This Privacy Policy explains what personal data Mafin ("we", "us", "our") collects when you use the Mafin mobile application and related services (the "Service"), why we collect it, who we share it with, and the choices and rights you have. By using the Service you agree to the practices described here.
Mafin is a mobile app that helps you capture, organize, and analyze your expenses. We are the data controller for the personal data processed through the Service.
If you have any questions about this policy or your data, contact us at support@mafinapp.com.
Account data: your email address and authentication identifiers. If you sign in with Apple or Google, we receive the identifier they provide (and, where applicable, an email address). We do not receive your Apple or Google password.
Your content: the receipts, receipt images and PDFs, amounts, merchants, dates, categories, notes, and budgets you add to the app.
Text extracted from receipts: when you scan a receipt, we process the image to extract details such as merchant, date, total, and line items.
Device and usage data: app interactions, feature usage, crash and diagnostic reports, and a device push token if you enable spending summaries.
Support data: messages, feedback, and any attachments you send us through the in-app feedback or support features.
To provide the Service: create and secure your account, store and sync your receipts and settings across your devices, run text recognition on receipts, generate reports and budgets, and operate shared Spaces.
To communicate with you: send the spending summaries you opt into, respond to support requests, and send important notices about the Service.
To improve and protect the Service: understand how features are used, diagnose crashes and errors, prevent fraud and abuse, and keep the Service secure.
We do not sell your personal data, and we do not use the contents of your receipts to serve you advertising.
When you scan or upload a receipt, the image or PDF is sent to our AI provider, OpenAI, which processes it using its Vision models to extract structured details (such as merchant, date, amount, and line items). This processing is necessary to provide the core scanning feature.
OpenAI acts as our processor for this purpose. Receipt images are sent solely to return the extracted data to you and are not used by us to train models.
Automated extraction can make mistakes, so you can review and edit the extracted details before saving them.
We rely on trusted providers that process data on our behalf under their own terms and security commitments:
Supabase — cloud hosting, database, authentication, and storage of your account data and receipt images.
OpenAI — automated text recognition of receipt images and PDFs (see section 4).
Google Firebase — analytics, crash reporting (Crashlytics), and remote configuration.
Apple and Google — sign-in providers, and the push-notification networks (APNs and FCM) used, via Expo, to deliver summaries you enable.
These providers may process data in countries outside your own. Where required, we rely on appropriate safeguards for such transfers.
If you create or join a shared "Space" (for example, with family or a business partner), the receipts and analytics you add to that Space become visible to its other members.
You control what you add to a Space and who you invite. Only share with people you trust.
Where the GDPR or similar laws apply, we process your data on the following bases: to perform our contract with you (providing the Service), for our legitimate interests (securing and improving the Service), to comply with legal obligations, and, where required, with your consent (for example, push notifications).
You can withdraw consent at any time by turning off the relevant feature or contacting us.
We keep your data for as long as your account is active and as needed to provide the Service. When you delete an item or your account, we delete the associated data as described below.
We may retain limited information where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.
You can delete your account at any time from Settings → Delete Account. This permanently and irreversibly erases your account and associated data — including receipts, images, budgets, and settings — from our systems.
Depending on where you live, you may also have the right to access, correct, export, or restrict the processing of your personal data, and to object to certain processing. To exercise these rights, use the in-app controls or contact us at support@mafinapp.com.
You may also have the right to lodge a complaint with your local data-protection authority.
We use technical and organizational measures — including encryption in transit and access controls — to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to limit access to it.
The Service is not directed to children under 16 (or the age of digital consent in your country). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
We may update this Privacy Policy from time to time. When we make material changes, we will update the version and effective date shown at the top of the policy and, where appropriate, notify you in the app.
Questions or requests about your privacy? Reach us at support@mafinapp.com and we will be happy to help.