This policy explains how OB Receipt Box ("the App", "we", "us") — operated by Oriental Bonanza Enterprise Ltd. — collects, uses, and protects your information. We do not sell your personal data. Ever.
01
Information We Collect
To provide our expense and income tracking service for small business owners and self-employed individuals, we collect the following types of information:
Account Information
- Email address — used for account registration, login, and service notifications
- Password — stored in encrypted form; we cannot read your plaintext password
Business Data
- Expense records — costs you enter manually or via AI receipt scanning
- Income records — sales or revenue entries you record
- Receipt images — photos or PDFs you upload for AI recognition; kept securely in your account so you can review or download them later, and deletable by you at any time
- Bank statement images — screenshots or PDFs you upload for transaction extraction; kept securely in your account and deletable by you at any time
- Settings — business name, currency preference, category labels, etc.
Technical Data
- Device info — browser type, OS (used for compatibility)
- Usage logs — feature access records (used for troubleshooting)
- IP address — automatically recorded by our hosting infrastructure
02
How We Use Your Information
We use your information solely for the following purposes:
- Delivering, maintaining, and improving the core features of the App
- Processing receipt and bank statement images via AI to automatically extract data
- Sending service notifications directly related to your account (not marketing)
- Diagnosing technical issues and improving app stability
- Processing subscription payments through Stripe (we never store your card details)
Sharing with your accountant (only if you are affiliated with a firm)
If your account is affiliated with an accounting firm (because you accepted an invitation, or the firm created the account for you), your business data (receipts, sales, bank transactions, business profile and related documents) is made available to the relevant accountants at that firm so they can provide bookkeeping, review and tax-filing services to you; the firm's lead account may reassign which of its accountants handles your file. This is how the App's accountant-collaboration feature works and is not a sale or disclosure of data to third parties. If you end your affiliation with a firm, contact us to arrange data ownership.
We will never use your business data for advertising, sell it to third parties, or use it for any purpose beyond providing this service to you.
De-identified categorization conventions
To improve automatic categorization, we may derive de-identified, aggregated categorization conventions — for example, that a given merchant name generally maps to a particular expense category. These conventions do not contain your personal identity or financial figures and are our intellectual property, as described in our Terms of Service. We do not use your actual amounts, balances, or receipt contents for this purpose.
03
Data Storage & Security
Your data is stored on Amazon Web Services (AWS) with Canada (Montreal, ca-central-1) as the primary region: account and business data in an Amazon RDS PostgreSQL database, and receipt images and files in Amazon S3. AI recognition may be processed in AWS regions in the United States (see Section 4), under the same encryption and contractual protections. We apply the following security measures:
- Per-account isolation — each user can only access their own data; if you are affiliated with a firm, only that firm's relevant accountants can access it (see Section 2)
- Encryption in transit — all data transmitted via HTTPS/TLS
- Encryption at rest — database and file storage are encrypted at rest
- Login credentials — managed by Amazon Cognito; passwords are irreversibly hashed and we cannot read them
- Private networking — the database and file buckets are not exposed to the public internet; only the application backend can reach them
The receipt and bank statement images you upload are stored securely in your own account, encrypted at rest and isolated per account. You can view, download, or permanently delete any image at any time from within the App. When you delete a record or close your account, the associated images are removed as described in Section 5 (tax records are subject to the CRA's 6-year retention requirement).
04
Third-Party Services
The App relies on the following third-party services, each governed by their own privacy policy:
Amazon Web Services (AWS) — Cloud Infrastructure
Database, file storage, application hosting and email (Amazon RDS/S3/CloudFront/Cognito/SES), with Canada as the primary region. Privacy notice: aws.amazon.com/privacy
Amazon Bedrock (Anthropic Claude models) — AI Recognition
Receipt and bank statement images are processed by Claude models on Amazon Bedrock to extract data; processing may occur in AWS regions in the United States. Your images and data are not used to train AI models. Privacy notice: aws.amazon.com/privacy
Stripe — Subscription Payments
Handles subscription billing. We do not store your card information. Privacy policy: stripe.com/privacy
Google Sign-In (optional)
If you choose to sign in with Google, Google provides us with your email address to create your account; we do not access any other data in your Google account. Privacy policy: policies.google.com/privacy
05
Your Rights
Under Canada's PIPEDA and British Columbia's PIPA, you have the following rights:
- Access — view the personal information we hold about you at any time
- Correction — request corrections to inaccurate personal information
- Deletion — request deletion of your account and all associated data
- Data portability — export all your business data in CSV or Excel format
- Withdraw consent — close your account and stop data processing at any time
To exercise any of these rights, contact us using the details below. We will respond within 30 business days.
06
Cookies & Local Storage
The App uses the following technologies to maintain your session and preferences:
- Authentication cookies — keep you logged in; expire when you close the browser
- LocalStorage — stores UI preferences (e.g. language, display settings) locally on your device only
We do not use tracking cookies or third-party advertising cookies.
07
Children's Privacy
OB Receipt Box is designed for small business owners and self-employed adults. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor is using the service, please contact us immediately.
08
Policy Changes
We may update this Privacy Policy from time to time. For material changes, we will notify you by:
- Displaying an in-app notification banner
- Sending an email to your registered address
- Updating the "Last updated" date at the top of this page
Continued use of the service after the effective date constitutes acceptance of the updated policy.
09
Contact Us
For any privacy-related questions or data requests, please reach out: