← Back to Levamio Receipt Vault
Privacy Policy "Levamio Receipt Vault" (app for iOS and Android)
1. Controller
NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO, Building A1, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (DIEZ License No. 67837), represented by Tassilo Peter Seitz. Levamio is offered by NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO ("we").
Privacy contact: [email protected] (general support: [email protected]).
EU representative (Art. 27 GDPR): We are not established in the EU. You can always contact us directly with any data protection matter.
2. Key points
- No account. We do not know your name or e-mail address.
- Your receipts stay on your device, encrypted (AES-256) with the key in the iOS Keychain / Android Keystore. There is no Levamio cloud for your receipts.
- Only when you choose "Scan with AI" and have expressly consented do we send the photo or PDF of the receipt via our server to our AI provider Anthropic (USA) to suggest shop, product, date, price and deadlines. Our server does not store the receipt.
- You can always add receipts by hand – then nothing is transferred.
- Backups are encrypted files you create and store yourself (e.g. iCloud Drive, Google Drive). We never receive them.
- No tracking, no advertising, no analytics tools.
3. Overview: what we process, why, and on which legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| AI scan of a receipt (only on request) | photo (JPEG, reduced to approx. 2.4 megapixels) or PDF (max. 6 MB), max. 5 pages, with everything on it (e.g. shop, products, prices, possibly name, customer number or last card digits); app language; date; consent version and age confirmation | Art. 6(1)(a) and (b); for any special categories (e.g. health-related pharmacy receipts) Art. 9(2)(a) (explicit consent) |
| Free quota (20 AI scans), abuse and cost protection | random device ID created by the app (no hardware ID); on the server only a salted hash with counters; IP address (IPv6 shortened to /64) only as a daily re-salted hash with a counter | Art. 6(1)(f); storing/reading the device ID on your device: necessary for the service you use (Art. 5(3) ePrivacy Directive) |
| Device check for free scans (attestation) | iOS: Apple App Attest attestation and key ID; Android: Play Integrity token checked with Google; one-time challenge; note "device verified" stored with the hash for 30 days | Art. 6(1)(f) |
| "Report AI result" | reason, optional comment, technical details (prompt version, model, language, app version); the AI result only with separate consent – never the photo | Art. 6(1)(f); for included content Art. 6(1)(a) (and Art. 9(2)(a) where applicable) |
| Checking and unlocking the subscription (only when needed, section 7) | device ID as RevenueCat customer ID, subscription status, store receipts, product, store country, device and app details | Art. 6(1)(b) |
| Vault on your device | receipts (name, shop, date, amount, category, country, deadlines, notes) and receipt files – only locally, encrypted | Art. 6(1)(b); storage on your device at your request |
| Reminders | deadline dates; local notification with neutral text without shop or product | Art. 6(1)(b) |
| Operation and troubleshooting | technical metrics without content, ID or IP address (outcome, duration, page count, token count, rule interventions), sample of approx. 10 % of requests; Cloudflare technically processes the IP address (request logs switched off) | Art. 6(1)(f) |
| Support | your message, e-mail address, subscription details if relevant | Art. 6(1)(b), otherwise (f) |
You are not obliged to provide data; without consent you can use the app without AI. We do not make automated decisions with legal effect (Art. 22 GDPR). We do not sell your data or use it for advertising.
4. AI scan of your receipt
Consent: Before the first AI scan the app shows a separate notice explaining what is sent to whom, that our server stores nothing and that receipts may contain sensitive information. It states: "Our server does not store your receipt. According to Anthropic, it stores the request for up to 30 days to detect misuse (longer only if a violation of its usage policies is found) and does not use it for training." Nothing is sent until you tick the consent box and the box "I am at least 16 years old." and tap "Agree and continue". Without both our server rejects the scan. If recipients or scope change, we ask again.
Special categories (Art. 9 GDPR): Receipts can reveal health (e.g. pharmacy), religious or other sensitive information. We ask for your explicit consent for this. You can enter such receipts by hand instead.
Process: The app reduces photos on the device and sends them encrypted (HTTPS) to our server at Cloudflare. The server checks file type, size, consent and quota and passes the pages, in memory only, to Anthropic (model "Claude Haiku"; if overloaded or the answer is invalid, once another Claude model of the same provider). The AI returns structured values only (shop, date, amount, items; warranty and return periods only with a verbatim quote from the receipt). Our server removes detected payment card and account numbers and stores neither the receipt nor the result. You check every value before anything is saved in the vault.
Anthropic: Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, processes the data as our processor under its commercial terms and data processing addendum; the data is not used for training. According to Anthropic's current information it stores requests for up to 30 days for misuse detection, longer only if a policy violation is found or the law requires it.
AI labelling: AI suggestions are marked "AI" in the app (Art. 50 EU AI Act) and may contain mistakes.
5. Data on your device
Receipts, files, deadlines and settings are stored only on your device. Receipts and files are encrypted with AES-256; the key is kept in the iOS Keychain (this device only, no iCloud sync) or the Android Keystore. Automatic cloud backups of app data are disabled on Android. "Settings → Delete all local data" deletes receipts, files, reminders and the key; uninstalling removes app data.
Exports and backup: PDF, CSV and ZIP exports are created by you and shared via your device's share menu; they are not encrypted (notice in the app). The backup is a file encrypted with your password (AES-256, PBKDF2 key derivation with 600,000 iterations). Where you store exports and backups (e.g. iCloud Drive, Google Drive) is your choice; the terms of that provider apply. We never receive these files and cannot recover your backup password.
Shared files: If you share a PDF invoice or photo "to Levamio" from another app, the app reads only that file.
6. Free quota, abuse protection and device check
To prevent abuse of the free AI scans our server counts, per salted hash of the device ID, the scans (up to 20 free) and requests per period, and per daily salted IP hash the free scans of a day. For free scans the server checks once per device ID via Apple App Attest or Google Play Integrity that the request comes from a genuine installation of the app and remembers the result for 30 days. Apple and Google process data under their own terms. Subscribers need no device check.
6a. Report AI result
You can report wrong or inappropriate AI results. We store the reason, an optional comment and technical details – without device ID or IP address; the AI result only if you tick the separate box. Photos and files are never sent. Reports are deleted automatically after 90 days.
7. Subscription and purchases
You buy the yearly subscription in the Apple App Store or on Google Play; payment, invoicing, cancellation and refunds are handled by the store as an independent controller. We receive no payment data. We use RevenueCat (RevenueCat, Inc., USA) as processor for subscription management (device ID as customer ID, store receipts, status, product, price, store country, technical details, IP address). Only when needed: the app connects to RevenueCat only when you open the subscription page, buy or restore, reach the free limit, or a subscription is known on the device; our server asks RevenueCat only when the free quota is used up or the app requests a subscription check.
8. Retention
- Receipts and scan results on our server: not stored (only during the request); exception section 6a.
- At Anthropic: currently up to 30 days (section 4).
- Hashes and counters: rate limits 15 minutes to 2 days; free quota 400 days from first use; device-check note 30 days; IP hash 2 days; challenge 15 minutes; subscription cache 24 hours.
- Reports: 90 days. Technical metrics/server logs: max. 7 days.
- Subscription data at RevenueCat: while the subscription exists, then according to RevenueCat's retention rules or legal obligations.
- Data on your device, exports, backups: until you delete them.
- Support requests: up to 3 years after completion.
9. Recipients and third countries
| Service | Purpose | Location | Safeguard |
|---|---|---|---|
| Cloudflare | server (Worker), counters, reports, logs, network | Cloudflare, Inc., USA; nearest location worldwide | data processing agreement; SCC or DPF where applicable |
| Anthropic | AI scan | Anthropic PBC, USA | DPA; SCC or DPF where applicable |
| RevenueCat | subscription management | RevenueCat, Inc., USA | data processing agreement; SCC or DPF where applicable |
| Apple / Google | distribution, purchases, subscriptions, system functions (camera, notifications, sharing), device check | Apple Distribution International Ltd., Ireland / Apple Inc., USA; Google Ireland Ltd., Ireland / Google LLC, USA | independent controllers under their terms |
USA: EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR) where the recipient is certified, otherwise Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures (encryption in transit, no storage by us, data minimisation).
United Arab Emirates: We as controller are based in the UAE (no adequacy decision). Receipt data does not reach our systems in the UAE because we do not store it; reported AI results (section 6a) may be viewed from the UAE via secure connections.
10. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20; the app offers CSV/ZIP export) and objection (Art. 21 GDPR). You can withdraw your consent at any time in "Settings → AI scanning consent" (Art. 7(3)); this does not affect processing before the withdrawal.
Right to object (Art. 21 GDPR): Where we process data based on legitimate interests (Art. 6(1)(f) GDPR) you may object at any time on grounds relating to your particular situation. We will then stop unless we demonstrate compelling legitimate grounds or the processing serves legal claims. An informal message to [email protected] is sufficient.
As we keep no accounts and store no receipts, we only hold hashes with counters and – for subscriptions – data at RevenueCat. For access or erasure please tell us the device ID shown in "Settings → Device ID"; without it we cannot identify your data (Art. 11 GDPR). You can lodge a complaint with a supervisory authority, in particular in the EU/EEA state of your residence or workplace; in the UK with the ICO, in Switzerland with the FDPIC. Residents of other countries may have additional rights under local law; contact [email protected].
11. Children
The app is intended for adults. AI scanning may only be used from the age of 16 (cf. Art. 8 GDPR); without the age confirmation our server rejects the scan. We do not knowingly collect data from children.
12. Security
Encrypted transfer (HTTPS), no storage of receipts on the server, file type and size checks, instruction to the AI to treat receipt text only as data, validation of AI answers against a fixed schema, removal of card/account numbers, salted hashes instead of IDs and IP addresses, device check for free scans, emergency switch for the AI function, encrypted vault with key in Keychain/Keystore, password-encrypted backup, neutral lock-screen notifications.
13. Changes
We update this policy when features, providers or the law change. If changes affect your consent, the app asks again. The current version is available in the app and at https://levamio.com/apps/beleg-tresor/datenschutz-en/.
As of: 21 October 2026