.2 Information We Collect Automatically

• Device and usage information

• Cookies and tracking technologies (via GA4, Intercom)

• Session logs and user interaction data

2.3 Information from Third Parties

• Analytics and marketing platforms (Google, Meta, TikTok, LinkedIn)

• Payment processors (Chargebee, Stripe)

• Financial data aggregators (e.g., Plaid)

• Email providers (e.g., Gmail, Outlook) where you connect your account to ingest receipts and invoices

• Authentication providers (e.g., OAuth where applicable)

2.4 Information from On-Device Access (Mobile App)

With your explicit consent, our mobile application may access certain on-device data to enhance functionality:

• Photos: to detect and ingest receipt images

• Messages: to identify receipts sent via SMS or messaging apps (where permitted)

• Wallet: to extract transactional data (where technically possible and legally compliant)

• Location: to associate receipts or expenses with locations (optional)

• Calendar: to assist with receipt/event reconciliation (e.g., matching travel or dining to meetings)

3. How We Use Your Information

We use your information to:

• Provide and maintain the Service

• Process subscriptions and payments

• Classify and categorize receipt data (including via AI models)

• Enrich transactions using third-party financial data (e.g., Plaid)

• Ingest receipts and invoices from your connected email accounts

• Use on-device data (when permission is granted) to simplify receipt import and classification

• Communicate with you (e.g., support, updates, marketing)

• Improve our platform (e.g., via analytics and feedback)

• Comply with legal obligations

4. Legal Bases for Processing (UK/EU/Canada)

We rely on the following legal bases:

• Contractual necessity (e.g., account and billing management)

• Legitimate interests (e.g., fraud prevention, service improvement)

• Consent (e.g., marketing emails, cookie usage, device data access)

• Legal obligation (e.g., compliance with tax or regulatory laws)

5. Sharing and Disclosure

We do not sell your personal data. We may share data with:

• Service providers under contract (e.g., Azure, Intercom, Chargebee, Plaid, OCR providers)

• Advertising platforms for audience targeting (anonymized where possible)

• Legal authorities when required by law or to protect our rights

6. Data Retention

We retain personal data only as long as necessary to:

• Provide services

• Fulfill legal or regulatory obligations

• Resolve disputes and enforce our terms

Data may be anonymized and retained for analytical purposes.

7. Data Security

We use industry-standard security measures, including encryption in transit and at rest. Infrastructure is hosted in the United States (Azure). We are pursuing SOC 2 and UK Cyber Essentials compliance.

8. Your Rights

Depending on your location, you may have the right to:

• Access your personal data

• Request correction or deletion

• Object to or restrict processing

• Port your data to another service

• Withdraw consent for marketing or data sharing

To exercise your rights, contact us at privacy@tryterrapin.com.

9. Cookies and Tracking

We use cookies to:

• Analyze website usage (Google Analytics)

• Enable support chat (Intercom)

• Run advertising campaigns (Meta, TikTok, etc.)

You can manage your preferences via our cookie banner.

10. Children’s Privacy

Terrapin is not intended for children under 13. We do not knowingly collect data from minors. If we become aware, we will delete the data promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. When we do, we will revise the “Effective Date” above and notify users where required.

Contact: privacy@tryterrapin.com