Data Security & Privacy

Last updated: October 2, 2026

Where Is My Data Stored?

Your files are stored with Amazon Web Services in Frankfurt, Germany, with a backup copy in Stockholm, Sweden, and the app and its database run on Heroku in Dublin, Ireland. Some providers that help us run SparkReceipt process data outside the EU, mainly in the United States. These include OpenAI, which reads your documents, sorts the emails from inboxes you connect, categorizes and matches bank transactions, and powers SparkAgent, Google, whose Gemini API reads text from documents, Sentry, which receives error reports, Twilio SendGrid, which receives the emails you forward to SparkReceipt, and our payment providers Stripe and Paddle. For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, on an adequacy decision of the European Commission (for example for the United Kingdom), or otherwise on the European Commission's Standard Contractual Clauses.

The full list of subprocessors, with what each one receives and where it processes data, is in the Subprocessors table of our Privacy Policy.

Application servers — Heroku Common Runtime interfaces user applications with backend services. The main application database runs in the same Heroku region, with access secured through long, random, auto-rotating passwords managed by Heroku.

File storage — Data is processed within Heroku servers but stored in AWS, in Frankfurt, Germany, with a backup copy in Stockholm, Sweden.

Email relay (Brevo) — Functions as SMTP relay for all app email communications. Logs retained for 30 days and may contain data traces. Servers located in France and Belgium.

Inbound email (Twilio SendGrid) — Receives the emails you forward to your SparkReceipt email address and emails sent to our support. Located in the United States.

OpenAI — Servers located in the United States. Data processing agreement signed with Enterprise Privacy terms:

• Your data is NOT used to train current or future models
• Data deleted after 30-day retention period
• Users own both input and output

Document reading (Mistral AI, Google Gemini) — Read the text in document images and PDFs. Mistral AI processes data in the EU; the Gemini API runs on Google's global infrastructure. Neither provider may use your documents to train its models.

How Is My Data Protected?

Your data is encrypted with a strong cipher in both transit and at rest.

Data access at different levels:

• Database level — Admin access to Heroku restricted with strong password and multi-factor authentication
• File system level — AWS admin access restricted; AWS accessed only from application servers
• Admin tooling level — Limited visibility for customer support and monitoring. Access restricted with brute-force rate-limiting, strong password, and multi-factor authentication
• No outside entities have access to these levels

Can I Delete My Documents & Data?

Yes. Account auto-deletion removes all personal data from the live system. Data may persist up to 30 days in logs, database backups, and file system backups for disaster recovery only.

We Do Not Sell Your Data

We monetize SparkReceipt through paid subscriptions, nothing more. Our business model is simple: users who love the product upgrade to a paid plan for more monthly documents and power features.

We do not sell your receipt, invoice, or financial data, use it for advertising, or monetize it in any other way. Ever.

Is OpenAI Safe to Use?

The OpenAI API differs from the ChatGPT application. We have signed a Data Processing Agreement with Enterprise Privacy terms:

• Your data is NOT used for model training
• Data is deleted after a 30-day retention period
• Users own both input and output