Privacy Policy
Last updated: September 22, 2026
This Privacy Policy explains how VagaBill (“we”, “us”, “the app”) collects, uses, and protects your information when you use our mobile application.
Data controller: Luigi CAROLE, registered as a micro-entrepreneur (auto-entrepreneur) in France, SIRET : 98473396400022, based in 119 B RUE DE COLOMBES, 92600 ASNIERES-SUR-SEINE.
For any question about this policy or your data, contact us at support@vagabill.com.
1. What data we collect
Data you provide directly
- Account information: email address, authentication data (via our authentication provider, Clerk)
- Receipt photos: images you capture or upload to log an expense
- Expense data: merchant name, amount, currency, date, and category, either extracted automatically from your receipt photos or entered/edited manually
- Trip/mission data: names and date ranges you create to group your expenses
- Country and travel data: the countries and dates you record (manually or via device location, if you enable it) to power the day-counter feature (e.g. Schengen 90/180 tracking)
Data collected automatically
- Purchase data: records of in-app purchases (scan credit packs) processed through the Apple App Store or Google Play Store, and validated through our subscription management provider, RevenueCat. We do not receive or store your payment card details — these are handled entirely by Apple/Google.
- Basic usage and diagnostic data needed to operate and maintain the app (e.g. crash reports)
2. How we use your data
We use your data to:
- Provide the core functionality of the app: scanning and extracting expense data, currency conversion, trip organization, and country-day tracking
- Process your in-app purchases and manage your scan credit balance
- Provide customer support when you contact us
- Maintain and improve the security and reliability of the app
We do not sell your personal data, and we do not use your receipt or expense data for advertising purposes.
3. Third-party services we use
To provide the app’s functionality, certain data is shared with the following processors, each acting under their own privacy commitments:
| Service | Purpose | Data shared |
|---|---|---|
| Anthropic (Claude API) | AI-powered extraction of data from receipt photos | The receipt image itself, processed to return structured text (merchant, amount, currency, date) |
| Clerk | Authentication and account management | Email address, authentication tokens |
| RevenueCat | Purchase validation and entitlement management | Purchase receipts, anonymized user identifiers |
| Apple / Google | Payment processing for in-app purchases | Payment and billing information (collected directly by Apple/Google, not by us) |
| Cloudflare (R2) | Storage of receipt images | Receipt image files |
| Hostinger (France) | Hosting of our backend application and database | All app data described in Section 1, stored on our self-hosted servers |
Some of these providers (notably Anthropic) may process data outside the European Economic Area. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses to ensure your data remains protected in accordance with GDPR requirements.
4. Legal basis for processing (EEA/UK users)
We process your data on the following legal bases under the GDPR:
- Performance of a contract: to provide the app’s core features you’ve signed up for
- Legitimate interest: to maintain, secure, and improve the app
- Consent: where required, e.g. for optional location access used in the country-day tracking feature
5. Data retention
We retain your account and expense data for as long as your account remains active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain certain records for legal or accounting obligations.
6. Your rights
If you are located in the EEA, UK, or another jurisdiction with similar protections, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Request a copy of your data in a portable format
- Object to or restrict certain processing
- Withdraw consent at any time (e.g. for location access)
To exercise any of these rights, contact us at support@vagabill.com. You also have the right to lodge a complaint with your local data protection authority (in France, the CNIL).
To delete your account and the data attached to it, see Delete your account and data, which lists exactly what is removed and what we are required to keep.
7. Data security
We take reasonable technical and organizational measures to protect your data, including encrypted connections (TLS) between the app and our servers, and access controls on our infrastructure. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
8. Children’s privacy
VagaBill is not intended for use by children under 16. We do not knowingly collect personal data from children.
9. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by other appropriate means. The “Last updated” date at the top of this policy indicates when it was last revised.
10. Contact us
For any question, request, or concern regarding this Privacy Policy or your data, contact us at: