Privacy Policy

Last updated 2026-10-30

This policy explains what personal data Receva processes, why, and the rights you have over it. Receva is an invoicing and e-invoicing service for freelancers and small businesses.

1. Controller

The controller responsible for your personal data is the operator of Receva (receva.app). For any privacy question or request, contact us at the address in the Contact section below.

2. Data we collect

• Account data — your name, email address, and password (stored only as a salted hash).
• Company profile — your business name, address, VAT ID, and contact phone and email used on your documents.
• Invoicing data you enter — your customers, invoices, estimates, credit notes, expenses, and related financial data.
• Payment data — when you accept card payments, these are processed by Stripe Connect. We never see or store full card numbers.
• Subscription data — if you subscribe to Pro, you buy it from Lemon Squeezy, which sells the Pro subscription as merchant of record and takes the payment (see section 4). We send Lemon Squeezy your account email, to fill in the checkout, and an internal reference that links the purchase to your account. Lemon Squeezy sends us the subscription's status, plan, billing period and renewal or end date, and its own customer, order and subscription numbers. If a payment confirmation is late, we may look up your subscription at Lemon Squeezy by your account email. We never see your card details.
• Accountant access — if you invite your accountant, we store the email address you entered, who sent the invitation and when, and when it expires or was accepted. Once they accept, we record that their Receva account can view your company, from when, and when and why that access ended (removed by you, left by them, or their account deleted), so you can see who had access. Your accountant can then see and download your company's data, but not change it. You decide whom to invite and can remove them at any time. An invitation that was never accepted is deleted when you cancel or remove it; everything else is deleted with your account. If your accountant deletes their own account, their access ends and is deleted with that account.
• Invoice and estimate opens — when someone opens an invoice or estimate link a Receva user sent them, we record the time it was first opened and show it to the sender. We don't store the visitor's IP address or device details for this, and we ignore the sender's own views and automatic link checks by mail and chat services.
• Email delivery status — when Receva emails an invoice or a reminder, our mail provider (Amazon SES) tells us whether it was delivered, bounced or marked as spam, and we keep that result with the recipient's address and the time so the sender can see it and is told when an email did not arrive.
• Receipts and OCR — receipts you upload or forward by email are stored and processed by an AI assistant to extract expense data. So that the same receipt is not filed twice, we also keep a fingerprint of each receipt file (a SHA-256 hash of its contents) with the expense, and a simplified form of the vendor name. Both stay inside your own account: they are compared only with your other expenses, never with anyone else's, and they are deleted with the expense.
• Bank statements — if you upload a bank statement (a camt file, on Pro), we keep each incoming payment in it: the payer's name and IBAN, the payment reference and text, the amount and the date, plus a fingerprint (a hash of the payment's details) that lets us spot a payment you have already imported. We keep these for the life of your account and delete them with it. While the import runs we hold a temporary parsed copy of the file, which is deleted when the import ends. The statement lines are not part of your data export; the payments they recorded on your invoices are.
• Logs — technical logs including your IP address, used to operate the service, apply rate limiting, and detect abuse. Login-alert and account-erasure signals are stored in a pseudonymized (one-way HMAC) form rather than as raw IP or email.

3. How we use AI

Receipts and text you submit to the AI assistant are sent to our AI sub-processors to extract or suggest invoice and expense data. No automated decision with legal or similarly significant effect is made about you. The output is always a suggestion you review.

4. Sub-processors

We rely on the following service providers:

• Cloudflare — hosting, database, file storage, visit statistics (Web Analytics) and the servers of our consent tool.
• Stripe — card payment processing.
• Amazon SES — transactional email (verification, reminders, notifications).
• AI Gateway providers (Google Gemini, OpenAI, Cloudflare Workers AI) — receipt OCR and invoice suggestion.

Lemon Squeezy sells the Pro subscription. It is the merchant of record: you buy Pro from Lemon Squeezy, which collects your payment and billing details itself and handles them under its own privacy policy. What it shares with us, and what we share with it, is listed under Subscription data in section 2.

5. Retention and deletion

We keep your data for as long as your account is active. You can delete your account at any time from the in-app account settings. Deletion runs on a 7-day grace period during which you can cancel and recover the account; after that, your data is permanently purged. A minimal erasure record (a tombstone holding no readable personal data) is retained to evidence that the deletion took place.

If you have a Pro subscription that is still running, we first try to cancel it, so you are not charged again. If Lemon Squeezy can't confirm that in time, the purge waits for up to 7 more days, so up to 14 days after your request in total, and then goes ahead anyway.

Deleting your Receva account does not delete Lemon Squeezy's own records of your purchase. As the seller, it keeps its order and tax records under its own privacy policy, and requests about them go to Lemon Squeezy.

To stop the free trial of Pro being used more than once, we keep a record when you start a trial checkout. It holds a keyed one-way hash of your email address and, if your email domain is a company domain rather than a public mail provider such as Gmail or Bluewin, a hash of the domain. It also links to your account, to the checkout and, once you subscribe, to the subscription. We don't keep the address itself, and we use the hashes only to check whether a new trial uses the same address or company domain. They are still personal data. We keep the record for 24 months after the trial starts, also after you delete your account (deleting it removes the link to the account). If you don't finish the checkout, the record is deleted within about a day and a half. Our legal basis is our legitimate interest in preventing abuse of the trial.

6. Your rights

Under the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR), you have the right to access, rectify, and erase your personal data, and to restrict or object to certain processing. You can exercise access and erasure directly through the in-app account settings, or by contacting us. You also have the right to lodge a complaint with the competent supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), and in the EU your local Data Protection Authority.

If you are in the EU, EEA, UK, Switzerland, Brazil, South Korea, Israel, Turkey, Canada or New Zealand, you can also use the form below to ask for a copy of your data or for its deletion, including the records our consent tool keeps for this browser. We reply by email within one month.

7. Cookies and similar storage

We only store what the site needs to work. None of it follows you to other sites or is used for advertising, so none of it needs your consent.

• Sign-in. A session cookie keeps you signed in for up to 30 days and is removed when you sign out. While you finish a two-factor sign-in, a second cookie holds the first step for a few minutes.
• Language. A cookie remembers the language you picked, or the one we took from your browser settings, for about 13 months.
• Company you are viewing. If you are someone's accountant and switch to their company, a cookie remembers which company you opened, for up to 30 days. It holds the company's ID and a signature tied to your account, and is removed when you switch back to your own company.
• Account language. If saving your language to your account fails, a cookie holding your account ID stops us from trying again on every page. It lasts one day.
• Consent tool. If you make a choice in our consent tool, it keeps that choice in your browser for 365 days, in the rb-consent and rb-consent-id cookies and in local storage, with a random consent ID. Where it shows nothing, your browser keeps only the current year, so that you are counted once a year (see below).

The current list, checked by an automatic scan every week, is on our cookie list.

Visit statistics

We count visits to receva.app with Cloudflare Web Analytics. It sets no cookies and stores nothing on your device. For each page view your browser tells Cloudflare which page you opened, the page you came from, your browser type and how fast the page loaded. We see totals, such as page views per page and per country, and nothing that tells us who you are or links a visit to your account. Our legal basis is our legitimate interest in knowing how the site is used.

Our consent tool

Our consent tool is served from privacy.revoltbots.com, which we run ourselves on Cloudflare. It uses the country and region Cloudflare reports for your connection to apply what the law there asks of us. Because Receva uses nothing that needs consent, it normally shows no banner.

• When you make a choice, we keep a record of it as proof: the random consent ID, your choice, the time, the country and region, your browser's user agent, the language shown, whether your browser sent a Global Privacy Control signal, and your IP address in encrypted form. We keep these records for 365 days. "View or delete my consent history" in the consent preferences shows the records for your consent ID and lets you delete them.
• When you are signed in, your cookie choice is saved with your account in pseudonymous form (a keyed one-way code made from your email address, never the address itself) and applies on your other devices. You can change it at any time with the cookie button.
• Where no banner is shown, we keep one record per browser of which rule applied: a random ID, the time, and the country, region and network provider Cloudflare reports. It does not include your IP address. We also count visits once per browser per year by country and region, as a number only, to know which state laws apply to us.
• To stop abuse, our servers count requests per IP address for a minute at a time. That count is kept only in memory and the address is not stored.

We honor Global Privacy Control signals. We do not respond to "Do Not Track" signals, because there is no common standard for them. We do not sell or share personal information.

8. International transfers

Our sub-processors operate infrastructure in Switzerland, the EU, and the United States, so your data may be transferred and processed in those regions under appropriate safeguards.

Lemon Squeezy, which sells the Pro subscription, handles your purchase under its own privacy policy. That policy says the data it collects is stored and processed in the United States.

9. Contact

For any privacy request or question, contact us at [email protected].