Privacy Policy

AI Expense Notebook is developed and operated by Codematics Services (Private) Limited ("Codematics," "we," "us"), a software company based in Pakistan. The app is available on the Apple App Store (App ID: 6758518297) and Google Play Store (Package: codematics.expensetracker.spendly.expense.income).

This Privacy Policy applies to your use of the AI Expense Notebook mobile app on iOS and Android, the website at expensenotebook.codematics.co, and its blog at expensenotebook.codematics.co/blog.

For privacy inquiries: support@codematics.co

We collect only what is necessary to deliver the features you use. Here is exactly what that includes:

Data You Enter Directly

• Expense and income entries — amounts, currencies, dates, merchant names, notes, and categories (e.g. Food, Travel, Bills) that you add manually or that are auto-filled after a receipt scan
• Budget limits — the spending thresholds you set per category or overall
• Account credentials — if you create an account: your name and email address

Data Collected Automatically

• Device information — device model, operating system version, app version, and a non-personal device identifier
• App usage data — which features you use and general session behavior, collected in anonymized or aggregated form to improve performance
• Crash and error logs — technical diagnostics sent when the app encounters an error, used for debugging
• Approximate region — country-level location derived from IP address, used solely to set a default currency. We do not track GPS location

Camera and Receipt Images

When you use AI Magic Scan, we access your device camera only to capture the receipt image you point it at. See How AI Magic Scan Works for full details.

AI Magic Scan is the core feature that eliminates manual expense entry. Here is a transparent, step-by-step explanation of what happens when you scan a receipt:

1. You open AI Magic Scan and point your camera at a receipt
2. The app captures the image on your device
3. The image is sent to our AI processing layer, which reads the receipt and extracts: total amount, date, merchant name, and suggested expense category
4. The extracted data is returned to the app and pre-fills your expense entry form for your review and confirmation
5. Once processing is complete, the raw receipt image is not retained on our servers — only the data fields you confirm and save are stored

Camera access is requested only when you actively open AI Magic Scan. The app does not access your camera in the background or at any other time.

AI extraction achieves approximately 99.2% accuracy under good lighting. Always review extracted data before saving, as results may vary with low-quality, handwritten, or damaged receipts.

We use the data described in Section 2 strictly for the following purposes:

• To display your expense entries, budget progress, category totals, and spending reports inside the app
• To process receipt images through AI Magic Scan and return extracted expense data to you
• To send budget alert notifications when your spending approaches a limit you have set
• To sync your data across devices if you are signed into an account
• To diagnose app crashes and improve stability through anonymized error logs
• To analyze anonymized, aggregated usage patterns and improve app features over time
• To respond to support messages you send us
• To comply with applicable legal obligations

We do not use your personal expense data to build advertising profiles, sell to data brokers, or make automated decisions about your financial standing.

We apply industry-standard security measures to protect your data at every stage:

• Encryption in transit: All data exchanged between the app and our servers uses TLS 1.2 or higher
• Encryption at rest: Financial data stored on our servers is encrypted using AES-256
• Access controls: Only authorized Codematics personnel with a legitimate operational need can access user data, and all access is logged
• Receipt image handling: Receipt images sent for AI processing are deleted from our servers after extraction is complete — they are not retained in any image database

While we take every reasonable precaution, no system is completely immune to risk. In the event of a data breach affecting your personal data, we will notify affected users as required by law — within 72 hours where required under GDPR.

AI Expense Notebook uses a small number of carefully selected third-party services to deliver its core functionality. All third-party processors are bound by data processing agreements and may only use your data for the specific purposes we authorize.

• AI and ML processing: Powers AI Magic Scan receipt extraction. Images are processed temporarily and not retained after extraction
• Cloud infrastructure: Encrypted user data is stored on secure cloud servers with restricted access
• Crash diagnostics: Anonymized technical error logs may be sent to a diagnostic service to help us identify and fix bugs
• Analytics: Anonymized, aggregated usage data (not tied to your identity or financial records) may be shared with an analytics tool to understand app performance

We do not sell, rent, or trade your personal data. We share data only in these limited circumstances:

• Service providers: Vendors who help us operate the app (cloud hosting, AI processing, diagnostics), under strict contracts that prohibit them from using your data for any other purpose
• Legal obligations: If required by a valid court order, law enforcement request, or applicable regulation. We will notify you where legally permitted to do so
• Protection of rights: When necessary to prevent fraud, protect the security of the app, or protect users or the public from harm
• Business transfer: In the event of a merger or acquisition, users will be notified before data is transferred and before any change to this privacy policy takes effect

Depending on where you live, you have specific legal rights over your personal data. We honor all of the following rights for every user, regardless of location.

If You Are in the EU, EEA, or UK — GDPR Rights

Under the General Data Protection Regulation (GDPR) and equivalent UK law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure ("Right to be Forgotten") — request deletion of your account and all associated personal data
• Data Portability — request your expense data in a machine-readable, portable format
• Restriction of Processing — ask us to pause processing your data in certain circumstances
• Object to Processing — object where we rely on legitimate interests as our legal basis
• Lodge a Complaint — file a complaint with your local Data Protection Authority (DPA) if you believe we have mishandled your data

Our legal basis for processing: contract performance (to deliver app features), legitimate interests (app security and improvement), and consent (for optional features like push notifications).

If You Are in California — CCPA Rights

Under the California Consumer Privacy Act (CCPA), you have the right to:

• Know — request disclosure of what personal data we collect, use, and share about you
• Delete — request deletion of personal data we have collected from you
• Opt-Out of Sale — we do not sell personal data, so this right is automatically satisfied
• Non-Discrimination — we will never deny you service or treat you differently for exercising your privacy rights

To exercise any of these rights, email support@codematics.co. We respond within 30 days, or within the time-frame required by your applicable law.

We retain data only for as long as it is needed:

• Expense and income records: Retained until you delete them in the app or request account deletion
• Receipt images: Deleted from our servers immediately after AI extraction is complete — not retained in any database
• Account information: Retained while your account is active. Deleted within 30 days of an account deletion request
• Crash and diagnostic logs: Retained for up to 90 days, then automatically deleted
• Anonymized analytics: May be retained for up to 24 months in aggregated, non-identifiable form

When you request account deletion, all personal data is permanently removed from our active systems within 30 days. Anonymized or aggregated data that cannot identify you may be retained longer for statistical purposes.

AI Expense Notebook is not directed at children under the age of 13 (or under 16 in the European Economic Area, in line with GDPR Article 8).

We do not knowingly collect personal data from anyone below these ages. If you are a parent or guardian and believe your child has submitted personal data through the app, please contact us at support@codematics.co and we will delete that data promptly.

We may update this Privacy Policy as the app evolves or legal requirements change. When we make a material change:

• We update the "Last Updated" date at the top of this page
• We notify users via in-app notification or email for significant changes
• Where required by law (e.g. GDPR), we will seek renewed consent

Continued use of AI Expense Notebook after a revised policy becomes effective constitutes acceptance. If you do not agree, you may stop using the app and request deletion of your data at any time.

For privacy questions, data access requests, deletion requests, or complaints:

• Email: support@codematics.co
• Company: Codematics Services (Private) Limited
• App Website: expensenotebook.codematics.co
• Developer Website: www.codematics.co

We acknowledge all requests within 5 business days and resolve them within 30 days, or within the timeframe required by applicable law.