Privacy Policy & Terms and Conditions — ScontrinOk

Last updated: June 10, 2026

This document contains the Privacy Policy and the Terms and Conditions that govern your use of ScontrinOk (the "Service"), provided as a mobile application (Android, iOS), a web application, and a companion website for account and subscription management (collectively, the "App").

The Service is provided by:

Meravit S.r.l. Registered office: [Registered office address — to be completed] VAT / Partita IVA: 02868600426 Contact (privacy & data protection requests): info@meravit.com Contact (general support): support@meravit.com

By creating an account or otherwise using the Service, you agree to this Privacy Policy and to the Terms and Conditions described below. If you do not agree, please do not use the Service.

Part 1 — Privacy Policy

This Privacy Policy explains how Meravit S.r.l. ("we", "us", "our"), as Data Controller, collects, uses, stores, shares, and protects your personal data when you use ScontrinOk, in compliance with Regulation (EU) 2016/679 ("GDPR") and applicable Italian data protection law.

1. Data Controller

Meravit S.r.l., VAT number 02868600426, registered office at [Registered office address — to be completed], is the Data Controller responsible for the personal data described in this policy.

For any question or request relating to your personal data, you can contact us at info@meravit.com.

2. What personal data we collect

2.1 Account data

When you sign up or sign in, we collect data provided by your chosen identity provider:

• Unique user identifier (UID)
• Email address
• Display name (if provided)
• Profile picture / avatar URL (if provided)
• Account creation date

We support sign-in via Google and Apple ("Sign in with Apple"), handled through Firebase Authentication. We do not receive or store your Google/Apple account password.

2.2 Receipt and document data

The core function of the App is to let you upload receipts, invoices, and similar payment documents. When you do so, we process:

• The uploaded image or PDF file itself (which may contain merchant names, addresses, item descriptions, prices, payment methods, dates, and — depending on what you photograph — names or other personal data of third parties printed on the document)
• Data automatically extracted from the document by our AI provider: transaction date, amount, currency, merchant name, payment type (cash/card), and matching expense category

Note on special category data: receipts (e.g., from pharmacies or healthcare providers) may incidentally reveal information about health or other sensitive matters. We do not intentionally collect or analyze special categories of personal data (Art. 9 GDPR), and we recommend avoiding uploading documents containing such information unless necessary for your own record-keeping. We process all uploaded documents in the same way regardless of their content.

2.3 Expense categories

Custom category names and descriptions you create to organize your receipts.

2.4 Subscription and payment data

If you subscribe to a paid plan, our payment processor Stripe processes:

• Billing name, billing address, and tax/VAT identification number (if provided, for invoicing purposes)
• Payment method details (Stripe handles and stores card data directly; we never receive or store full card numbers)
• Subscription status, plan, renewal dates, and a history of completed payments/invoices

This data is shown to you in your account area on the website.

2.5 Optional integrations

Telegram bot. If you choose to connect a Telegram bot to your account, we store the bot token, bot username, and bot ID you provide. When you send a photo or PDF document to your connected Telegram bot, we receive that file (and the associated Telegram chat ID) in order to process it the same way as an in-app upload and reply to you with the extracted information.

Google Drive. If you choose to connect Google Drive, the App requests your authorization (via Google Sign-In/OAuth) to access your Google Drive on your behalf, in order to read receipt files from, and/or write processed receipts and exports to, folders you select. We only access the files and folders needed to provide this feature and do not access unrelated content in your Drive.

2.6 Technical and diagnostic data

We use Sentry to collect crash reports and error diagnostics from the mobile and web app (e.g., stack traces, device/OS information, app version) to identify and fix bugs. This data is associated with your session but is used solely for stability and reliability purposes.

2.7 Data we do not collect

We do not use advertising cookies or third-party analytics/tracking on the website. The website only uses Firebase Authentication's local session storage to keep you signed in (see Section 9, "Cookies and similar technologies").

3. How and why we use your data (purposes and legal basis)

4. AI-based processing of receipts

To extract structured data from your receipts (date, amount, merchant, currency, payment type, suggested category), uploaded images and PDFs are sent to Google's Gemini AI API for automated analysis. The extracted result is returned to our backend and stored in your account; the underlying file is stored separately in our cloud storage (see Section 5).

This automated processing is a core, necessary part of the Service. The output is always shown to you and can be reviewed and corrected manually before or after it is saved.

5. Service providers and recipients of your data ("processors")

We share personal data only with service providers acting on our behalf (data processors) or, where required, with the relevant identity provider. These include:

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

6. International data transfers

Our primary infrastructure (Firestore database, Cloud Storage, and Cloud Functions) is hosted in the European Union. However, some of the service providers listed in Section 5 (including Google's Gemini AI API, Stripe, Sentry, and Telegram) are based in, or may process data in, the United States or other countries outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we rely on appropriate safeguards recognized under GDPR Chapter V, such as the European Commission's Standard Contractual Clauses (SCCs) and/or the providers' adherence to the EU-U.S. Data Privacy Framework, as applicable. You can contact us at info@meravit.com for more information about these safeguards.

7. Data retention

• Active accounts: we retain your account data, receipts, files, and related metadata for as long as your account is active and the data is needed to provide the Service.
• Account deletion: if you request deletion of your account (see Section 8), we will delete or anonymize your personal data, including uploaded receipt files and extracted metadata, within 30 days of confirming your request, except where we are legally required to retain certain records for longer (e.g., billing/invoicing records required for tax purposes, which are retained for the period mandated by applicable law).
• Optional integrations: if you disconnect Telegram or Google Drive, the related credentials (e.g., bot token) are deleted from our systems; any files already exchanged are handled according to the retention rules above.
• Diagnostic data: crash and error reports are retained by our error-monitoring provider according to its standard retention settings, generally limited to a period sufficient for debugging purposes.

8. Your rights under GDPR

Subject to the conditions set out in the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectify inaccurate or incomplete data (Art. 16)
• Erase your data ("right to be forgotten") (Art. 17)
• Restrict processing in certain circumstances (Art. 18)
• Data portability — receive your data in a structured, machine-readable format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, where processing is based on consent (e.g., optional integrations), without affecting the lawfulness of processing before withdrawal

How to exercise your rights

Send a request to info@meravit.com. Account and data deletion requests are currently handled manually by our support team upon email request; we will confirm completion of your request and the deletion timeline described in Section 7.

You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.

9. Cookies and similar technologies

The ScontrinOk website uses Firebase Authentication, which stores a session token in your browser's local storage to keep you signed in between visits. This is strictly necessary for the Service to function and is not used for advertising or cross-site tracking.

We do not currently use analytics cookies, advertising cookies, or third-party tracking pixels on the website. If this changes in the future, we will update this policy and request your consent where required by law.

10. Data security

We rely on Google Cloud / Firebase's security infrastructure, including encryption in transit (TLS) and at rest, access controls limiting data access to authenticated users for their own data, and secret management for API keys and integration tokens. While we take reasonable measures to protect your data, no method of transmission or storage is 100% secure.

11. Children's privacy

The Service is not directed to children under 16 years of age, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at info@meravit.com so we can delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Service or legal requirements. The "Last updated" date at the top of this document indicates when it was last revised. Material changes will be communicated through the App or by email where appropriate.

Part 2 — Terms and Conditions

1. Acceptance of these Terms

These Terms and Conditions ("Terms") govern your access to and use of ScontrinOk. By creating an account or using the Service, you confirm that you are at least 16 years old and that you accept these Terms in full.

2. Description of the Service

ScontrinOk is a receipt and expense management service that allows you to:

• Upload photos or PDFs of receipts and invoices, with AI-assisted extraction of merchant, date, amount, currency, payment type, and category
• Organize receipts using custom categories
• Receive and process receipts sent via a connected Telegram bot
• Sync receipts with a connected Google Drive account
• Export receipts and summary reports (e.g., for accounting purposes)
• Manage a subscription plan and view billing history via the companion website

3. Account registration

You must register and authenticate using a supported identity provider (Google or Apple). You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. Notify us immediately at support@meravit.com if you suspect unauthorized use of your account.

4. Subscription plans, billing, and cancellation

ScontrinOk offers the following plan tiers (features and pricing may be updated from time to time and are displayed in the App/website at the time of purchase):

• Free — limited monthly receipt uploads, basic categorization, email support
• Pro — unlimited receipts, AI categorization, CSV export, priority support
• Max — everything in Pro, plus multi-workspace, API access, custom categories, dedicated support

Paid subscriptions are billed on a recurring basis (monthly or annually, as selected at checkout) through Stripe. By subscribing, you authorize us (via Stripe) to charge your chosen payment method on each renewal until you cancel.

You can manage or cancel your subscription at any time from your account page via the Stripe billing portal. Cancellation takes effect at the end of the current billing period; we do not provide pro-rata refunds for partial periods unless required by applicable consumer protection law. If you are a consumer residing in the EU, you may have a statutory right of withdrawal as described by applicable law; contact info@meravit.com for details.

5. Acceptable use

You agree not to:

• Use the Service for any unlawful purpose or to upload content that infringes the rights of others or contains malware
• Attempt to gain unauthorized access to the Service, other users' accounts, or our systems
• Use the Service to process documents on behalf of third parties without their knowledge, where this would violate applicable privacy laws
• Reverse-engineer, decompile, or attempt to extract the source code of the App, except as permitted by law

We reserve the right to suspend or terminate accounts that violate these Terms.

6. Your content

You retain ownership of the receipts, documents, and data you upload ("Your Content"). By uploading Your Content, you grant us a limited license to store, process (including via AI analysis), and display Your Content solely for the purpose of providing the Service to you. We do not claim ownership of Your Content and do not use it to train AI models beyond the processing necessary to deliver the requested feature.

You are responsible for ensuring you have the right to upload any documents containing third-party personal data (e.g., shared receipts) and for complying with applicable privacy laws when doing so.

7. AI-generated data — accuracy disclaimer

Data extracted from your receipts (amounts, dates, merchant names, categories, etc.) is generated automatically using AI and may contain errors or omissions. You are responsible for reviewing and correcting extracted data before relying on it for accounting, tax, expense reporting, or any other purpose. We do not guarantee the accuracy, completeness, or fitness for any particular purpose of AI-generated data.

8. Third-party integrations

Optional integrations (Telegram, Google Drive) rely on third-party services governed by their own terms and privacy policies. We are not responsible for the availability, security, or content of these third-party services. You may disconnect any integration at any time from the App's settings.

9. Intellectual property

The Service, including its software, design, logos, and trademarks (including "ScontrinOk"), is owned by Meravit S.r.l. or its licensors and is protected by intellectual property laws. Nothing in these Terms grants you any rights to our intellectual property other than the limited right to use the Service as intended.

10. Termination

You may stop using the Service and request deletion of your account at any time by contacting support@meravit.com (see Section 8 of the Privacy Policy). We may suspend or terminate your access to the Service if you breach these Terms, with notice where reasonably possible.

11. Disclaimer of warranties

The Service is provided "as is" and "as available". To the maximum extent permitted by applicable law, we disclaim all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the Service will be uninterrupted, error-free, or that AI-extracted data will be accurate.

12. Limitation of liability

To the maximum extent permitted by applicable law, Meravit S.r.l. shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of data, profits, or revenue, arising from your use of (or inability to use) the Service. Nothing in these Terms limits liability that cannot be limited under applicable law (including liability for fraud or for death or personal injury caused by negligence).

13. Governing law and jurisdiction

These Terms are governed by Italian law. For consumers residing in the EU, this choice of law does not deprive you of the protection afforded by mandatory provisions of the law of your country of residence. Any dispute not resolved amicably shall be subject to the exclusive jurisdiction of the competent courts of Italy, without prejudice to any mandatory consumer venue rights under applicable law. EU consumers may also use the European Online Dispute Resolution platform at https://ec.europa.eu/consumers/odr.

14. Changes to these Terms

We may update these Terms from time to time. Continued use of the Service after changes take effect constitutes acceptance of the revised Terms. The "Last updated" date at the top of this document reflects the latest revision.

15. Contact

For any questions about this Privacy Policy or these Terms, please contact:

Meravit S.r.l. Email: info@meravit.com / support@meravit.com