This Privacy Policy explains how Expense Rescue ("we", "us", or "our") collects, uses, and protects your personal information when you visit our website and use our browser-based redaction tool. It also describes your rights under the General Data Protection Regulation ("GDPR") if you are in the European Economic Area ("EEA").
1. Data controller
The data controller responsible for your personal data is:
Rubber Duck Labs Inc.
Email: privacy@expenserescue.com
If you have any questions about how we handle your data or would like to exercise your GDPR rights, please contact us at the email address above.
2. What personal data we process
When you browse the website: We do not ask you to create an account or sign in. We may process limited technical data automatically when you load a page, such as your IP address, browser type, and device information, through our hosting and analytics providers.
When you use the redaction tool: The PDF or bank statement you open is processed entirely inside your browser on your own device. We do not receive, upload, store, or access the contents of your document.
3. How your documents are handled
Expense Rescue is designed to keep your financial documents private. The redaction tool uses Mozilla's PDF.js to read the PDF locally in your browser. All rendering, selection, and export logic runs on your device. The file is discarded as soon as you close or refresh the page. We cannot see the transactions, account numbers, or any other information in your statement.
4. Legal basis for processing (GDPR)
We process your personal data only where we have a legal basis to do so. The legal bases we rely on are:
- Legitimate interests — to operate and maintain the website, ensure security, and understand how visitors use the site.
- Consent — where required, for example for any optional cookies or marketing communications.
- Compliance with legal obligations — to respond to legal requests or protect our rights.
Because the redaction tool itself does not send your document to our servers, the processing that occurs when you use the tool is performed locally by you on your own device and is not a processing activity we carry out as a data controller.
5. Cookies, analytics and advertising
Visit counting by Lovable. Our hosting platform, Lovable, counts visits to the site. It uses no cookies, stores nothing on your device, doesn't keep IP addresses and doesn't identify you. It records the pages you visit, where you came from, your country, browser, operating system and device type, how long you stay, how fast pages load, errors, and which buttons and links you click. Detailed data is kept for 90 days and daily summaries for a year. Lovable collects this data for us. Lovable's privacy policy explains how it handles it.
Google Analytics 4 (Google Ireland Limited / Google LLC) helps us understand how the site is used. It sets cookies and may process your IP address (truncated), browser, device, operating system, approximate location, pages viewed, session duration and referring site. Data is kept for up to 14 months.
When analytics is allowed, we also record the steps of opening a statement, selecting a transaction, clicking download, completing the review and successfully generating a redacted PDF for download. A download event does not confirm that the file was retained on your device or accepted for reimbursement. An optional survey records whether the document was created for employee expense reimbursement (Yes or No), a satisfaction rating from 1 to 5, and an optional predefined improvement category for ratings of 3 or below. These answers go to Google Analytics when analytics is allowed. Lovable Analytics also receives the fact that a redacted statement was saved and the chosen export scope, subject to analytics choices. We do not collect written feedback, company names, file names, transaction amounts, dates, merchant names or statement contents through these events. Skipping the survey does not affect your download.
Google Ads (Google Ireland Limited / Google LLC) tells us whether a visit from one of our ads led to someone saving a redacted statement. When advertising is allowed, the Google Ads tag sets cookies and records the ad click and the fact that a statement was saved. It never receives the file name, amounts or any content of your statement.
Your choices. If you are in the EU/EEA, the UK, Switzerland or Canada, or we can't tell where you are, Google Analytics, Google Ads and Lovable's click recording stay off until you accept them in the cookie banner. Everywhere else they are on unless you turn them off. If your browser sends Global Privacy Control, they stay off, even if you accepted. Page visits, time on page, page speed and errors are counted by Lovable for every visitor, without cookies and without identifying anyone. You can change your choice at any time with the Cookie settings link in the footer; it is saved in your browser for up to 12 months.
Google may transfer data to the United States. We rely on the EU–US Data Privacy Framework and standard contractual clauses as safeguards. None of these services ever receive the contents of a statement you open in the redaction tool — that processing stays entirely in your browser.
6. Data retention
We do not retain the contents of any PDF you open in the redaction tool. Because the file is processed locally and never uploaded to our servers, we have no copy to keep. Google Analytics data is retained for a maximum of 14 months, after which it is deleted automatically. Lovable keeps detailed visit data for 90 days and daily summaries for a year. Technical data may be retained by our hosting provider for the period described in their privacy policy.
7. International transfers
If you are in the EEA, your personal data may be transferred to countries outside the EEA for hosting or analytics purposes. We rely on appropriate safeguards, such as standard contractual clauses or the provider's certification under recognized data transfer frameworks, to protect your data.
8. Your rights under GDPR
Because we do not collect, process, or store personal data through the redaction tool or any account system, several GDPR rights are not applicable in relation to your use of the tool itself. However, the rights below are set out for completeness.
Rights not applicable to the redaction tool: because we do not hold any personal data about you or your documents, the following rights cannot be exercised against us: the right of access, the right to rectification, the right to erasure, the right to restrict processing, and the right to data portability.
Rights that may still apply:
- Right of access — ask what personal data we hold about you. This is generally not applicable because we do not hold identifiable personal data.
- Right to rectification — ask us to correct inaccurate data. Not applicable because we do not maintain personal data.
- Right to erasure — ask us to delete your personal data. Not applicable because we do not store your personal data or documents.
- Right to restrict processing — ask us to limit how we use your data. Not applicable because we do not process your personal data.
- Right to data portability — receive your data in a structured, machine-readable format. Not applicable because we do not hold your data.
- Right to object — object to processing based on legitimate interests, such as analytics or hosting-related data collection by our providers.
- Right to withdraw consent — withdraw consent at any time where we rely on it, for example for optional cookies or communications.
- Right to lodge a complaint — complain to your local data protection authority if you believe your rights have been infringed.
To exercise any of these rights that may apply, or if you have questions about why certain rights are not applicable, please contact us at privacy@expenserescue.com.
9. Children's privacy
Expense Rescue is not intended for children under 16. We do not knowingly collect personal data from children.
10. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version on this page with a revised "last updated" date. We encourage you to review this policy periodically.
11. Contact us
For privacy-related questions or data requests, please contact:
Rubber Duck Labs Inc.
Email: privacy@expenserescue.com