This Privacy Policy explains how Expense Rescue ("we", "us", or "our") collects, uses, and protects your personal information when you visit our website and use our browser-based redaction tool. It also describes your rights under the General Data Protection Regulation ("GDPR") if you are in the European Economic Area ("EEA").
1. Data controller
The data controller responsible for your personal data is:
Rubber Duck Labs Inc.
Email: privacy@expenserescue.com
If you have any questions about how we handle your data or would like to exercise your GDPR rights, please contact us at the email address above.
2. What personal data we process
When you browse the website: We do not ask you to create an account or sign in. We may process limited technical data automatically when you load a page, such as your IP address, browser type, and device information, through our hosting and analytics providers.
When you use the redaction tool: The PDF or bank statement you open is processed entirely inside your browser on your own device. We do not receive, upload, store, or access the contents of your document.
3. How your documents are handled
Expense Rescue is designed to keep your financial documents private. The redaction tool uses Mozilla's PDF.js to read the PDF locally in your browser. All rendering, selection, and export logic runs on your device. The file is discarded as soon as you close or refresh the page. We cannot see the transactions, account numbers, or any other information in your statement.
4. Legal basis for processing (GDPR)
We process your personal data only where we have a legal basis to do so. The legal bases we rely on are:
- Legitimate interests — to operate and maintain the website, ensure security, and understand how visitors use the site.
- Consent — where required, for example for any optional cookies or marketing communications.
- Compliance with legal obligations — to respond to legal requests or protect our rights.
Because the redaction tool itself does not send your document to our servers, the processing that occurs when you use the tool is performed locally by you on your own device and is not a processing activity we carry out as a data controller.
5. Cookies and analytics
We do not set our own advertising or third-party tracking cookies. We use Lovable, our hosting platform, which may collect basic analytics data such as page views, performance metrics, and technical information. This helps us understand how the site is used and improve the experience. For details about how Lovable processes this data, please refer to Lovable's privacy policy.
6. Data retention
We do not retain the contents of any PDF you open in the redaction tool. Because the file is processed locally and never uploaded to our servers, we have no copy to keep. Technical analytics data may be retained by our hosting provider for the period described in their privacy policy.
7. International transfers
If you are in the EEA, your personal data may be transferred to countries outside the EEA for hosting or analytics purposes. We rely on appropriate safeguards, such as standard contractual clauses or the provider's certification under recognized data transfer frameworks, to protect your data.
8. Your rights under GDPR
Because we do not collect, process, or store personal data through the redaction tool or any account system, several GDPR rights are not applicable in relation to your use of the tool itself. However, the rights below are set out for completeness.
Rights not applicable to the redaction tool: because we do not hold any personal data about you or your documents, the following rights cannot be exercised against us: the right of access, the right to rectification, the right to erasure, the right to restrict processing, and the right to data portability.
Rights that may still apply:
- Right of access — ask what personal data we hold about you. This is generally not applicable because we do not hold identifiable personal data.
- Right to rectification — ask us to correct inaccurate data. Not applicable because we do not maintain personal data.
- Right to erasure — ask us to delete your personal data. Not applicable because we do not store your personal data or documents.
- Right to restrict processing — ask us to limit how we use your data. Not applicable because we do not process your personal data.
- Right to data portability — receive your data in a structured, machine-readable format. Not applicable because we do not hold your data.
- Right to object — object to processing based on legitimate interests, such as analytics or hosting-related data collection by our providers.
- Right to withdraw consent — withdraw consent at any time where we rely on it, for example for optional cookies or communications.
- Right to lodge a complaint — complain to your local data protection authority if you believe your rights have been infringed.
To exercise any of these rights that may apply, or if you have questions about why certain rights are not applicable, please contact us at privacy@expenserescue.com.
9. Children's privacy
Expense Rescue is not intended for children under 16. We do not knowingly collect personal data from children.
10. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version on this page with a revised "last updated" date. We encourage you to review this policy periodically.
11. Contact us
For privacy-related questions or data requests, please contact:
Rubber Duck Labs Inc.
Email: privacy@expenserescue.com