Privacy Policy

Welcome to smyat.ai.

Your privacy matters to us. This Privacy Policy explains what personal data we collect, how we use it, how long we keep it, and the choices and rights you have under applicable data protection laws, including the General Data Protection Regulation (GDPR).

By using smyat.ai, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Data Controller

The controller responsible for processing your personal data is:

UX Craft EOOD UIC (ЕИК): 207480881 20 Praga Blvd.

Bulgaria Manager: Svetoslav Obretenov Email: support@smyat.ai

2. About smyat.ai

smyat.ai is a service that helps users split restaurant bills and expenses by combining receipt scanning, optical character recognition (OCR), artificial intelligence, and collaborative bill sharing.

Our goal is to minimize the amount of personal data we process while providing the functionality of the service.

3. Information We Collect

Depending on how you use the service, we may collect the following information.

Account Information

When you create an account, we may collect:

• your name
• your email address
• your authentication identifier
• your profile picture (if provided by your identity provider)

Authentication is provided through Clerk.

Receipt Images

When you scan a receipt, we temporarily process:

• the uploaded image
• receipt text
• merchant name
• purchased items
• prices
• totals
• currencies
• timestamps contained within the receipt

Receipt images may incidentally contain personal information printed by merchants, such as loyalty numbers or partial payment details.

Bill Data

After processing, we may store:

• bill items
• prices
• participants
• item assignments
• settlement information
• optional notes

This information exists solely to provide the bill-sharing functionality.

Usage Information

We automatically collect technical information such as:

• device type
• operating system
• application version
• language
• approximate region
• IP address
• timestamps
• crash reports
• diagnostic information

Analytics We collect anonymous or pseudonymous analytics to improve the service.

Depending on your platform and settings, analytics may include:

• feature usage
• screen views
• performance metrics
• crash diagnostics
• application stability
• aggregated product analytics

PostHog and Vercel Speed Insights are activated in the web application only after explicit permission for product analytics. Firebase Crashlytics is activated in the mobile application only after separate permission for crash reports. Until the relevant permission is granted, these services do not collect analytics or diagnostic data through smyat.ai.

When product analytics is enabled, PostHog may receive a pseudonymous identifier, a temporary diagnostic identifier for the current app launch, feature usage, screen views, application version and platform, aggregated counts, and error or result categories. We do not send receipt images, OCR text, email addresses, phone numbers, payment data, or complete bill contents to PostHog.

When crash reports are enabled, Firebase Crashlytics may receive technical error details, application version, device and operating-system information, the temporary diagnostic identifier, categories for up to the last 12 in-app actions, and the Clerk profile identifier. The diagnostic trail is held in memory only and does not include receipt contents, names, amounts, or payment data.

Independently of these settings, the backend retains anonymous OCR operational metrics for up to 90 days: provider, success or failure category, processing stage, duration, and aggregate row counts. These records contain no user, profile, bill, receipt, or device identifier and no image, text, name, amount, or payment data.

You may change or withdraw either permission at any time through Privacy Settings in the web or mobile application. Withdrawal stops future collection, disables the relevant service, and resets the local analytics identifier. It does not affect essential smyat.ai functionality. To make a request concerning data already received, contact support@smyat.ai.

Optional Android advertising

In the Android app, you may choose to watch an advertisement in exchange for one automatic scan. The core features and manual entry work without watching ads. Before requesting an ad, we use Google User Messaging Platform (UMP) to present applicable consent choices and controls for your advertising preferences.

When you use the ad, the Google Mobile Ads SDK may collect and share your IP address and general location, ad interactions, diagnostic information, and device or account identifiers for ad delivery, measurement, and fraud prevention. Data is encrypted in transit. The ads available to you depend on applicable rules and the choices you make.

We do not send receipt images, OCR text, bill contents, your email address, or your Clerk profile identifier to AdMob. To confirm the reward, we send a temporary technical identifier for that viewing session. Google returns a signed confirmation to our server, which validates the reward and adds a credit to your account.

When UMP provides privacy controls, you can open them from Profile and history. These choices are separate from product analytics and crash-reporting settings. For more information about Google's processing, see its Privacy Policy.

4. How We Use Your Information

We use your information to:

• provide the service
• authenticate users
• process receipt images
• extract receipt information using OCR and AI
• synchronize bills across devices
• allow collaborative bill splitting
• detect abuse and fraud
• improve product quality
• analyze application performance
• diagnose crashes
• comply with legal obligations
• respond to support requests

We do not sell your personal data. When you voluntarily use Android advertising, Google processes the technical data described in the "Optional Android advertising" section for advertising, measurement, and fraud prevention.

5. Artificial Intelligence Processing

Receipt images may be processed using artificial intelligence technologies in order to:

• recognize receipt text
• identify purchased items
• classify products
• improve extraction quality
• generate structured bill data

AI processing is used solely to provide the requested functionality. AI-generated results are not guaranteed to be accurate. Users should always verify extracted information before relying on it.

6. Legal Basis for Processing

Depending on the processing activity, we rely on one or more of the following legal bases:

• performance of a contract
• legitimate interests
• legal obligations
• your consent, where required

7. Data Retention

We retain different categories of data for different periods.

Receipt Images

Uploaded receipt images are automatically deleted no later than 7 days after upload.

This limited retention period helps minimize personal data storage while allowing users to continue collaborating on recently created bills.

Account Information

Account information is retained while your account remains active.

Bill Data

Bill information is retained until you delete it or your account is deleted, unless longer retention is required by law.

Diagnostic Data

Crash reports and technical diagnostics may be retained for a limited period necessary to investigate technical issues and improve application stability.

8. Third-Party Service Providers

We use carefully selected third-party providers to operate the service.

These providers process data only as necessary to perform their services.

Current providers include:

• Clerk (authentication)
• Convex (application backend and data storage)
• OpenAI (AI-powered receipt processing)
• Vercel (web hosting)
• Vercel Speed Insights (aggregated performance metrics after explicit permission)
• Firebase Crashlytics (crash reporting after separate permission in the mobile application)
• PostHog (product analytics after explicit permission)
• Google Play Billing (payment processing for Android)
• Google AdMob / Google Mobile Ads / UMP (optional rewarded Android advertising, advertising preferences, measurement, and fraud prevention)

These providers may process personal data on our behalf under appropriate contractual safeguards. The processing of technical data by Google for optional advertising is described in the "Optional Android advertising" section. We do not provide receipt or bill contents to third parties for advertising or marketing purposes.

9. International Data Transfers

Some of our service providers may process information outside the European Economic Area.

Where international transfers occur, we rely on appropriate safeguards as required under the GDPR, including Standard Contractual Clauses or other legally recognized transfer mechanisms where applicable.

10. Data Security

We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, or destruction.

These measures include, where appropriate:

• encrypted communications
• authenticated access
• access controls
• secure infrastructure
• monitoring
• automatic deletion of temporary receipt images
• regular software updates

No internet-based service can guarantee absolute security, but we continuously work to maintain a high level of protection.

11. Your Rights

If you are located within the European Economic Area, you have rights under the GDPR, including the right to:

• access your personal data
• correct inaccurate information
• request deletion
• restrict processing
• object to certain processing
• receive your data in a portable format
• withdraw consent where processing is based on consent
• lodge a complaint with your local supervisory authority

To exercise these rights, contact: support@smyat.ai We may request additional information to verify your identity before fulfilling certain requests.

12. Children's Privacy

smyat.ai is not intended for children under the age of 16.

We do not knowingly collect personal information from children.

If you believe that a child has provided personal data to us, please contact us and we will promptly delete the information where required.

13. Cookies

Our website may use cookies and similar technologies necessary for authentication, security, and analytics.

For more information, please see our Cookie Policy.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When material changes are made, we will update the "Last updated" date and, where appropriate, notify users through the application or website.

Continued use of the service after such changes constitutes acceptance of the updated Privacy Policy.