Privacy Policy

1. Who We Are

Div/Sum ("we", "us", "our") is a bill-splitting application available on iOS, Android, and the web. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Div/Sum app. If you have any questions, contact us at hello@divsum.app.

2. Data We Collect

We collect the following categories of data:

• Account data: your email address, display name, and optional payment handle (e.g. your Revolut, Venmo, or PayPal username). • Profile preferences: avatar colour, preferred currency, and app theme — stored to personalise your experience. • Photos and images: receipt photos you upload for scanning. These are processed by our AI and stored to provide the service. • Financial information: bill item names, prices, quantities, and who they are assigned to within your splits. • Social / connection data: when you connect with another user, we store both parties' names and email addresses, and the status of that connection (pending, approved, or declined). • Authentication identifiers: unique session tokens and user IDs generated by our platform to authenticate you and secure your data. These are transmitted off your device to our servers. • Device and technical data: device type, operating system, browser or app version, and IP address — collected for security and debugging purposes. • Usage data: app activity such as when you create or complete a split, to improve the service.

3. How We Use Your Data

We use your data to:

• Provide the core bill-splitting service. • Process receipt images using AI to extract item and price data. • Enable personalised payment link generation for Revolut, Venmo, and PayPal. • Manage your social connections and friend network within the App. • Send in-app notifications about shared bills, connection requests, and payment status. • Authenticate your identity and keep your account secure. • Improve, debug, and optimise the App. • Comply with legal obligations.

We do not sell your personal data to third parties. We do not use your receipt data or images to train AI models without your explicit consent. We do not use your data for advertising or behavioural profiling.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your data under the following legal bases:

• Contract performance: processing your account data and splits to provide the service you signed up for. • Legitimate interests: improving the App, preventing fraud, and ensuring security. • Consent: where you have explicitly agreed (e.g. optional features). • Legal obligation: where required by applicable law.

5. Data Sharing

We share your data only in the following circumstances:

• Service providers: we use trusted third-party services (including cloud infrastructure and AI providers) to operate the App. These providers are contractually bound to handle your data securely and only for the purposes we specify. • Other users: your display name and split information are visible to other users you split bills with. When you connect with another user, both parties can see each other's names and email addresses. • Payment platforms: when you share a payment link (Revolut, Venmo, PayPal), your payment handle is included in that link. These platforms have their own independent privacy policies. • Legal requirements: if required by law or to protect the rights, property, or safety of Div/Sum or its users.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. Receipt images are stored to provide the service and are accessible until you delete the associated receipt. Upon account deletion, we delete your personal data within 30 days, except where retention is required by applicable law.

7. Your Rights

Depending on your location, you may have the following rights:

• Access: request a copy of the personal data we hold about you. • Correction: request correction of inaccurate or incomplete data. • Deletion: request deletion of your account and all associated data. You can also do this directly via the Profile page in the App. • Portability: request your data in a machine-readable format. • Objection: object to certain types of processing. • Withdrawal of consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at hello@divsum.app. We aim to respond within 30 days as required by applicable law.

8. Cookies, Local Storage, and Tracking

Div/Sum uses minimal cookies and local storage solely for authentication (to keep you logged in) and user preferences (such as theme and language). We do not use advertising trackers, third-party marketing cookies, or behavioural profiling technologies. We do not sell browsing data. We may use anonymous, aggregated analytics to understand overall app usage patterns.

9. Device Permissions

The App may request the following device permissions:

• Camera: to photograph receipts for scanning. Access is only used when you actively initiate a scan. • Photo library / media access: to select existing receipt images from your device.

All permissions are optional and requested only when needed. You can revoke them at any time in your device settings. Revoking a permission may limit certain App features.

10. Security

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. This includes encrypted data transmission (HTTPS/TLS), server-side access controls enforced at the API layer, and regular security reviews. Session tokens are used to authenticate every request and are stored securely. However, no system is completely secure, and we cannot guarantee absolute security.

11. Children's Privacy

Div/Sum is not intended for children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it promptly. If you believe we have inadvertently collected data from a child, please contact us at hello@divsum.app.

12. International Data Transfers

Your data may be processed and stored on servers located outside your country of residence. Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place in accordance with applicable data protection law, such as standard contractual clauses.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the App or applicable law. We will notify you of significant changes via the App or by email. Continued use of the App after changes are posted constitutes acceptance of the updated policy. The "last updated" date at the top of this page reflects the most recent revision.

14. Contact

For privacy-related questions, data requests, or concerns, contact us at hello@divsum.app. We aim to respond within 5 business days.