Privacy Policy
Short version: your actual expense data — every receipt, amount, and category — is written straight into a Google Sheet that lives in your own Google Drive. We don't keep a separate copy of it, and we don't store the receipt photos themselves after we've read them. What we do keep, centrally, is the minimum needed to operate the service: your WhatsApp number and some account metadata. We don't sell your data, and we don't access anything in your Google account beyond the one file purche.ai created. Ever.
AI accuracy: purche.ai uses AI (OCR and language models) to read receipts and answer questions about your spending. AI can make mistakes — misread amounts, dates, or vendor names, especially on blurry or handwritten receipts. Always verify entries before relying on them for tax filings, reimbursement claims, or other important decisions.
1. Who we are
purche.ai is built and operated by Corshift Product Consulting (contact: vishant@corshift.com). This policy covers data collected via the purche.ai website, the purche.ai WhatsApp bot, and Google sign-in used to connect your Google Sheets/Drive.
2. What data we collect — and what we don't keep
We store the minimum needed to operate the service, centrally, in our own systems:
- Your WhatsApp number — to know who's messaging us and where to reply.
- Account and operational metadata — status, role, business type, an approver's number (if you're part of a team), and join/last-active timestamps.
- Vendor-to-category associations tied to your number — e.g. "this vendor is usually 'Fuel'" — used to speed up categorising your future receipts.
- Your Google OAuth refresh token (only if you connect Google) — stored encrypted, used solely to write to the one spreadsheet purche.ai created for you. See Section 3.
What we deliberately do not keep a copy of:
- Your actual expense entries — vendor, amount, date, category, description. These are written directly into the Google Sheet purche.ai creates in your own Google Drive. We don't maintain a separate database of your transactions.
- The receipt photos, PDFs, or screenshots you send. We fetch them briefly to extract the data (via AI/OCR), then discard them — they are not written to any persistent storage on our side. (Twilio, our messaging provider, briefly hosts the media file as part of delivering your WhatsApp message, per its own retention policy.)
- Your name, email, or Google profile information. We don't request it — our Google permission is scoped to creating and writing one spreadsheet file, nothing more.
We do not collect payment card details, national identification numbers, or other sensitive personal data.
3. Google user data (OAuth) — what we access and why
If you choose to connect a Google account, purche.ai requests only the drive.file OAuth scope — no profile, email, or general Drive access is requested. This is a restricted, per-file scope: it only gives purche.ai access to files that purche.ai itself creates — specifically, the single Google Sheet purche.ai creates in your Drive to hold your expense ledger. purche.ai cannot see, list, or modify any other file in your Google Drive.
We use this access solely to:
- Create your personal expense ledger spreadsheet in your own Google Drive (you own this file — not us)
- Write expense rows to that spreadsheet as you send receipts and transactions
- Read that spreadsheet back to answer your questions about your spending
We do not use Google user data for advertising, and we do not transfer it to any third party except the infrastructure providers listed in Section 7, who process it only to operate the service on our behalf.
Limited Use disclosure: purche.ai's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Your Google refresh token (used to maintain access without asking you to sign in repeatedly) is stored encrypted at rest, with strict controls limiting who and what can decrypt it. You can revoke purche.ai's access at any time from your Google Account permissions page, or by emailing us to request disconnection.
4. How we use your data
We use your data to:
- Read and log the receipts, invoices, and messages you send, into your expense ledger
- Answer your questions about your spending
- Reach out to you on WhatsApp about your purche.ai account, relevant product updates, or occasional reminders to log your expenses — you can turn these off anytime (see Terms of Service, Section 2)
- Troubleshoot onboarding issues, using only the abbreviated logs described in Section 2 (last 4 digits of your number, plus step/status)
We do not run behavioural analytics on your use of the WhatsApp service, and we do not use your data for advertising, profiling, or any automated decision-making that produces legal or similarly significant effects. Website analytics (Section 5) is separate and measures only anonymous browsing of purche.ai, never your messages or expense data.
5. Where your data is stored
Your expense ledger is stored as a Google Sheet in your own Google Drive — you own and control that file directly. Account and message metadata is stored on AWS infrastructure (Amazon Web Services), encrypted in transit and at rest. We use Google Analytics 4 for website traffic and engagement measurement. It sets first-party cookies to recognise returning visitors and measure how the site is used; Google truncates visitor IP addresses and does not receive your name, email, or any of your expense data. We have not enabled Google Signals or Google Ads linking, so this data is not used for advertising personalisation.
6. Your rights
Depending on your location, you have the following rights:
- India (DPDP Act 2023): Right to access, correct, and erase your personal data. Right to withdraw consent at any time.
- Turkey (KVKK): Right to be informed, access, rectify, erase, and restrict processing of your personal data.
- EU / EEA (GDPR): Right to access, rectify, erase, restrict processing, data portability, and object to processing.
- All users: Right to unsubscribe from any communication, and to disconnect Google access, at any time. For WhatsApp reminders specifically, just reply STOP in the chat.
To exercise any of these rights, email vishant@corshift.com. We will respond within 30 days.
7. Third-party services
- Amazon Web Services (AWS) — hosting, message processing, and encrypted storage. AWS Privacy Notice
- Google — Google Sheets/Drive holds your expense ledger in your own Drive; purche.ai's access is scoped as described in Section 3, under the Limited Use terms. Google Privacy Policy
- WhatsApp (Meta) — the messaging platform your messages travel over, governed by Meta's own WhatsApp Business Platform terms, separately from Twilio's role below. WhatsApp Privacy Policy
- Twilio — our messaging provider; delivers and receives WhatsApp messages between you and purche.ai. Twilio Privacy Policy
- Anthropic — AI models used to read receipts (OCR) and answer spending questions. Anthropic Privacy Policy
- Google Analytics 4 — website traffic and engagement measurement. Sets first-party cookies; IP addresses are truncated and not stored by Google. Google Privacy Policy
- Google Fonts — font delivery. Your IP address is shared with Google when fonts load. Google Privacy Policy
8. Data retention
We retain WhatsApp account and message metadata for as long as your account is active, or until you request deletion. Your Google Sheet remains in your own Drive under your control even if you stop using purche.ai — we do not delete files from your Drive. If you request account deletion, we delete our stored copy of your data and revoke our access token within 30 days.
9. Changes to this policy
We may update this policy as purche.ai grows. We will notify users of material changes via WhatsApp. The "last updated" date at the top of this page reflects the most recent revision.
10. Contact
For any privacy-related questions or requests: vishant@corshift.com
See also our Terms of Service.