Privacy policy

This policy explains how we process the personal data of visitors to speseincasa.it and users of the Spese in Casa app, in accordance with Regulation (EU) 2016/679 (GDPR).

1. Data controller

Spese in Casa
Email: [email protected]

2. What data we process

• Account data: name, username, chosen colour, role and household. Passwords are only stored in encrypted form and cannot be read by anyone.
• Data entered in the app: expenses (amount, category, date, description, who paid, shared or personal), categories, shopping list.
• Receipts (Premium plan only): uploaded images and the products read from each receipt.
• Notifications: if you turn them on, the technical identifier provided by your browser to deliver them.
• Activation requests sent from the website: name, email, chosen plan, number of people and message.
• Emails you send to [email protected].
• Technical data: IP address and browser information, used for security (for example to block repeated login attempts) and to run the service.

3. Why we process it and on what legal basis

• To provide the app and its features, including the AI shopping list: performance of a contract (Art. 6(1)(b) GDPR).
• To reply to activation requests and emails: pre-contractual steps at your request (Art. 6(1)(b)).
• To protect the service from abuse and unauthorised access: legitimate interest (Art. 6(1)(f)).
• To comply with legal obligations, such as tax rules: legal obligation (Art. 6(1)(c)).

We do not use your data for advertising, we do not sell it and we do not build marketing profiles.

4. Where it is stored and who processes it

App data is stored on a server managed by the controller in Italy. To run the service we use the following providers, appointed as data processors:

• Cloudflare, Inc.: website hosting, content delivery network, DNS, attack protection; artificial intelligence service (Workers AI) for reading receipts.
• ngrok, Inc.: encrypted connection between the website and the server that stores the data.
• Anthropic, PBC: artificial intelligence service (Claude) for reading receipts and preparing the shopping list.
• Plus Five Five, Inc. (Resend): sending and receiving emails.

Some of these providers are based in the United States. Transfers rely on the EU-U.S. Data Privacy Framework or on the standard contractual clauses approved by the European Commission. Receipt images are sent to the artificial intelligence service only to read their content.

5. How long we keep it

• Account and app data: for as long as the service is provided. When an account is closed we delete it within 30 days, unless the law requires otherwise.
• Receipts: up to 5 per household; each new receipt replaces the oldest one. Household admins can delete them at any time.
• Activation requests and emails: up to 24 months, unless they lead to a contract.
• Technical security data: only for as long as strictly necessary, usually a few days.

6. Your rights

You can ask at any time to access, correct or delete your data, to restrict its processing, for data portability, and you can object to processing based on legitimate interest (Arts. 15–22 GDPR) by writing to [email protected]. We reply within one month. You also have the right to lodge a complaint with a supervisory authority, such as the Italian Garante per la protezione dei dati personali (garanteprivacy.it) or the authority in your country.

7. Security

Connections are encrypted (HTTPS), passwords are stored in encrypted form, each household only sees its own data and personal expenses are visible only to the person who logged them and to the household admins.

8. Cookies

The website only uses technical cookies. See the cookie policy for details.

9. Changes

We may update this policy; the date of the last change is shown at the bottom of the page.

Last updated: 14 October 2026