Privacy Policy

Effective date

July 27, 2026

Information we collect

• Account and profile information, such as your email address, name, preferences, and authentication identifiers.
• Transaction information you enter, including merchant, date, amount, category, notes, tax-relief selections, and related records.
• Receipt images and information extracted from them, such as merchant, date, amount, line items, and suggested categories.
• Support communications and information you provide when asking us for help.
• Usage, device, diagnostic, and security information used to operate, protect, and improve the service.
• Google Drive identifiers and authorisation details when you choose to connect the optional integration.

How we use your information

• Provide receipt storage, receipt scanning, transaction tracking, tax-readiness tools, and reports you request.
• Process receipt contents using automated receipt-reading tools to extract information and suggest records that may need review or may be claimable.
• Operate an optional Google Drive backup or export that you enable.
• Respond to support requests and communicate important service, security, or policy updates.
• Troubleshoot, maintain, secure, and improve Xpensight, and prevent fraud, misuse, or unlawful activity.
• Comply with applicable legal obligations and enforce our Terms of Service.

Authorised access

Receipt images and related information are not publicly accessible. Access is restricted to authorised Xpensight personnel and service providers that require access to operate or support the service.

Xpensight personnel may access uploaded receipts only where reasonably necessary to respond to user-requested support, investigate technical or security incidents, prevent fraud or misuse, maintain the service, or comply with applicable legal obligations. Access is limited according to role and operational need and may be recorded for security and accountability.

Some providers process receipt information automatically through their systems without a person manually viewing a receipt.

Service providers and data sharing

We do not sell personal data. We disclose data only as reasonably necessary to operate Xpensight, at your direction, or where required by law.

• Cloud hosting, private receipt storage, database, and infrastructure providers, including AWS.
• receipt-processing providers that process receipt contents to provide scanning and smart-review features.
• Authentication, communications, customer-support, monitoring, and security providers.
• Google Drive when you enable its optional backup or export integration.
• Professional advisers, authorities, or other parties where reasonably necessary to protect rights, investigate misuse, comply with law, or respond to lawful requests.

Where data is stored and processed

• Receipt files stored directly by Xpensight are kept in private AWS storage in Malaysia.
• Receipt metadata is kept in Xpensight’s database infrastructure in Singapore.
• Receipt contents and other data may be processed through Xpensight’s application infrastructure and service providers, including receipt-processing providers, in other locations. Appropriate safeguards are applied where required.
• If you enable Google Drive, an additional copy is stored in your Google account and is subject to Google’s terms and privacy practices.

Google Drive usage

Google Drive is optional. When you enable backup or request an export, you authorise Xpensight to create or access the relevant files in your Google Drive for that feature.

You can revoke Xpensight’s access in your Google account settings. Revoking access stops future access but does not automatically delete files already created in your Drive. You can delete those files in Google Drive.

Retention and deletion

We retain personal data only for as long as reasonably necessary to provide the service, maintain security and business records, resolve disputes, and comply with applicable legal obligations. Retention periods depend on the type of information and why it is held.

When you delete a receipt stored by Xpensight, its receipt file and thumbnail are deleted from active receipt storage. A limited receipt record may remain marked as deleted so we can operate storage accounting, security, and deletion workflows. Residual copies may remain temporarily in backups or security records until they expire under normal retention processes, or longer where retention is required by law.

Deleting a receipt from Xpensight does not necessarily delete an additional copy in your Google Drive. You control and can delete that copy through Google Drive. Disconnecting Google Drive also does not automatically delete files already created there.

You may contact us to request access to or correction of your personal data, or to ask about account deletion. We may retain limited information where reasonably necessary or legally required and may need to verify your identity before completing a request.

Your choices

• Update transaction, receipt, tax-profile, and language information through available app controls.
• Delete receipts or transactions using available app controls.
• Choose whether to connect or disconnect the optional Google Drive integration.
• Contact us to request access, correction, or deletion, or to ask how your personal data is handled.

Security

We use reasonable administrative, technical, and organisational safeguards designed to protect personal data, including restricted access and private receipt storage. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

Xpensight is not intended for children under 18. If you believe a child has provided personal data without appropriate permission, contact us.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page, revise the effective date, and provide additional notice where appropriate.

Contact us

Questions or requests about privacy? Contact us at support@xpensight.my.

For the rules governing use of Xpensight, read our Terms of Service.