Privacy Policy

1. Who operates Smart Expense

Smart Expense is operated by Navin Saravanan. This policy applies to the Smart Expense document-to-expense workflow service available at smartexpenseapp.com.

Privacy questions and data requests may be sent to privacy@smartexpenseapp.com.

2. Information we process

Accounts and access

We process account details used for authentication, business memberships, active workspace selection, assigned roles, access status, and invitation records. Role and membership information is used to enforce what each user may view or change.

Business configuration

Businesses may provide workspace details and optional configuration, including branches, tracking structures, categories, suppliers, and team information.

Documents and expense records

We process uploaded receipts, invoices, supporting documents and other retained business files, together with original-file metadata, extracted fields, line items, financial values, classifications, workflow states, payment records, review comments, and activity history. Original files are stored privately and protected by access controls designed around business and user scope.

Email intake

When a business uses its Smart Expense intake address, we process the inbound message, sender and delivery metadata, and supported attachments needed to create and route document records. An email attachment does not automatically approve an expense or record a payment.

Technical information

We process essential session and workspace-selection data, security and integrity metadata, service logs, error classifications, and privacy-safe usage telemetry needed to operate, secure, diagnose, and improve the service. We do not store document body content in ordinary operational logs.

3. How information is used

• Authenticate users and enforce business, role, and document access.
• Store, verify, understand, review, approve, and track documents.
• Support accounting classification, payment tracking, reports, and exports.
• Detect possible duplicate documents and suggest configured references.
• Deliver optional email intake and Google Workspace mirroring.
• Protect the service, investigate failures, and maintain audit history.

4. AI-assisted document processing

Smart Expense uses AI services to help classify documents, extract relevant fields, and provide review suggestions. Uploaded document content is sent to the configured AI provider only as needed to perform this processing.

AI output is assistance, not final authority. Deterministic checks and authorized human actions control classification, approval, accounting references, and payment records.

5. Google user data

Google Workspace connection is optional. When an authorized business user connects it, Smart Expense requests basic Google account identity information and the limited Google Drive permission needed to create and manage only the files and folders used with Smart Expense. The requested Drive permission is drive.file; Smart Expense does not request access to every file in the user's Drive.

We use this access to create and maintain a one-way Google Drive and Google Sheets mirror of selected Smart Expense records. Smart Expense remains the source of truth, and edits made in Google do not update Smart Expense. We may read identifiers and metadata for Smart Expense-created Google items to verify and reconcile that mirror.

We store the connected Google account identifier, granted scopes, Smart Expense-created folder, file and spreadsheet identifiers, and sync status. The Google refresh credential is encrypted before it is stored and is not sent to the browser or exposed to ordinary users. Google Drive or Sheets content is not used for advertising or sold.

Google user data is used and transferred only to provide or secure the user-requested integration, consistent with the Google API Services User Data Policy, including its Limited Use requirements. Service providers may process the minimum technical data necessary to host and operate the integration on our behalf.

An authorized user can disconnect Google Workspace in Smart Expense settings. Disconnecting stops new sync attempts and removes the local stored credential. Existing copies already created in Google Drive or Sheets remain in the connected Google account and can be managed there by its owner.

6. Service providers

Smart Expense relies on service providers to operate the application. These currently include Supabase for authentication, database and private file storage; Vercel for application hosting and server-side processing; Google for Gemini AI and the optional Drive/Sheets integration; and Resend for inbound email delivery. Providers process information under their own terms and privacy commitments and may operate infrastructure in more than one region.

7. Sharing and disclosure

We do not sell customer documents or Google user data. Information may be shared with service providers as needed to deliver and secure the service, with authorized members of the relevant business under role-based access, when required by applicable law, or to protect users and the service from misuse.

8. Retention and deletion

Information is retained while needed to provide the service, maintain document and audit integrity, resolve disputes, protect security, and meet applicable obligations. Deactivating a team member preserves historical document and audit attribution. Disconnecting an integration does not delete business records or remote Google copies.

A business or user may contact us to request access, correction, or deletion of personal information. Requests are evaluated against the business's authority, document integrity requirements, applicable law, and records that must reasonably be retained. We do not promise a fixed deletion period where one has not been implemented.

9. Security

Safeguards include private document storage, tenant and role-based controls, server-side authorization, upload integrity verification, audit history, and encrypted Google refresh credentials. No online service can guarantee complete security, and users should protect their credentials and report suspected misuse promptly.

10. Changes and contact

We may update this policy as the controlled pilot and service evolve. The effective date above identifies the current version. Material changes will be communicated through an appropriate service channel.

Contact: Smart Expense, operated by Navin Saravanan, at privacy@smartexpenseapp.com.