Privacy Policy

This policy explains how ClaimJar (ABN 75 331 735 840) ("we", "us") collects, uses, stores and protects your personal information when you use ClaimJar (the "Service"). We handle your information in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

What we collect

• Account details — your email address and, if you provide it, your name.
• Receipts & extracted data — the receipt images and PDFs you upload, and the data read from them (merchant, date, amounts, GST, ABN, line items).
• Optional profile info — your occupation and annual salary, if you choose to enter them, used only to sharpen category suggestions and tax-saving estimates.
• Payment info — handled entirely by our payment processor (Stripe). We never see or store your full card number.
• Usage & technical data — basic logs needed to run and secure the Service.

How we use your information

To provide the Service — reading your receipts, organising them, producing your exports — and to manage your account, process payments, respond to support requests, and keep the Service secure. We do not sell your personal information, and we do not use it for advertising.

AI processing of receipts

To read your receipts we send the image or PDF to a third-party AI provider (Anthropic, and/or OpenAI). This is used solely to extract the data for you. Under those providers' API terms, your content is not used to train their models. We do not use your receipts to train any model of our own.

Storage & security

Your data is stored with our infrastructure providers (Supabase for the database and file storage, hosted in an Australian region; Vercel for the application). It is encrypted in transit and at rest, and access is isolated per user by database security rules so no other user can see your data.

How long we keep it

Your extracted receipt data is kept while your account is active so your history and summaries keep working. How long we keep the original receipt files depends on your plan:

• Pro — we keep your original files for as long as your subscription is active, so you have them for the full five-year period the ATO expects records to be kept. You can delete any receipt yourself at any time.
• Free — original files are deleted 30 days after you export them, by which point your downloaded ZIP is your record. Files you have never exported are kept while your account is active.

You can delete individual receipts or your whole account at any time; deleting your account removes your data from our active systems.

Note: Australian tax law generally requires you to keep tax records for 5 years. Your exported ZIP is that record — please retain it.

Who we share it with

Only the service providers needed to run ClaimJar, acting on our instructions: Supabase (database, storage, authentication), Anthropic/OpenAI (receipt reading), Stripe (payments), Vercel (hosting and site analytics), Resend (account emails such as sign-in links and password resets), SendGrid (only if you use a Pro email-in address, which receives the receipts you forward), Sentry (error tracking), and Meta (advertising measurement on our marketing pages only). We may disclose information if required by law. We never sell it.

Overseas disclosure

Your database and receipt files are stored in an Australian region (Supabase, Sydney), but some processing happens overseas. Receipt images are read by AI providers (Anthropic/OpenAI) and payments are processed by Stripe, both in the United States. Our email providers (Resend, and SendGrid for Pro email-in addresses), our error-tracking provider (Sentry) and our advertising-measurement provider (Meta) also operate in the United States. Sentry receives technical diagnostic information only — we have configured it not to send your email address, IP address or request contents, and your receipts are never sent to it. We only use providers with strong contractual privacy and security commitments, and we take reasonable steps as required by APP 8 to ensure they handle your information consistently with Australian privacy law.

Direct marketing

We may occasionally email you about ClaimJar features or your account. Every marketing email has an unsubscribe link, and opting out never affects the Service. We don't give your details to anyone else for their marketing.

Data breaches

If a data breach involving your personal information is likely to result in serious harm, we'll notify you and the OAIC as required by the Notifiable Data Breaches scheme, and tell you what happened and what we're doing about it.

Your rights

You can access, correct or delete your personal information at any time from your account, or by contacting us. If you have a privacy concern you can contact us first; if unresolved, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Cookies & analytics

We use essential cookies to keep you signed in and to secure the Service. We also use privacy-focused product analytics (Vercel Analytics) to understand how the Service is used — for example, how many people who visit go on to create an account.

On our public marketing pages we use the Meta (Facebook) advertising pixel to measure how well our ads perform — for instance, whether someone who clicked an ad went on to sign up. This involves Meta setting cookies and receiving limited event data (such as page views and that a sign-up occurred). It runs on our marketing pages, not inside your account, and we never share your receipts, extracted data or financial information with Meta. You can limit this with your browser or device privacy settings, and through your Meta ad preferences.

Children

The Service is intended for adults (18+) managing their own tax records.

Changes & contact

We may update this policy from time to time; material changes will be notified in-app or by email. Questions or requests: privacy@claimjar.com.au.