Last updated August 5, 2026

Privacy Policy

StubNest stores receipts and files them to your companies. This policy explains what we collect, why, who processes it on our behalf, and how to get it deleted.

Who we are

StubNest is operated by Aztec Software, LLC. If you have any question about this policy or about your data, email support@stubnest.com.

What we collect

• Account details — your email address and name. Passwords are stored only as a salted hash; we never see or store the password itself.
• Profile details you choose to add — profile photo, phone number, postal address, and a contact note. All optional.
• Receipts you submit — the image, PDF, or forwarded email, plus what we extract from it: vendor, date, totals, tax, currency, the last four digits of the card used, and individual line items. We never receive or store a full card number.
• Forwarded email — when you forward a receipt to an ingest address we store the message, including the sending address, so the receipt can be processed and duplicates suppressed.
• Company records — the companies you create, their expense categories and card last-four digits, and who you invite to them.
• Device token for notifications — if you enable push notifications, the Apple-issued token for your device.
• Operational records — sign-in sessions and an audit log of changes to receipts and companies, used for security and to show who changed what.

What we do not do

• We do not sell or rent your personal information.
• We do not track you across other companies' apps or websites, and we do not use advertising or analytics SDKs.
• We do not use your receipts to train AI models. Neither does our AI provider — their commercial terms prohibit training on data submitted through their API, and that is a contractual prohibition, not a setting.

How we use it

To read your receipts and file them under the right company and category; to show you your receipts across the web and iPhone apps; to send transactional email such as verification and password resets, and the daily digest and push notifications if you enable them; to keep the service secure and prevent abuse; and to comply with legal obligations.

Who processes your data

We use a small number of service providers, each of which processes data only to provide their service to us:

• Cloudflare — hosting, database, file storage, and inbound email routing. Your receipts and their images are stored on Cloudflare infrastructure.
• Anthropic PBC (United States) — with your permission, receipts are sent to the Claude API to be read. What is sent: the receipt image or PDF you capture, or the text of a receipt email you forward; and, so the receipt can be filed correctly, your company names, their expense category names, and the last four digits of your company cards. What is never sent: your name, email address, password, or a full card number. Anthropic processes it only to return the extracted fields to us. Their Commercial Terms of Service prohibit training models on customer inputs and outputs, and their Data Processing Addendum — incorporated into those terms — binds them to protect it to a standard equivalent to this policy. Nothing is sent until you grant permission — see below.
• Resend — delivery of transactional email and the optional daily digest.
• Apple — delivery of push notifications, if you enable them.

Your permission for AI processing

Reading a receipt means sending it to Anthropic, so we ask first. The app shows you exactly what is sent and who it goes to, and nothing leaves StubNest until you agree.

• If you have not given permission, receipts you upload or forward are still stored for you — they are simply held unread. Nothing about them is transmitted to Anthropic.
• When you give permission, receipts that were waiting are read and filed.
• You can withdraw permission at any time — on iPhone under Profile → Data & AI, or on the web under My settings. New receipts are then held unread again. Receipts already read keep the details that were extracted; you can delete any of them.

Sharing with other people

Receipts filed to a company are visible to the members of that company, including any accountant you invite. You control who is invited and can remove members at any time. We otherwise disclose data only when required by law or to protect our rights, users, or the security of the service.

How long we keep it

Receipts and their images are kept until you delete them or delete your account — business records like these are usually kept for several years for tax purposes, so we do not expire them on our own. Deleted receipts stay recoverable in Trash until you remove them permanently. When you delete your account we remove your personal data and the receipt files belonging to it. Backups and logs may retain some data for a short period before being overwritten.

Your choices and rights

• Access and correct — view and edit your profile and any receipt at any time in the app.
• Delete — delete individual receipts, or delete your whole account from Profile on iPhone or My settings on the web. Deletion is permanent.
• Notifications — turn push notifications and the daily email digest on or off in Settings. Transactional email needed to operate your account cannot be turned off while the account exists.
• Regional rights — depending on where you live you may have additional rights over your personal data, including access, correction, deletion, portability, and the right to object. Email support@stubnest.com and we will respond as required by applicable law.

Security

Traffic between your devices and StubNest is encrypted with HTTPS, and the iPhone app stores its sign-in token in the iOS Keychain. Access to receipts is scoped to your account and the companies you belong to. No service can promise perfect security, but we design for least privilege and keep the number of parties touching your data small.

Children

StubNest is a business tool and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, email us and we will delete it.

International transfers

Our service providers operate globally, so your data may be processed in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for those transfers.

Changes to this policy

We will update this page when our practices change and revise the date at the top. Material changes will be communicated in the app or by email.