Privacy Policy

1. What information we collect

Information you provide directly

• Account information: Your email address and password when you create an account.
• Order data: Amazon order history you upload (via CSV, PDF, or receipt image) or that the browser extension imports from your Amazon account pages. This includes order numbers, dates, item titles, ASINs, quantities, prices, taxes, discounts, and return information.
• Payment information: If you subscribe to a paid plan, your payment is processed by our payment processor. We do not store your credit card number, billing address, or other payment details on our servers.
• Support communications: If you contact us by email, we keep a record of that correspondence.

Information collected automatically

• Usage data: Pages visited within the app, features used, and general interaction patterns. This helps us understand what's working and what isn't.
• Technical data: Browser type, operating system, and approximate location (country/region) derived from your IP address.
• Error logs: Crash reports and error events, with the technical context of what failed and the account it happened to. A short replay of the moments before a crash can include whatever was on screen at the time.

Information collected by the browser extension

The AmazaSpend browser extension imports orders from your Amazon account pages: your order history, order details, invoices, and returns. It works on these pages when you visit them, and when you sync it opens them in background tabs to bring in the orders you have not added yet. It captures:

• Order numbers, dates, and marketplaces
• Item titles, ASINs, quantities, and prices
• Taxes, discounts, fees, and shipping costs
• Delivery dates, and return and refund information where present
• The payment method shown on the order, such as the card type and its last four digits, so you can see which card paid

The extension does not capture:

• Your Amazon username, password, or any login credentials
• Shipping addresses
• Full card numbers, bank account numbers, or any other payment credentials
• Amazon pages other than your orders, invoices, and returns. On other Amazon pages it only checks whether you are signed in to Amazon, so it can pause a sync and let you know.
• Your activity on any other website

Order data the extension captures is sent directly to your AmazaSpend account over an encrypted HTTPS connection.

How the extension is used: The extension also tells us which of its screens you open and which of its buttons you press, and how each sync went: when it started and ended, how many orders it added, whether it was stopped or resumed, and the type of Amazon page where an order could not be imported. These reports are tied to your account. They never include order numbers, item titles, prices, or the content of any page. In Firefox this is the optional "technical and interaction data" permission, which you can switch off in the add-on's settings.

What stays on your device: To work, the extension keeps a few things in its own private storage: your AmazaSpend sign-in and email address, the progress of a sync (including the order numbers it still has to bring in), and the orders it has not been able to import yet, so it can try them again. Signing out of the extension removes your sign-in, and removing the extension deletes all of it.

2. How we use your information

We use your information to:

• Provide the Service: Store, process, and display your order data as analytics, charts, and insights
• AI processing: Send your order data to Google Gemini's API to categorize purchases, generate Discipline Scores, and produce spending insights. See Section 4 for details.
• Improve the Service: Understand how features are used and where people get stuck, so we can fix and improve them (see Section 4)
• Send service communications: Account confirmations, billing receipts, and important updates about the Service. We do not send marketing emails without your explicit opt-in.
• Respond to support requests: If you contact us, we use your information to respond
• Comply with legal obligations: Where required by applicable law

We never sell your data, we never use your order data for advertising, and we do not use it to train AI models.

We may use aggregated, anonymized patterns from across our user base, such as which product categories are most common, what types of purchases are frequently miscategorized, or which features are used most to inform product decisions and develop new features. This analysis is done at an aggregate level and does not involve reading or acting on any individual user's order data.

3. How we store and protect your data

Your data is stored on servers located in the United States. We use industry-standard security practices including:

• Encryption in transit (HTTPS/TLS) for all data sent between your browser or extension and our servers
• Encrypted storage for authentication credentials
• Access controls that limit which team members can access user data

No method of transmission or storage is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security.

We retain your data while your account is active. Deleting your account deactivates it and anonymizes your profile by removing your name and email. Order, budget and settings records may remain. For additional data deletion, contact [email protected] with details of your request. We will explain any retention needed for legal or compliance purposes. See our account-deletion page for the current steps.

4. Third-party services

We share data with the following third parties to operate the Service:

Google Gemini (AI processing)

When you upload an invoice or the browser extension captures an order, we may send your order data to Google's Gemini API for parsing, categorization, and insight generation. This data includes item titles, prices, and order metadata. It does not include your Amazon credentials or payment information.

Google's use of this data is governed by the Google Cloud Privacy Notice. We use the API under terms that restrict Google from using submitted data to train their models.

Payment processor

Payments for Pro subscriptions are handled by our payment processor. We share only what is necessary to complete the transaction (email address and subscription details). Your full payment details are handled entirely by the processor and never touch our servers.

Hosting and infrastructure

We use cloud hosting providers to run our servers and store data. These providers act as data processors under our instruction and are contractually bound to protect your data.

Product analytics and session recordings

We use PostHog to understand how the Service is used: which pages and screens people open, which buttons they press, and where they get stuck. Because it helps us support your account, this is tied to your account rather than anonymous, and PostHog sets cookies in your browser.

PostHog also records sessions, which is a replay of what happened on screen: taps, scrolls, and the pages you moved through. What you type is hidden from these recordings, and so are passwords and other form fields. On the website, the page content around you can be visible in a recording, which can include your order titles and amounts. In the mobile app, every piece of text and every image is hidden, and the Amazon window inside the app is never recorded at all. Recordings are deleted after 30 days.

You can turn all of this off. On the website, switch off Product analytics in Settings; that browser then stops capturing entirely. Turning it off does not affect anything else about your account.

Error monitoring

We use Sentry to find crashes and errors. When something breaks, it records the technical detail of the failure along with the account it happened to, and a short replay of the moments before it, so we can reproduce and fix the problem.

Advertising measurement

When we run ads, we use the Meta pixel and Meta's Conversions API, the ChatGPT ads pixel and Conversions API from OpenAI, and at times a Google Ads tag or Microsoft Advertising's UET tag, to learn which ads led to signups. These receive the fact that a visit or a signup happened, and Meta and Google also receive a hashed form of your email address. They do not receive your order data, your spending, or anything you upload. Switching off Product analytics in Settings stops these too.

5. Cookies and local storage

AmazaSpend uses minimal cookies and local storage:

• Session cookie: To keep you logged in while you use the app. This expires when you log out or after a period of inactivity.
• Preference storage: To remember settings like your selected year filter. This stays in your browser's local storage.

• Analytics and advertising: Unless you switch off Product analytics in Settings, PostHog and, while we are running ads, the advertising tags listed in section 4 (Meta, OpenAI, Google and Microsoft) set cookies that let us measure usage and see which ads led to signups. Switching it off stops all of them. We do not use fingerprinting.

The browser extension keeps your sign-in and its sync progress (described in section 1) in chrome.storage.local (or the Firefox and Safari equivalent). This is sandboxed to the extension and is not accessible to websites, including Amazon.

The mobile app keeps your sign-in on the device in the operating system's protected storage. If you turn on notifications, we also store a device token so we can send them, and it is removed when you sign out.

When you sync from inside the mobile app, Amazon opens in a window in the app. You sign in to Amazon there, and that sign-in stays between you and Amazon: we never see your Amazon password, and that window is excluded from session recordings. The app imports your orders from those pages the same way the browser extension does, and sends us the order details, never your credentials.

6. Your rights

You have the following rights regarding your personal data:

• Access: You can request a copy of the personal data we hold about you
• Export: You can download your full order history at any time via the CSV export feature in the app
• Correction: You can update your account email or other details in your account settings
• Deletion: You can deactivate your account and anonymize your profile from Settings. For deletion of additional retained records, email [email protected]with details of the data you want removed. We will respond within 30 days and explain any applicable retention requirements. See account deletion.
• Withdrawal of consent: You can stop using the Service at any time. If you've opted in to any communications, you can opt out via the unsubscribe link in any email.

If you are in Quebec or the European Economic Area, you may have additional rights under applicable privacy law (including Law 25 in Quebec and GDPR in the EEA), including the right to data portability and the right to lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Children's privacy

AmazaSpend is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have collected data from a minor, contact us at [email protected] and we will delete it promptly.

8. International data transfers

AmazaSpend Inc. is a Canadian corporation based in Montréal, Quebec, and our infrastructure providers store and process data in the United States. Regardless of where you access the Service from, your data may be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using the Service, you consent to this transfer.

We take steps to ensure that any cross-border data transfers are subject to appropriate safeguards.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, particularly any that affect how we use your data, we will notify you by email and/or by posting a notice in the app at least 14 days before the changes take effect.

The "last updated" date at the top of this page reflects the most recent revision.

10. Contact

If you have any questions, concerns, or requests related to this Privacy Policy, please contact us:

Email: [email protected]

Mailing address: AmazaSpend Inc.,
192-365 rue Sainte Catherine Est,
Montréal, Québec H2X 3X2, Canada

You can also reach us through the in-app help link.