Data Processing Addendum (DPA)

Effective Date: January 5, 2026 | Last Updated: September 18, 2026

1. Introduction

This Data Processing Addendum ("DPA") forms part of the Terms of Service ("Agreement") between AppWrapp, LLC ("Processor") and the user or entity utilizing the Receipto service ("Controller").

This DPA applies to the extent that AppWrapp, LLC processes Personal Data on behalf of the Customer in the course of providing the Service.

2. Definitions

  • "GDPR" means the General Data Protection Regulation (EU) 2016/679.
  • "CCPA" means the California Consumer Privacy Act of 2018.
  • "Personal Data" means any information relating to an identified or identifiable natural person uploaded to the Service (e.g., names on receipts, email addresses).
  • "Sub-processor" means any third party engaged by AppWrapp, LLC to process Personal Data.

3. Processing of Data

3.1 Roles

For the purposes of GDPR, the Customer is the Controller (decides why data is collected) and AppWrapp, LLC is the Processor (processes data on the Controller's instructions).

3.2 Scope and Purpose

AppWrapp, LLC will process Personal Data solely to provide the Receipto Service, including:

  • Extracting text and data from receipt images (OCR and AI processing).
  • Storing and organizing expense data in user and organization accounts.
  • Providing team workspace features (member management, receipt approval workflows, custom fields).
  • Generating exportable reports (CSV, PDF).
  • Processing subscription payments (web: via Stripe; iOS: via Apple In-App Purchase).
  • Sending push notifications for reminders and alerts (via Firebase Cloud Messaging).
  • Monitoring application stability and diagnosing errors (via Sentry).

3.3 Duration

Processing continues for the duration of the Customer's subscription and up to 30 days after termination (for data deletion cycles), unless otherwise required by law.

4. Sub-processors

The Customer grants AppWrapp, LLC general authorization to engage the following Sub-processors to provide the Service. We will ensure all Sub-processors are bound by data protection obligations compatible with this DPA.

Sub-processorRoleData ProcessedLocation
Supabase, Inc.Database Hosting & AuthenticationEmail, account data, receipt data, organization dataUSA / EU
Cloudflare, Inc.File Storage (R2) & CDNReceipt images, app static assetsGlobal
OpenAI, LLCAI Receipt ProcessingReceipt images and extracted text (training opt-out enforced via enterprise API)USA
Amplitude, Inc.Product Analytics and Website Session ReplayUsage events, user properties (email, subscription tier, onboarding data, user ID)EU data center
UXCam, Inc.Session ReplayScreen recordings, account identifier and subscription properties. Sensitive inputs and selected screens are masked.EU
RevenueCat, Inc.Subscription Management & AttributionUser ID, account email, subscription transaction history and permitted attribution identifiers. Optional Meta measurement is described separately below.USA
Apple, Inc.iOS In-App PurchasePurchase transactions (processed on-device by Apple; AppWrapp receives subscription status only)Global
Stripe, Inc.Web Payment ProcessingName, email, billing address (web subscriptions only; no mobile)Global (PCI-DSS compliant)
Google Firebase (FCM)Push NotificationsFCM device token, notification delivery metadataUSA
Sentry, Inc.Crash Reporting & Error MonitoringCrash logs, error stack traces, user ID, subscription tierUSA

We explicitly opt out of data training for all AI providers. Receipt data is processed via enterprise APIs and is never used to train public AI models.

Notes: Amplitude handles event analytics and optional website session replay. UXCam handles mobile session replay. Apple IAP processes mobile payments natively. Stripe is used for web subscriptions only.

We will notify Customers of any changes to this list via email or website updates at least 30 days in advance.

5. Security Measures

AppWrapp, LLC implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption: Data is encrypted in transit (HTTPS/TLS) and in provider-managed encrypted storage.
  • Access Control: Access to production data is restricted to authorized personnel with 2FA.
  • Vendor Management: Evaluating the security practices of all Sub-processors.
  • Crash Monitoring: Application errors are captured by Sentry with user context (user ID, subscription tier) to enable diagnosis. Raw receipt data is not included in error logs.
  • Session Replay Masking: UXCam session recordings automatically mask all text input fields. Financial values on receipts are not captured in recordings.
  • Advertising choices: Supported mobile versions gate Meta measurement on a separate advertising choice and, on iOS, App Tracking Transparency authorization. Website Meta measurement requires a separate cookie choice.

6. International Data Transfers

If Personal Data is transferred from the European Economic Area (EEA) to the United States (or other third countries), AppWrapp, LLC relies on:

  • Standard Contractual Clauses (SCCs): We agree to abide by the European Commission's SCCs for the transfer of data to processors established in third countries.

Processing is not restricted to the EEA. Our production Supabase project is hosted in the United States. Other providers may process information internationally, including for support and operations, even where an EU data center is selected.

7. iOS Platform and Apple Data Processing

For users of the Receipto iOS application:

  • Apple In-App Purchase: Subscription transactions are processed by Apple, Inc. on-device. AppWrapp, LLC receives subscription status and entitlement information from RevenueCat but does not receive raw payment card data.
  • Push Notifications: Firebase Cloud Messaging (FCM) tokens are stored per user in Supabase to enable scheduled reminders and alerts. Users can disable notifications in iOS Settings.
  • Advertising is separate from this DPA:Optional Meta advertising measurement is AppWrapp's own controller activity, not processing of business receipt content on the Customer's instructions. It requires a separate choice and, on iOS, ATT authorization. Meta is not authorized to receive Customer receipt content through this integration. Details, recipients and withdrawal controls are in the Privacy Policy.

8. Data Subject Rights

AppWrapp, LLC will assist the Customer, to the extent possible, in fulfilling their obligation to respond to requests from individuals exercising their rights (e.g., "Right to be Forgotten", "Right to Access").

  • Tools: Customers can export or delete data directly within the Receipto application.
  • Support: If the automated tools are insufficient, Customers may contact support@receipto.app.

9. Data Breach Notification

In the event of a confirmed Personal Data Breach affecting Customer data, AppWrapp, LLC will:

  • Notify the Customer without undue delay (within 72 hours of becoming aware).
  • Provide details regarding the nature of the breach and mitigation steps.

10. Audit Rights

Upon written request, AppWrapp, LLC will make available to the Customer information necessary to demonstrate compliance with this DPA. If a formal audit is legally required, it shall be conducted at the Customer's expense, during normal business hours, and with reasonable notice.

11. Contact

For any questions regarding this DPA or data privacy:

AppWrapp, LLC

Email: support@receipto.app

Address: 651 N Broad St, Suite 201, Middletown, DE 19707

End of DPA