Privacy Policy
Effective date: 2 October 2026 · Version: 1.0
1. Who this policy covers
This policy describes how Tiquento (“Tiquento”, “we”, “us”) handles personal data when it operates the Tiquento website, mobile application, and expense-management service (the “Service”). Contact: admin@tiquento.com. Data Protection Officer: not appointed.
Where an organisation subscribes to the Service, that organisation normally determines why and how its workforce’s expense data is used. It is the controller; Tiquento processes that data as its processor under the applicable data processing agreement. Tiquento is an independent controller for its website, sales contacts, service administration, security, and billing data.
2. Personal data we process
| Data | Examples | Source |
|---|---|---|
| Account and identity data | Name, work email address, user ID, role, organisation, login/session and verification data. | You, your company administrator, or the Service. |
| Expense and receipt data | Receipt photographs/files, merchant and transaction details visible in a receipt, amount, currency, category, description, submitted/approval/payment status, expense identifiers and timestamps. | Users and company administrators. |
| Workflow data | Approver identity, decisions, comments, notification recipients, reporting and export records. | Users and the Service. |
| Technical and security data | IP address, device/app/browser information, access logs, token/session metadata and security events. | Your device and the Service. |
| Commercial and billing data | Organisation contact details, subscription/plan and invoices. Payment-card data is handled by Stripe, not stored by Tiquento. | Customer and Stripe. |
Receipts can incidentally contain personal data beyond the fields above. Do not upload special-category data or unnecessary personal information. The Service is not designed to request such data.
3. Why we use data and legal bases
| Purpose | Role and basis |
|---|---|
| Provide the expense, approval, reporting, account and mobile-app functions | Processor for the customer’s documented instructions; where Tiquento is controller, performance of its contract (GDPR Art. 6(1)(b)). |
| Secure, troubleshoot and prevent misuse of the Service | Processor where carried out for a customer; otherwise legitimate interests in operating a secure service (Art. 6(1)(f)). |
| Manage customer relationship, subscriptions, invoices and support | Performance of contract and legal obligations (Arts. 6(1)(b) and 6(1)(c)). |
| Meet legal obligations and respond to valid legal requests | Legal obligation (Art. 6(1)(c)). |
| Send non-essential marketing | Consent where required, or legitimate interests where permitted; you can opt out at any time. |
4. OCR and automated assistance
If your organisation enables receipt extraction, a receipt may be sent to Google Cloud Document AI in the EU to suggest expense fields. The suggestion is assistance only; users must review it. Tiquento does not use this feature to make solely automated decisions with legal or similarly significant effects about individuals.
5. Recipients, processors and international transfers
Access is limited to authorised personnel and the customer’s authorised users. We may disclose data where required by law or to protect rights, security, or the Service. We use the following service providers:
| Provider | Purpose | Location and safeguard |
|---|---|---|
| Google Cloud | Application hosting, database, private receipt storage, background processing and, where enabled, Document AI receipt extraction. | EU regions (Belgium and Spain). Google Cloud data processing terms. |
| Stripe | Subscription payments and billing. | EU, with possible transfers to the United States under the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses. |
| Postmark | Transactional email (account verification, password reset, notifications). | United States, under the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses. |
6. Storage, security and retention
Receipt files are stored in a private cloud-storage bucket; access is authorised by the Service and time-limited links are used for viewing. We use appropriate technical and organisational safeguards, but no system can be guaranteed completely secure.
We retain personal data only as long as necessary for the stated purposes, the customer’s documented instructions, and applicable law. Customer data is kept while the organisation’s subscription is active and is deleted within 90 days after termination, unless the organisation asks for earlier deletion or an export. Users removed by an administrator lose access immediately; their expense records remain with the organisation. Technical logs are kept for up to 30 days. Billing and invoice records are kept for up to six years to meet Spanish commercial and tax obligations. Data may be retained longer where required for legal claims, compliance or accounting obligations.
7. Your rights and how to exercise them
Subject to the GDPR, individuals may have rights of access, rectification, erasure, restriction, objection, portability, and (where applicable) withdrawal of consent. For workforce/expense data, contact your employer or organisation administrator first because it is normally the controller. Tiquento will assist its customers under the DPA. For data for which Tiquento is controller, email admin@tiquento.com. You may also complain to your local supervisory authority; in Spain, this is the AEPD (aepd.es).
8. Children, changes and contact
The Service is for business use and is not directed to children. We will post material changes here and update the effective date. Contact admin@tiquento.com with privacy questions.