Expendit Privacy Notice

Cuesoft is the controller of what Expendit holds at expendit.cuesoft.io, as set out in the privacy policy: Cuesoft Inc. and Cuesoft Nigeria Limited, as joint controllers, reachable at hello@cuesoft.io.

Expendit is open-source software. If you, or an organisation you work with, run your own copy, whoever runs it is the controller of the data it holds, and this notice does not describe it.

Who Can Use Expendit

Expendit is for people 18 and older. See children.

Signing In

• What we collect: you sign in with Google, the only way in. Expendit receives from Google your Google account identifier, email address and name.
• Session: a cookie that scripts on the page cannot read, valid for up to 24 hours.
• Legal basis: performing the contract you enter when you create an account (GDPR Art. 6(1)(b), and the equivalent contractual basis under the NDPA).

Your Books

• What we collect: the organisations you keep books for (a personal one is created for you, and you may add companies with their name and registered address), the people you invite to them with their email and role, your categories, and your transactions: description, amount, date and where each came from.
• For tax estimates: your tax identification number, state of residence, company registration number, national identification number, annual rent and the deductions you claim, as you enter them, and the estimates, statements and filing drafts Expendit works out from them.
• Who sees it: you, and the members you invite to an organisation, with the role you give them.
• Retention: until you delete it or your account.
• Legal basis: performing the contract (GDPR Art. 6(1)(b)).

Importing Statements and Receipts

• What happens: the file you upload (a CSV, spreadsheet, PDF or image) is read into transactions you review before anything enters your books.
• The file itself is deleted within an hour of being read or discarded, and our storage provider keeps a recovery copy for up to 7 more days. The import’s record (the file’s name, type and size, the rows it produced and a summary) is deleted 90 days after you confirm or discard it.
• Legal basis: performing the contract (GDPR Art. 6(1)(b)).

AI Processing

Expendit can use AI to read PDFs and images, suggest categories and write a short summary of an import. It does so only if you consent to AI processing; without that consent, images are refused and every other file is read without AI.

• What the AI receives: the text of a PDF statement, in parts; the image of a receipt or statement; the description and type of each transaction with your category names, to suggest a category; and, for the summary, totals only (the number of transactions, income, expenses, net and the top five categories). Spreadsheets and CSV files never go to AI.
• Who runs it: Google’s Vertex AI, inside our own Google Cloud project in the United States, acting as our processor. Google does not use what it receives to train its models.
• Withdrawing: you can withdraw AI consent in your settings, and imports after that are read without AI. Until the app records the withdrawal itself, email hello@cuesoft.io and we will record it for you.
• Legal basis: your consent (GDPR Art. 6(1)(a), and consent under NDPA s. 25).

Logs and Monitoring

Our servers keep operational logs of each request’s method, address and outcome, never the contents of your books. They are kept for no more than 30 days: see retention.

• Legal basis: our legitimate interest in running a secure, working service (GDPR Art. 6(1)(f)); you may object.

Where Your Data Is Held

Expendit’s services and files run on Google Cloud in Iowa, United States, and its databases are run for us by Aiven in DigitalOcean’s San Francisco region. See processors and platforms and international transfers.

Your Rights in Expendit

Email hello@cuesoft.io to get a copy of everything Expendit holds about you, to correct it, or to delete your account and its data. Every right, and how to exercise it, is on your rights.

We do not sell personal data, and Expendit carries no advertising tags.