Last updated: 4 November 2025

This Privacy Notice for Checkchecker (“we,” “us,” or “our”) describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”).

Checkchecker is operated by Octopod Systems s.r.o., located at Štursova 638/43, Ústí nad Labem 40001, Czech Republic, which acts as the data controller for the personal data processed through our Services. This Privacy Notice may vary based on local laws and is not intended to override any mandatory local privacy or data protection laws.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services.

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by using our Table of Contents below to find the relevant section.

• •.What personal information do we process?
  When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. 

• •.Do we process any sensitive personal information?
  Some of the information may be considered “special” or “sensitive” in certain jurisdictions (for example, your racial or ethnic origins, sexual orientation, and religious beliefs). We do not actively request or process sensitive personal information. 

• •.How do we process your information?
  We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. 

  • •.Legal Bases: We process your data to provide the Services (contractual necessity). We rely on legitimate interests to improve our product and detect fraud. We rely on consent to send you marketing emails. 

• •.In what situations and with which parties do we share personal information?
  We may share information in specific situations and with specific third parties. 

• •.What are your rights?
  Depending on where you are located geographically, the applicable privacy law may grant you certain rights regarding your personal information. 

• •.How do you exercise your rights?
  The easiest way to exercise your rights is by submitting a data subject access request or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws. 

Want to learn more about what we do with the information we collect? Review the full Privacy Notice below.

Table of Contents

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register on the Services, express an interest in obtaining information about us or our products, participate in activities on the Services, or otherwise contact us.

• •.Sensitive Information: We do not actively request or process sensitive information. However, note that receipt data may sometimes reveal sensitive details (see Section 11). 

All personal information you provide must be true, complete, and accurate. You must notify us of any changes to such personal information.

In Short: Some information—such as your Internet Protocol (IP) address and browser/device characteristics—is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (e.g., name or contact information) but may include device and usage information such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services. This information is primarily needed to maintain the security and operation of our Services and for internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process personal information for a variety of reasons, depending on how you interact with our Services, including:

• •.To provide and maintain the Services (contractual necessity). 

• •.To improve our Services (legitimate interest). 

• •.To communicate with you (contractual necessity, legitimate interest, or consent, depending on the nature of the communication). 

• •.For security and fraud prevention (legitimate interest or legal obligation). 

• •.To comply with our legal obligations (legal obligation). 

• •.To send you marketing communications (consent or legitimate interest, as applicable). 

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

• •.Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. 

• •.Affiliates. We may share your information with our affiliates. Affiliates include our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us. 

• •.Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions. 

In Short: We may use cookies and other tracking technologies to collect and store your information.

We use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also permit certain third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements, tailor ads to your interests, or send abandoned shopping cart reminders (depending on your communication preferences). These third parties use their technology to provide advertising about products and services tailored to your interests, which may appear on our Services or on other websites. Refer to our separate Cookie Notice for more details on how we use such technologies and how you can refuse certain cookies.

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details (e.g., Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the provider but will often include your name, email address, friends list, and profile picture, as well as other information you choose to make public.

We will use the information we receive only for the purposes described in this Privacy Notice or that are otherwise disclosed to you on our Services. We do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend reviewing their privacy policies to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their platforms.

In Short: We may transfer, store, and process your information in countries other than your own.

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless otherwise required by law.

We retain personal data for as long as you maintain an active account. After account deletion, we typically keep data for up to six months for backup and dispute resolution purposes, unless a longer retention period is required by tax, accounting, or other laws.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information. If this is not possible (for example, because personal information is stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is feasible.

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect or solicit data from, or market to, children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to their use of the Services. If we learn that personal information from users under 18 has been collected, we will deactivate the account and delete such data from our records as promptly as possible. If you become aware of any data we may have collected from children under 18, please contact us at privacy@octopodsystems.com.

In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Your rights may include (depending on local law):

• •.Right to Rectification: Fix incorrect data. 

• •.Right to Erasure (“right to be forgotten”): Request deletion of data in certain circumstances. 

• •.Right to Restrict or Object to certain processing (especially direct marketing). 

• •.Right to Data Portability: Request a copy of your data in a structured, commonly used format (for data processed on the basis of consent or contract). 

If you would like to review or change the information in your account or terminate your account, please contact us at privacy@octopodsystems.com.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, or comply with applicable legal requirements.

Most web browsers and some mobile operating systems and applications include a Do-Not-Track (DNT) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked. If a standard for online tracking is adopted that we must follow in the future, we will inform you in a revised version of this Privacy Notice.

We use third-party service providers to assist us in digitizing and extracting data from your receipts.

• •.What Data Is Shared?
  When you upload a photo or PDF of your receipt, the image is transmitted to Azure Document Intelligence for optical character recognition (OCR). The extracted text is then returned to us for processing. 

• •.Why We Use It
  We rely on Azure Document Intelligence to provide accurate and efficient OCR so that we can transform your receipts into structured data (e.g., item names, prices, stores). 

• •.Legal Basis
  We process and share this data under our legitimate interest to provide and improve our Services, or for contract performance if our Terms of Service specify that receipt digitization is part of the contracted service. 

• •.Location and Safeguards
  Your data may be transferred outside your country. Where such transfers occur, we rely on appropriate safeguards (such as Standard Contractual Clauses) to ensure compliance with EU data protection law. 

• •.Data Protection Agreement
  We have a Data Processing Agreement in place with Microsoft to ensure that any personal information processed via Azure Document Intelligence is handled in accordance with the GDPR and other applicable privacy laws. 

• •.What Data Is Shared?
  After the OCR phase, the extracted text may be processed by OpenAI’s language models (e.g., for categorization or item tagging). 

• •.Why We Use It
  We use OpenAI’s AI-powered services to improve the accuracy of expense categorization, offer better budget insights, and continuously enhance our automated features. 

• •.Legal Basis
  Similar to the OCR process, we rely on our legitimate interest or contract performance as the lawful basis for using OpenAI’s services. 

• •.Location and Safeguards
  Data may be transferred and stored on servers located outside the EU/EEA. When that happens, we use approved transfer mechanisms such as Standard Contractual Clauses to protect your data. 

• •.Data Protection Agreement
  We also maintain a Data Processing Agreement with OpenAI to ensure GDPR-compliant handling of any personal data transmitted during the analysis phase. 

Please note that receipts can sometimes contain information that could reveal health data, religious affiliation, or other potentially sensitive details (e.g., a pharmacy purchase). While we do not actively request or intend to collect sensitive personal data, such data may be inadvertently processed by Azure Document Intelligence and OpenAI. We take the following measures to protect your information:

• •.We use encrypted connections (HTTPS/TLS) when transmitting data to our third-party providers. 

• •.We limit the scope of data shared to what is strictly necessary for the OCR and categorization process. 

• •.We have contractual obligations (Data Processing Agreements) with these providers to ensure compliance with the GDPR and other applicable privacy laws. 

If you have concerns about the handling of potentially sensitive data, we encourage you to redact or remove such information from the receipt images before uploading, where feasible. You can also contact us at privacy@octopodsystems.com for additional information on how we safeguard your data.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated “Last updated” date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to remain informed about how we are protecting your information.

If you have questions or comments about this notice, you may contact us by post at:

Octopod Systems s.r.o.
Štursova 638/43
Ústí nad Labem 40001
Czech Republic

Or by email at privacy@octopodsystems.com.

Based on the applicable laws of your country, you may have the right to request:

• •.Access to the personal information we collect about you, 

• •.Details about how we have processed it, 

• •.Correction of inaccuracies, or 

• •.Deletion of your personal information. 

You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in certain circumstances by applicable law.

To request to review, update, or delete your personal information, please fill out and submit a data subject access request or contact us at privacy@octopodsystems.com.