UtläggPrivacy Policy — LVSTR Expenses (Utlägg)
Last updated: 2026-10-10
Data controller: Lovestjärna Consulting AB, org. no. 559085-7842
Address: Ekåsvägen 1, 504 75 Borås, Sweden
Contact: kent@lovestjarna.se
1. The 30-second summary
- Your receipts stay on your phone. We do not store your data on our servers.
- AI extraction goes through our API, which proxies to Anthropic Claude. The receipt image (downscaled), your category names and a short instruction are sent for interpretation. The result comes back and the image is discarded by us immediately — Anthropic may retain the image for up to 30 days for safety and abuse handling (their standard retention).
- No ads. No tracking. No IDFA. No selling of data.
- No cookies. This is an app, not a website.
- Subscriptions are handled by Apple. We never see your card.
2. What data we process
2.1 On your device (stored locally, never leaves your phone)
- Receipt images (PDF/JPG/PNG) in the app's private storage
- Receipt data: date, vendor, amounts, VAT, category, notes
- Trips: date, from/to addresses, distance, car type
- Per diems: country, dates, standard amount, meal deductions
- Favourite places for addresses
- Supplier register: vendors you have bought from and the defaults the app learned from your receipts
- Calendar events are read only if you turn on trip suggestions yourself, only on the device, and are never stored
- Crash and hang reports from iOS (MetricKit) are kept locally until you choose to share them
- Your settings (business form, file format, reminders, etc.)
2.2 What leaves your device
| What | Where | Why | How long |
|---|---|---|---|
| Receipt image + extraction prompt | api.lvstrexpenses.app (Cloudflare Worker) → Anthropic Claude | AI interpretation of the receipt | With us: deleted right after the response. At Anthropic: up to 30 days |
identifierForVendor (Apple's non-tracking device ID) | api.lvstrexpenses.app | Count the 10 free AI scans and limit a Pro subscription to three devices | Cloudflare KV: the free counter has no expiry, the device list 31 days. Network addresses are counted per day (2 days) and masked in logs |
| Your category names | api.lvstrexpenses.app → Anthropic Claude | The AI suggests a category from your own list | Deleted right after the response |
| App Store transaction JWS (Pro users) | api.lvstrexpenses.app | Verify that you are a paying Pro user | Not stored — checked on every request |
Mail that suppliers or you send to your invoice inbox (<id>@lvstrexpenses.app): attachment (PDF/image), sender, subject | api.lvstrexpenses.app (Cloudflare Email Routing + KV) | Receive invoices and e-receipts by e-mail instead of photographing them | Deleted once the app has fetched them, at the latest after 30 days. At most 50 mails per inbox and day, PDF and images only |
| Receipts you email to your bookkeeping inbox (Fortnox, Bokio, Spiris) | Your own email provider → your bookkeeping system | You start every email yourself in Apple Mail | Per your email provider's and bookkeeping system's policies |
| Purchases and subscription | Apple (App Store) | Handle payment | Per Apple's policy |
| Addresses for route calculation | Apple (MapKit) | Suggestions and driving distance | Per Apple's policy |
| Exchange rates (requests) | Frankfurter (open data, ECB rates) | Convert receipts in foreign currency | Minimal logging — see frankfurter.dev |
2.3 What we do NOT collect
- No name, email address or phone number
- No GPS location (we have no location permission)
- No contacts, photos (beyond what you choose to import) or microphone. The calendar is read only if you turn on trip suggestions — and then only on the device
- No ads or advertising identifiers (no IDFA)
- No tracking cookies or analytics pixels
- No social media SDKs
3. Sub-processors
| Service | Role | Location | DPA |
|---|---|---|---|
| Anthropic, PBC | AI interpretation of receipts | USA | https://www.anthropic.com/legal/dpa |
| Cloudflare, Inc. | Hosting of our API server | Global, EU region | https://www.cloudflare.com/cloudflare-customer-dpa/ |
| Apple, Inc. | App distribution, subscriptions, MapKit | EU/USA | https://www.apple.com/legal/privacy/ |
Anthropic is a sub-processor under the GDPR. Lovestjärna Consulting AB has entered into Anthropic's standard DPA. Under its policy Anthropic may retain submitted receipt images for up to 30 days for abuse detection. The images are not used for AI training as long as we use the API (which we do).
4. Legal basis (GDPR Art. 6)
- Performance of a contract (6.1.b) — to deliver the AI interpretation you paid for or signed up for
- Legitimate interests (6.1.f) — to count free-tier usage so we can offer the service free of charge to new users
5. Transfers outside the EEA
Anthropic is based in the USA. Transfers take place under the EU Standard Contractual Clauses (SCC) included in Anthropic's DPA. The European Commission's adequacy decision for the USA (Data Privacy Framework, July 2023) applies to Anthropic.
6. Your rights (GDPR)
Because we do not store your data on our servers, there is no personal data held by us to request. But you always have the right to:
- Access, rectification, erasure, portability — in the app you can export your data at any time via More → Send records (SIE, PDF or CSV) or share individual receipts via AirDrop. You can erase all data by uninstalling the app.
- Withdraw consent — you can cancel your subscription at any time via the App Store. Uninstalling erases all data on the device.
- Complain — you have the right to lodge a complaint with our supervisory authority, the Swedish Authority for Privacy Protection (IMY), www.imy.se, or with the supervisory authority in the EU country where you live.
7. Security
- All traffic is encrypted with TLS 1.3
- No passwords or secrets are stored on the device beyond what the iOS Keychain protects
- Our API server runs in a sandboxed environment (Cloudflare Workers) without persistent disk storage
- Anthropic keys are stored only as Cloudflare Secrets — never in code, never in logs
- We log no receipt images or extracted fields server-side; network addresses are masked in logs
- Receipt files on the device are protected by iOS file encryption and are unreadable until you have unlocked the phone for the first time
8. Children
The service is not intended for children under 13 and we do not knowingly collect data from children.
9. Changes to this policy
If we make material changes we update the date above and notify you in the app at the next launch. Minor corrections (typos, clarifications) may be made without notice.
10. Contact
Questions, objections or requests: kent@lovestjarna.se
Lovestjärna Consulting AB
Ekåsvägen 1
504 75 Borås
Sweden