Tab Privacy Policy

The controller of your personal data, meaning the person legally responsible for it, is:

Endive Limited, a company registered in Ireland, number 828414, 10 Nutley Lane, Donnybrook, Dublin 4, D04 X3D0, Ireland

Email: support@tabreceipts.com

"Tab", "we" and "us" in this policy mean that controller. Tab has not appointed a data protection officer, because the law does not require one for a service of this kind. The address above reaches the person responsible for privacy at Tab.

Data protection law lets us use personal data only where we have a lawful basis. The ones Tab relies on are:

• Contract. We need the data to give you the service you signed up for.
• Legitimate interests. We have a real need that does not override your interests, and we name that need each time. You can object; see section 12.
• Consent. You said yes, and you can change your mind at any time.
• Legal obligation. The law requires it of us.

What	Why we use it	Lawful basis	How long we keep it
Your account and profile. Email address, display name, username, profile photo, language, time zone, country and city. A phone number if you add one.	To create your account, sign you in, and show your name and photo to people you share with	Contract	Until you delete your account (section 10)
Optional profile details. Under Profile details, if you fill them in: your postcode and address, your date of birth, your sex or gender (in your own words if you choose), why you use Tab and how you use it. Each one is empty unless you add it	To understand who uses Tab, through anonymous totals that name no one, such as how many users live in a county or fall in an age group. No feature reads them today. They are never shown to other people or used to target you. They are never sold, and never used for insights sold to shops, unless you first give a separate, explicit opt-in for that and this policy has been changed to say so	Consent: you choose to add them, and clearing a field and saving withdraws it	Until you clear them or delete your account
Sign-in through Google or Apple. Your email address, name and profile photo from Google. From Apple, your email address or a private relay address, and your name the first time you sign in.	To sign you in without a password	Contract	Until you delete your account
Your receipts. The photo, the merchant and its address and map location, the date, the items, the totals, taxes and tips, the currency, payment details printed on the receipt (such as the last four digits of a card), and the tags, folders, categories, notes and workspaces you add	This is the product: storing, organising, searching and exporting your receipts	Contract	Until you delete the receipt or your account
AI reading of a receipt photo. The photo and the text your phone recognised in it	To fill in the receipt for you. See section 3	Contract: reading the receipt is the service you asked for when you allowed AI reading and scanned it. If a receipt reveals something about your health or another special category of data, such as a pharmacy purchase, we rely on your explicit consent (Article 9(2)(a) GDPR), which the AI reading question asks for. You can change it at any time (section 3)	Tab keeps the result as part of the receipt. For what Google keeps, see section 3
Sharing and bill splits. Who you shared with, their and your display name, username and profile photo, an optional message of up to 280 characters, each person's share of the bill, and the receipt itself	To share a receipt or split a bill when you ask us to	Contract	A share lasts until you stop it, the other person removes it, or either account is deleted. An unanswered share request expires after 14 days, a share link after 7 days and a split link after 30 days, or after 12 months while its guest has asked Tab to keep it for their email (section 5). We delete expired requests, links and pending claims 30 days after they expire.
How you get paid. If you add them under Getting paid: your Revolut Revtag, PayPal.Me name, $Cashtag or Monzo.me name, a Zippay mobile number, and whether to show the Zippay number on guest links (off unless you turn it on)	So the people you split a bill with can pay you in their own payment or banking app. Your Revtag, PayPal.Me, $Cashtag and Monzo.me names are shown to them, including on a guest link you send; your Zippay number is shown to people on Tab in your splits, and on a guest link only if you turned that on. A Revolut link takes the payer to Revolut with your Revtag, the amount and a note such as "Tab: Wingstop". Tab never receives, holds or sends the money and sees no bank or card details	Contract	Until you remove them or delete your account
Push notifications. A push token that identifies your app installation, your phone's platform and device name, the title and text of each notification, and a delivery log	To tell you about a share, a split, a finished export or a sync problem	Contract for notices about things you or another user did. Legitimate interests (telling users about changes to the service) for announcements, which you can turn off	The token: until you sign out, the token is replaced, or you delete your account. Delivery logs: 30 days.
App updates. Your IP address, the app's version and platform, and a random update identifier, sent when the app checks for an update	To deliver fixes to the app	Contract. The app cannot be kept working without it	Tab keeps none of this. Expo's privacy policy sets no fixed period: it keeps information only as long as reasonably necessary
Crash and error reports. Your user ID, app and operating system version, the screen and action involved, and the technical error. We strip personal details out before a report is sent. Reports never contain receipt photos or amounts	To find and fix faults	Legitimate interests: keeping the service you use working. On unless you turn off Send crash reports in Settings	90 days. Deleted with your account if that comes sooner.
Usage analytics. Your user ID, the name of an action (for example "receipt saved"), a few details about it, your platform and app version. It is collected by Tab itself. There is no third-party analytics tool, no advertising identifier and no device identifier. If you made your account after following a shared receipt or split link, Tab also records that you did and which of the two kinds of link it was: never which link, whose receipt or who sent it	To understand which parts of the app are used and where people get stuck	Consent. Off until you turn on Share usage analytics in Settings	14 months. Timing measurements (how long the app took to open or load a screen, and how smoothly it drew) 45 days, except the first of each kind in each month, which is kept for 14 months like the rest; the daily totals made from them name no one and are kept. Deleted with your account if that comes sooner
Days you opened Tab. Your user ID and the date (UTC) of each day you opened the app. Nothing else: no time of day, no device, no count, no record of what you did	To count how many people use Tab, which we need to run and fund the service. It is not analytics and is not shared	Legitimate interests: knowing how many people use the service. It is the least that can be kept to count them, and it is collected whatever you choose for usage analytics	14 months. Deleted with your account if that comes sooner
Receipts you email to Tab. A receipt you forward to your own Tab address: the email, its sender and its attachments	To turn it into a receipt in your library	Contract	The receipt it becomes is kept like any other. The email's files are deleted when your phone takes the receipt, and the record of the email 30 days after it arrived
Support messages. Your email address, username, display name, the subject and message, your platform and app version	To answer you and keep a history of the conversation	Legitimate interests: answering the people who write to us. Contract where you ask for help using the service	24 months after the last message. Deleted with your account if that comes sooner
Business enquiries from our website. Your company name and work email address, from the form on tabreceipts.com	To reply	Legitimate interests: responding to enquiries	24 months after we have dealt with it
Tips through Support Tab. If you give a tip on tabapp.link/support-tab, Revolut takes the payment on its own page and shows us the amount, the date, the note if you wrote one, and the payer details Revolut displays to a business for a card payment (such as the name on the card and its last four digits). We never see your full card details	To keep the company's accounts, and to refund or answer a dispute	Legal obligation: keeping accounting records; legitimate interests: handling refunds and disputes	Six years after the end of the financial year the tip falls in, as company accounting records must be kept
Rate limiting and abuse prevention. Your user ID, which function was called, and a counter; and if a limit stops you, a record that it did (which limit, and when)	To stop the service being overloaded or abused, and to see an account that keeps reaching its limits so we can raise them or, rarely, reduce that account's limits. If we reduce yours, the app tells you	Legitimate interests: protecting the service and its users	Counters are cleared automatically shortly after each time window ends; records of being stopped after 30 days
Receipt history log. For each receipt, a list of events (created, edited, shared, deleted) with times	To diagnose sync and data-loss problems	Legitimate interests: being able to work out what happened to a receipt when something goes wrong	See section 10 for what remains after deletion
Problem reports about a receipt. When you use Report a reading problem on a receipt: what was wrong, your note, a copy of how the receipt was read, the receipt's photo, and your app version and platform. Card digits and payment references are left out of the copy	To improve how receipts are read	Legitimate interests: fixing reading errors you told us about	24 months after you sent it or we last reviewed it. Deleted with your account if that comes sooner
Operator actions log. A record of each action a Tab operator takes on an account	Security and accountability	Legitimate interests: being able to show who did what	24 months
Backups. A weekly copy of the whole database and of the stored images	To recover from data loss	Legitimate interests, and our legal duty to be able to restore personal data after an incident	Four weeks
Requests under data protection law. Your request and our reply	To answer you and to show that we did	Legal obligation	Three years after the request is closed, so that we can show how it was handled if that is ever questioned

Tab does not send marketing email. If that changes, we will ask for your consent first.

Things on receipts we do not go looking for. A receipt can reveal sensitive things: a pharmacy purchase, a donation, a trade union subscription. Tab stores what is printed on the receipt because you asked it to. It does not try to work out anything about your health, beliefs or private life from your receipts, and it does not use them to build a profile of you.

Your contacts, only when you use them. Tab reads your address book only if you choose Find friends and allow it. Your phone turns each number into a code (a SHA-256 hash) and sends only the codes, which Tab's server compares with the numbers of people on Tab who chose to be found. Readable numbers and names never leave your phone, and nothing from your contacts is stored. A code made from a phone number can be turned back into the number by someone who tries every possible number, so the codes protect against casual exposure, not a determined attacker. When you share a receipt or split a bill you can also pick one person in your phone's own contact picker: Tab reads only that person, on the phone, to use their first name for a guest and their number to open your messages, and keeps nothing about them beyond the guest name you choose to keep. On Android both need permission to read your contacts, which Tab asks for only after saying why. We rely on contract for finding the friends you asked to find, and on your and our legitimate interest in doing so for the numbers of the people in your contacts.

Being found by your number. If you add a phone number to your profile, Tab asks once, after you first use Find friends, whether people who have your number may find you the same way. Nobody can find you by your number until you say yes (consent), and you can change it at any time under Profile details with Discoverable via contacts.

What happens. When you scan a receipt, Tab sends the photo to Google Cloud's Vertex AI service, where Google's Gemini model reads it and sends back the merchant, the date, the items and the totals. Alongside the photo Tab sends the text your own phone recognised in the image, which helps the model get it right. Tab also tells the model your preferred language, your country and your default currency, so that it reads dates, numbers and currencies the way you would. Nothing else about you or your other receipts is sent: your name, email address and user ID are not part of what the model is sent.

Where it runs. In Google Cloud data centres in the European Union.

Looking up a shop. When a receipt is from a shop Tab has not seen before, Tab's server sends the shop's name and the address printed on the receipt, and nothing about you or the rest of the receipt, to find the shop's website, logo and address. It asks Google's Gemini model with Google Search, which may run in any of Google's regions and which Google logs for up to three days, and Anthropic's Claude, which searches the web. Anthropic deletes what it is sent within 30 days unless it flags it under its usage policy; Tab's own Anthropic account keeps a record of each look-up.

What Google keeps. Google acts on our instructions, under a data processing agreement. Google does not use your receipts to train its models. We have switched off Google's short-term caching, so Google does not keep the photo or the result after the request has been answered. Google's abuse monitoring may log a request for up to 90 days if its automated safety checks flag it, which should be rare for a receipt.

Your choice. Tab asks your permission before your first scan, and the question says that receipts can show private things about you, such as your health, money or beliefs, and that allowing AI reading covers those too. A receipt can reveal special categories of personal data under Article 9 GDPR: data concerning your health (for example, a pharmacy or clinic receipt), your religious or philosophical beliefs, your political opinions, trade union membership, your racial or ethnic origin, or your sex life or sexual orientation. We read receipts with AI only with your explicit consent under Article 9(2)(a) GDPR, which you give by choosing Allow AI reading or by turning on Read receipts with AI. Receipts also show financial details, such as what you bought, where, the amount and the last digits of the card used; these are not special-category data, and AI reading reads them on the same basis as the rest of the receipt. If you choose Fill in by hand, nothing is sent to Google and you type the details yourself. You can change your mind either way at any time in Settings, under Privacy and security, with Read receipts with AI. Turning it off does not remove what was already read into your receipts; you can edit or delete those yourself.

It can be wrong. The AI makes mistakes: a misread total, a wrong date, a missing item. Everything it fills in can be edited, and you should check figures before relying on them.

No automated decisions about you. Tab makes no decision about you by automated means that has a legal effect on you or affects you in a similarly significant way. The AI reads a piece of paper. It decides nothing about anyone.

Sharing with another Tab user. When you share a receipt, the other person sees the receipt, including its photo, and your display name, username and profile photo. Their access is view-only. You see their display name, username and profile photo. Either of you can end it: you with Stop sharing, they by removing the receipt from their own library.

Splitting a bill with other Tab users. Each person sees the receipt, the items assigned to them and the amount Tab worked out as their share, along with any message you wrote. Cancel split ends it for everyone.

Splitting a bill together, live. You can start a live split and let the people at the table tap their own items, in Tab or in a web browser. Everyone who joins, and anyone who opens your link or scans your code, sees the shop's name, the date, the currency, each item's name, quantity and price, and the bill's tax, tip, fees, discount and total. They never see the photo, your notes, the shop's address, your card or the category. They see each other's names and initials; people on Tab also see each other's profile photo and username, as they would on any split. Tab deletes the items and everyone's taps the moment you send or cancel the split, and deletes the rest (names, and the share each person was sent) 72 hours later; a split nobody touches for 12 hours is deleted outright. Anyone with the link can join until you turn off New people can join, send or cancel, so share it only with the people at the table. You can take anyone off.

Shared workspaces. If you invite people to a workspace, or join theirs, every member can see and edit every receipt in it, photos included, and sees the other members' names, usernames and profile photos. Each receipt stays owned by whoever added it, and only they can delete it. If you leave, or are removed, your receipts go back to your own workspace and the others stop seeing them.

Links for people who do not have Tab. You can create a link and send it yourself, by any messaging app you like. Be aware of what a link is:

• A share link lets whoever opens it view the receipt in Tab. It expires after 7 days.
• A split link opens a page with the receipt's title and merchant, the items and amounts in that person's share, your message, and a web address for the receipt image. Since 28 September 2026 those details are kept with the link on Tab's servers and the link itself is a short code; links sent before then carry the details inside the link. Either way, anyone who has the link can read those details, so send it only to the person it is for. You may give a guest a first name (it is optional; without one they are shown as "Guest 1", "Guest 2" and so on). The name goes into their link, so they see it when they open it, and Tab keeps it with the link so your split still shows it on your other devices. Tab does not ask for a guest's phone number or email address. The part of the link that lets someone claim their share in the app expires after 30 days.
• Once you paste a link into a chat, a copy lives in that chat. Tab cannot reach it or delete it there. Stopping the share in Tab stops the link from giving access to the receipt in the app.

Sending receipts to your expense app. If you connect an expense app (Xero, Dext, Expensify, SAP Concur or Emburse Professional) or an email address such as your accountant's, Tab emails it the receipts you choose: those in the workspace or paid with the cards you picked, and any you send by hand. Each email carries the receipt's photo (or a PDF of its pages or details), the shop, date, total, VAT, the last four digits of the card if the receipt printed them, the items and your note, from an address Tab makes for you (r-…@expenses.tabreceipts.com) with your display name. Nothing is sent before you connect an app and choose what it receives, a receipt shared with you is never sent, and an accountant receives nothing until they reply to accept. Once a receipt reaches the app it is held under that app's own terms; Tab cannot delete it there. Expensify and SAP Concur ask you to add Tab's address to your account, and send a code to it; Tab shows you the code and deletes it after 30 minutes. You can pause or disconnect an app at any time.

Tab may handle a little data about you even if you have never installed it.

Someone sent you a share link or a split link. When you open it, the page at tabapp.link is served by Cloudflare, which sees your IP address and your browser type, as any website does. Tab does not store them. Tab counts that a share or split page was opened, as one more in that day's total for that kind of link, and keeps nothing else about the visit: not the link, not your address or browser, nothing that could tell the visit apart from any other. The person who sent the link did not give Tab your phone number or email address. If they split a bill with you as a guest, they may have typed your first name, so that you and they see it instead of "Guest 1". Tab keeps that name with the link, where only the sender can read it, and it is in the link you were sent. We rely on the sender's and our legitimate interest in making a split readable. It goes when the link does, or when the sender deletes the receipt or their account; to have it removed sooner, write to support@tabreceipts.com with the link.

Someone invited you to split a bill live, and you joined in your browser. Tab asks only for your first and last name, which the payer and the others in the split see. Your browser makes a random code that tells Tab it is you; Tab keeps only a scrambled form of it, and the code stays in your browser. Tab keeps your name and your taps while the split is open, and your name and the share you were sent for 72 hours after the payer sends it, then deletes them. If the payer sends the split, you get a guest link to your share, the same as any guest (above). We rely on the payer's and our legitimate interest in letting the people at the table split the bill. If you tap Get Tab, Tab adds one to that day's count of taps and keeps nothing else about it.

You asked Tab to keep a split for your email. After you finish picking in your browser, or once the bill is sent, Tab may offer to keep the bill for you. If you give an email address, Tab emails it a six-digit code; until you enter the code, nothing is kept for that address and it is deleted within 24 hours. Once you confirm it, this split and every later split you join as a guest in that browser are kept for the address, and when you sign up to Tab with it they are in your account. Tab stores the address encrypted, with a scrambled form used only to match it, and never tells anyone whether an address is known. It sends that address three kinds of email only: the code, one email with your share after each split is sent, and one warning a month before deletion. If you never sign up, Tab deletes the address and what it holds 12 months after the last split kept for it. "Not this one" stops a split being kept; signing up, or deleting the account that uses the address, deletes it at once. Your browser keeps the address and a random key so it does not ask again. We do this because you asked us to, as a step before you become a user. To have it removed sooner, write to support@tabreceipts.com with the address.

You typed your email address into a share page. If you do not have Tab yet, the page offers to attach the shared receipt to your account when you sign up. If you enter your email address, Tab stores it, in lower case, next to the link it belongs to, for that one purpose. We rely on our legitimate interest in doing what you asked for. Tab does not email this address. The address is deleted 30 days after the link expires if you have not signed up. To have it removed sooner, write to support@tabreceipts.com from that address.

Your name is on someone's receipt. A receipt may show a cashier's first name, the name of a sole trader, or a name written on a bill. Tab stores it as part of the receipt, because the user asked us to keep their receipt. We do nothing else with it.

You emailed us. We keep your message and address so that we can reply, for 24 months after the last message.

Your number is in a Tab user's phone. If that person uses Find friends, their phone turns your number into a code and Tab's server compares it with the numbers of people on Tab who chose to be found. If you are not on Tab there is nothing to match, and the code is not kept. We rely on the user's and our legitimate interest in finding friends who are already on Tab.

You have the same rights as a user (section 12). Write to support@tabreceipts.com. We will need enough to find your data, such as the email address you entered or the link you were sent, and nothing more.

Tab uses a small number of companies to run the service. Each handles your data to provide its service to Tab, under that company's own data protection terms, which section 7 names. Most of them act only on our instructions, as our processor; where a company does not offer processor terms for the account Tab uses, the table says so. While Endive Limited was being set up, several of these accounts were opened by its two owners, Tom Haran and Mark Turley, in their own names. They are used for Tab on the company's behalf, and they are moving into the company's name.

Company	What it does for Tab	What it receives	Where
Supabase (Supabase Pte. Ltd, Singapore), hosted on Amazon Web Services	The database, sign-in and file storage behind the whole app	Everything in section 2	Stockholm, Sweden (AWS region eu-north-1)
Google Cloud (Google Cloud EMEA Limited, Ireland)	Reads receipt photos with AI (section 3)	The receipt photo (for a PDF, pictures of its pages, made on your phone) and the text your phone recognised in it	European Union
Expo (650 Industries, Inc., United States)	Sends push notifications and delivers app updates	Your push token and the title and text of each notification; for updates, your IP address and app version	United States
Resend (Plus Five Five, Inc., United States)	Sends email: support messages to our inbox, account emails such as sign-up confirmation and password reset, and the receipts you send to an expense app; receives the codes and replies those apps and people send back, and the receipts you forward to your own Tab address	Your email address and the content of the email; for an expense app, the receipt you send and the address it goes to; for a forwarded receipt, the whole email you forwarded	United States
Cloudflare (Cloudflare, Inc., United States)	Serves the share-link pages at tabapp.link, the website at tabreceipts.com, and mcp.tabreceipts.com, where an AI app you connect signs in to Tab (see below). The account is held by Mark Turley, one of Endive Limited's two owners	Your IP address, browser type and the link you opened; your email address if you type it into the page	Cloudflare's network, at the location nearest you
Google Maps Platform (Google Cloud EMEA Limited, Ireland)	Suggests addresses as you type your own address in Profile details	The text you type, the country you chose and a random id for the search, from Tab's server, with nothing else about you. Tab keeps only the address you pick	Google's network; Google does not state a region for this service
Revolut (Revolut Bank UAB, Irish Branch)	Takes a tip given through Support Tab, on its own checkout page, and pays it into the company's account	Only if you give a tip: your card or wallet details and what you type on its page; Tab sends Revolut nothing	The European Economic Area
Vercel (Vercel Inc., United States)	Hosts the dashboard the people who run Tab use to look after the service (section 8)	What the dashboard shows as its pages are built: account details such as a partly hidden email address, usage counts, and problem reports you send. Nothing is stored there. Vercel offers processor terms only on its paid plans, and Tab's dashboard is on its free plan, so Vercel handles this under its own privacy policy	Stockholm, Sweden (Vercel region arn1)
Google (Gmail)	Holds our support inbox: mail to support@tabreceipts.com is forwarded by Cloudflare to a Gmail account, and we reply from it	Emails you send us and our replies	Google's data centres, which may be outside the EEA
Apple (Apple Distribution International Ltd, Ireland), through iCloud	Holds a synced copy of our weekly backups. Each backup is encrypted before it leaves our computer, and Apple does not hold the key, so it cannot read them. Apple acts under its own iCloud terms, not as our processor	Encrypted backup files only	Apple's and its suppliers' data centres, which may be outside the EEA

When a push notification is delivered, Expo passes it to Apple (for iPhones) or Google (for Android phones), because that is the only way a notification can reach a phone.

Companies that act for themselves, not for us. If you sign in with Google or Apple, that company handles the sign-in under its own privacy policy and tells Tab who you are. You can remove Tab's access in your Google or Apple account settings. If you sign in with Apple, Tab's server keeps a token Apple gives it, so that when you delete your account Tab can tell Apple to revoke the connection; the token is deleted with the account.

Services that receive no personal data. To place a merchant on a map, Tab sends the merchant's address, with nothing that identifies you, to OpenStreetMap's Nominatim service. To find a chain's logo when its own website has none, Tab looks the shop's website up on Wikidata and fetches the logo from Wikimedia Commons, again with nothing about you. If Nominatim cannot be reached, the same address goes to komoot's Photon service. To convert currencies, Tab sends currency codes and dates to the Frankfurter exchange-rate service. To find a shop by name on a map, Tab's server sends the text you search for and an approximate map position to search around (to about 1 km), with the size of the area on screen, to Apple's Maps Server API, with no account id or anything else about you; Tab keeps nothing Apple sends back except, when you choose a place, Apple's identifier for it.

The map on a shop's page, on Android. Your phone loads that small map straight from Google, so Google sees your phone's internet address and the area around the shop. The point shown is the shop's, never yours, and Tab's map key names Tab, not you.

The map you choose a shop on. When you open the map to choose where a receipt is from, your phone loads the map straight from Apple (MapKit JS), so Apple sees your phone's internet address, the part of the map you look at and the places you tap. If you let Tab use your location, the map starts near you, so that part of the map is near you. Tab's map token identifies Tab, not you: no account id, email or receipt goes to Apple. Apple handles these requests under its own privacy policy, and it publishes no retention period for MapKit JS, so we cannot tell you how long it keeps them.

Other people, when you choose. The people you share a receipt or split a bill with, and the expense apps or accountant you connect (section 4). An expense app handles your receipts under its own privacy policy.

An AI app you connect, when you choose. If you connect an AI app such as Claude (Anthropic) or ChatGPT (OpenAI) to Tab, and approve it on your phone, that app can read your receipts while it is connected: their shops, dates, totals, items, tax, notes, categories, tags, folders and split shares, with the names you gave the people you split with. It never receives your photos, your card numbers beyond the last four digits, or anyone's email address or phone number. If you allow it to organise, it can also file, tag and tidy your receipts and add receipts it finds, and you can undo what it changes for 30 days. The AI company handles what its app reads under its own terms and privacy policy, not ours, and we cannot delete what it has received. On ChatGPT's personal plans, OpenAI may use what an app gives it to train its models while your "Improve the model for everyone" setting is on. Nothing is sent until you connect an app, and you can disconnect it at any time in Settings, then Privacy and security, then Connected apps.

When the law requires it. We will disclose data if a court or an authority with the power to demand it requires us to, and we will tell you unless we are forbidden to.

We do not sell your data, share it for advertising, or pass it to data brokers. If Tab is ever transferred to another owner, we will tell you before your data moves, and you will be able to delete your account first.

Your receipts are stored in Sweden. Some of the companies above are based outside the EEA, or can reach the data from outside it, so the law requires a safeguard for each.

Company	Transfer	Safeguard
Supabase	The data stays in Sweden. Supabase is a Singapore company and its staff may access systems from outside the EEA to run the service	The European Commission's standard contractual clauses, which form part of Supabase's data processing agreement
Google Cloud	None for receipt photos: they are processed in the EU. Google may access systems from outside the EEA to run the service	Standard contractual clauses between Google and its sub-processors, under Google's Cloud Data Processing Addendum. Google LLC is also certified under the EU-US Data Privacy Framework
Expo	Push tokens, notification text and update requests go to the United States	Standard contractual clauses (module two), which Expo's terms of service build in for every account, and Expo's certification under the EU-US Data Privacy Framework
Resend	Emails go to the United States	Resend's certification under the EU-US Data Privacy Framework, with standard contractual clauses in Resend's data processing agreement
Cloudflare	Traffic is handled at the nearest Cloudflare location and may be processed in the United States	The EU-US Data Privacy Framework and standard contractual clauses, both in Cloudflare's data processing agreement, which the account holder accepted with Cloudflare's terms
Vercel	Dashboard pages are built in Stockholm; Vercel, a US company, may reach them from the United States	Vercel's certification under the EU-US Data Privacy Framework
Google (Gmail) and Apple (iCloud)	Our support inbox and our encrypted backups may be stored outside the EEA	Each company's own safeguards under its consumer terms. The backups are encrypted with a key Apple does not hold

You can ask us for a copy of the safeguard that applies to any of these: write to support@tabreceipts.com.

Tab is offered in the European Union and the European Economic Area.

Tab is run by a very small team. Day to day, Tab's team sees totals and account events, such as when a receipt was added or synced, and never what your receipts say: the tool we use to run Tab does not show a receipt's contents. Because we run the database your account lives in, we can reach your data directly, and we do so only when you ask us for help, or to investigate a fault, a security problem or abuse, and we keep a record each time. When you report a problem with a receipt, we see the details and the photo you send with the report. Each action taken through Tab's operator dashboard is also recorded in a log.

Two people hold keys that reach the whole database: Tom Haran and Mark Turley, Endive Limited's two owners. Such a key is also kept, as a secret setting, in two services that need it: the Cloudflare service behind tabapp.link, which runs on Mark's account, and the hosting of Tab's operator dashboard at Vercel. No person outside Endive Limited holds one.

Your receipts are encrypted in transit and while stored, but they are not end-to-end encrypted: Tab's servers can read them, which is what allows search, sharing and AI reading to work.

Tab keeps a copy of your receipts in a database on your phone, so that the app works offline and opens quickly. Your sign-in session and your passcode settings are held in your phone's secure storage (the iOS Keychain or the Android Keystore). If you turn on Passcode lock, Face ID or fingerprint checks are done by your phone; Tab never receives your biometric data. Signing out or deleting your account clears Tab's data from the phone, as does uninstalling the app.

On Android, Tab's data is left out of your phone's backup to your Google account and of transfers to a new phone. On iPhone, Tab's copy of your receipts is part of your phone's own backup to iCloud or to a computer if you make one; that backup is yours, held by Apple under your Apple account, and Tab cannot reach it.

The law also gives you a say over what an app reads from your phone and sends elsewhere:

• Needed for the service, so no consent is asked: your session, your receipts, the push token once you have allowed notifications, and update checks.
• Crash reports: on unless you turn them off in Settings, under Privacy and security, with Send crash reports.
• Usage analytics: off unless you turn them on in Settings, under Privacy and security, with Share usage analytics.

Permissions. Tab asks for the camera when you photograph a receipt or scan a friend's QR code; for notifications if you want them; for your contacts only when you use Find friends, or on Android to pick a contact (section 2); and for your approximate location, only while you use the app and only when you open the map to choose where a receipt is from, where it centres the map and is never saved. On iPhone it can also ask for Face ID if you turn on Passcode lock. Choosing a photo from your library uses your phone's own picker, so Tab sees only the photo you pick. Tab never asks for the microphone. If you turn on Offer to share on screenshot, Tab notices when you take a screenshot of one of your own receipts. On Android the option needs Android 14 or later and no access to your media.

Our websites: cookies and browser storage. Tab sets no cookies on tabreceipts.com and uses no analytics or advertising tools there. If you send the business enquiry form, the page loads the code that sends it, which can keep a sign-in record in your browser's local storage; the form never signs you in, so nothing about you is kept there. On tabapp.link a page stores something in your browser only when you use a feature that needs it: a random code that tells Tab you are the same person in a live split you joined, the email address and a random key if you asked Tab to keep your splits for that address (section 5), and your sign-in if you sign in to Tab on the page. The dashboard the people who run Tab use sets sign-in cookies and remembers a light or dark theme. Each of these is strictly necessary for something you asked for, so under the Data Protection Commission's guidance on cookies no consent is needed, and Tab shows no cookie banner.

The table in section 2 gives the period for each kind of data. This section covers deletion.

Deleting a receipt. Delete a receipt and it is removed from Tab's servers the next time your phone syncs. Its photo stays in storage for 14 days, in case the deletion was a mistake, and is then removed the next time Tab syncs on one of your phones. If you never open Tab again, the photo is removed when your account is deleted.

Deleting your account. In the app, tap your photo at the top left, then Profile details, then Delete account at the bottom. The app shows you what will be deleted and asks you to type DELETE. If you no longer have the app, use https://tabreceipts.com/delete-account.

• Days 0 to 30: the grace period. Your account is scheduled for deletion and you are signed out. Nothing has been deleted yet. If you sign in again within 30 days, Tab shows Account scheduled for deletion and a Cancel deletion button, which restores the account as it was.
• After 30 days. A daily job permanently deletes your account: your profile, your receipts, their photos and your profile photo, your tags, folders and workspaces, your shares (people you shared with lose access), your push tokens, your analytics, the record of days you opened Tab, your support messages, your problem reports, and any pending share claims addressed to your email. If you used Sign in with Apple, Tab asks Apple to revoke the connection first. We email you to confirm when it is done.
• Backups. We take a backup of the database and the stored images each week and keep each one for four weeks. A deleted account therefore remains in our backups for up to four weeks after it is permanently deleted, and then expires with them. We do not restore a deleted account from a backup. If we ever had to restore the whole service from a backup, an account that had asked in the app to be deleted would be deleted again by the same daily job, because its request is in the backup too.

What remains after your account is deleted.

• The receipt history log, stripped. For each receipt you had, the log keeps the type of each event (for example "created" or "deleted") and its time. Your user ID is removed from these rows wherever it appears, their details are emptied, and the receipt they refer to no longer exists. We keep them so that we can tell a deliberate deletion from lost data when investigating a fault, and we delete each one 24 months after the event it records. The same applies to the history of any receipt you delete while you still have your account.
• Crash reports. None. Crash reports linked to your account are deleted with it.
• The operator actions log. If a Tab operator acted on your account, the record of that action stays for 24 months. It holds your account's ID, what was done, when and by which operator, and for a deletion the storage names of the deleted files, which are made of account and receipt IDs. It holds no email address, name or receipt content.
• Copies held by other people. A receipt you shared stops being available to the other person, and the notification that told them about it is removed. A bill you split is different: if the other person accepted it, they keep their own copy of their share (the shop, the date, their items and the amount), with no photo, notes, card details, name or account ID of yours, because it is their record of money between you. A notification you caused in someone else's inbox keeps its wording, with "A deleted account" where your name was. A link you pasted into a chat stays in that chat, though it stops giving access.
• Your old usernames. A username you change away from is held for you for as long as you have your account, so nobody else can take it and receive what was meant for you, and so you can switch back to it. When you delete your account, your usernames are held for 30 more days, without anything saying whose they were, and then deleted.

Traffic between the app and Tab's servers is encrypted. The database and the stored images are encrypted at rest. Database rules limit every account to its own data, and a shared receipt to the people it was shared with. Receipt photos sit in a private storage area and are served through short-lived links. Crash reports are scrubbed of personal details before they leave your phone. Secret keys are kept out of the app. You can add a passcode lock with Face ID or fingerprint.

No system is perfectly secure. If a breach of your data is likely to put you at high risk, we will tell you without undue delay, and we will report breaches to the Data Protection Commission as the law requires.

You have these rights under the GDPR. None of them costs anything. For each, there is a way to do it yourself in the app where one exists, and you can always write to support@tabreceipts.com instead.

Right	In the app	By email
See your data (access)	Download my data, in Settings under Privacy and security, gives you one file of everything Tab holds about you: your account and profile, settings, receipts, shares and splits, connected apps and expense apps, support messages, analytics and logs. Other people appear in it only by the name Tab shows you. Your profile is under Profile details (tap your photo) and your receipts are in your library. Your receipt photos are in the archive: in Library, More, then Export receipts, then Export archive gives you a summary, a PDF of every receipt and the original photos	Ask for a copy, or for anything you think the file leaves out
Correct your data (rectification)	Edit your profile under Profile details. Open any receipt and choose Edit	Ask us to correct anything you cannot change yourself
Delete your data (erasure)	Delete one receipt with Delete, or everything with Delete account (section 10). Clearing Phone number in Profile details and saving removes your number	Ask us to delete your account or any particular data. https://tabreceipts.com/delete-account explains how
Take your data elsewhere (portability)	Download my data gives you the same file in JSON, a format other services can read. Export spreadsheet (CSV) gives your receipts as a spreadsheet	Ask us and we will send them to you as a JSON file, the same file
Object to anything we do on the basis of legitimate interests	Turn off crash reports in Settings with Send crash reports. Turn off push notifications for announcements in Settings, under Notifications, with From Tab; announcements still appear in the app's notifications list	Tell us what you object to. We will stop unless we have compelling grounds to continue, and we will tell you which
Restrict what we do with your data while a question about it is settled		Ask us
Withdraw consent	Turn off Share usage analytics in Settings, under Privacy and security. Turn off Read receipts with AI in the same place. Clear an optional profile detail in Profile details and save. Turn off Discoverable via contacts in Profile details. Withdrawing is as easy as agreeing was, and it does not affect what was done before	Ask us

How we handle a request. We answer within one month. If a request is complicated we may take up to two more months, and we will tell you within the first month if so. Send the request from the email address on your Tab account, so that we know it is you. We may reply to that address and ask you to confirm. We will not ask for identity documents. If you cannot use that address any more, we will ask you a few questions about the account that only its owner could answer.

Complaining to the regulator. You can complain to the Data Protection Commission, which supervises Tab:

Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland Web: https://www.dataprotection.ie — complaints form: https://forms.dataprotection.ie/contact Phone: 01 765 0100 or 1800 437 737

If you live in another EU or EEA country you can complain to your own data protection authority instead. We would like the chance to put things right first, but you do not have to give it to us.

• Required: an email address, or a Google or Apple account, because an account cannot exist without one. Without an account Tab cannot store or sync receipts.
• Optional: a profile photo, a phone number, your city, and the optional profile details in section 2. AI reading: without it you type receipts in by hand. Notifications: without them you find out about shares when you open the app. Usage analytics and crash reports: the app works the same without them.

Tab is not meant for children. You must be 16 or older to use Tab, which is the age of digital consent in Ireland. Tab does not check your age: your date of birth is an optional profile detail, never required. If we learn that an account belongs to someone under 16, we will delete it. A parent or guardian who believes their child has an account can write to support@tabreceipts.com.

When we change this policy in a way that matters, such as a new company receiving your data, a new purpose, or a longer retention period, we will tell you in the app before the change takes effect, and by email where the change is significant. We will not rely on you checking this page. Where a change needs your consent, we will ask for it. Small corrections that change nothing about how your data is handled are recorded in the history below.

Endive Limited, a company registered in Ireland, number 828414, 10 Nutley Lane, Donnybrook, Dublin 4, D04 X3D0, Ireland support@tabreceipts.com

In the app: tap your photo, then Help, and under Get in touch choose Contact us.

Version	Effective from	What changed
1.0	9 November 2026	First version