Invoice Reader Privacy Notice Supplement

Information and Purpose

We process receipts and invoices you upload, capture, or import, including any personal information visible in those documents. We use document contents, filenames, file and folder identifiers, source hashes, connected-account labels and identifiers, extracted fields, draft edits, and activity records to identify the connected account, preserve receipt sources, prepare invoices for review, and support authorized accounting and recordkeeping. Authorized Operations users can review saved sources and drafts in the shared business workspace; these are not private to the person who connected the cloud account.

Google Drive and Microsoft OneDrive Access

Current Google access uses only drive.file, for files created by or explicitly made available to this app. Broader Google Drive access is not configured. Entering a scanner folder ID does not grant access to arbitrary files in that folder. Any future broader access would require updated disclosures and separate consent before use.

Microsoft access requests delegated Files.ReadWrite plus offline_access. The file permission can authorize reading, creating, changing, and deleting the signed-in user's files, not just files in one folder. Invoice Reader restricts its file operations to its configured scanner inbox and receipt archive through application checks. This is an application restriction, not a folder-only permission enforced by Microsoft. Offline access allows token renewal so an authorized connection can continue without signing in for each operation; Google connections also request offline access.

Storage and Receipt Copies

OAuth access and refresh tokens are encrypted before storage in the server-side database. The application uses server-held keys to decrypt them for authorized provider requests. Invoice metadata, drafts, extracted fields, connection records, and audit events are stored in Netlify Database.

Receipt file copies are saved in the app-created receipt archive in the selected connected provider, Google Drive or OneDrive. Scanner imports copy the selected source into that archive; Invoice Reader does not delete scanner originals. A separately configured scanner integration can initiate imports, but an import does not itself start OCR or post accounting entries. Access controls and encryption reduce risks but cannot guarantee perfect security.

Optional Invoice Extraction

When configured, Azure AI Document Intelligence processes a receipt only after a user manually selects Read invoice. The server sends the saved receipt bytes, including information visible on its pages, to Azure for extraction. Returned invoice fields are saved to the draft for review. Uploading or importing alone does not request extraction. OCR does not automatically post accounting entries; posting requires a separate owner action and review confirmation. Manual review remains available without OCR.

Camera and Device Storage

The in-app camera does not save captures to your photo gallery or intentionally persist captures in browser storage. Temporary captures are held in page memory; the app releases its temporary copies after a confirmed upload or when the page closes. Browser or operating-system caching is outside our control, so this is not a guarantee of device-level erasure. Saved receipt sources remain in the cloud archive, and closing the camera or page does not delete them. Existing files selected from your device also remain on that device.

Disconnect, Retention, and Privacy Requests

The workspace owner can disconnect a provider in Invoice Reader. Disconnect removes the app's stored connection and tokens to stop future use of that connection by the app. It does not revoke permission at Google or Microsoft; revoke that permission separately in your provider account settings. Neither action recalls data already sent or necessarily cancels requests already in progress.

Disconnecting or revoking permission does not delete receipt archives, scanner originals, saved drafts, or accounting and audit records. Records may be retained for applicable business, accounting, warranty, dispute, or legal requirements described in our base Privacy Notice. Providers may also retain data under their own terms, settings, and retention practices; disconnect is not a provider deletion request.

To request access, correction, a copy, deletion, or withdrawal of future use, contact ronbaker@yampabasingroup.com or call or text (970) 629-6862. We may verify identity and authority and explain any records we need to retain. Do not send passwords, access tokens, or unrelated sensitive documents with your request.

Provider Privacy References

Provider handling is also described in the Google Privacy Policy, Microsoft Privacy Statement, Azure Document Intelligence data privacy information, and Netlify Privacy Policy. These references do not replace the terms applicable to a particular provider account or service.