Privacy Policy

Last updated: October 2, 2026

1. Introduction

Axpense ("we," "our," or "us") is a company based in Switzerland and is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our expense tracking application.

This policy complies with the Swiss Federal Data Protection Act (nDSG - new Data Protection Act), the General Data Protection Regulation (GDPR) for EU/EEA users, the California Consumer Privacy Act (CCPA) for California users, and other applicable privacy laws including state privacy laws in Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, and other US states. By using our service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you register, we collect:

  • Email address
  • Display name
  • Password (encrypted and never stored in plain text)

2.2 Expense Data

We store the expense information you create:

  • Expense amounts, dates, and descriptions
  • Categories, projects, and departments
  • Receipt images you upload
  • Currency information

2.3 Company Information

If you create or join a company, we store:

  • Company name and details
  • Company logo (if uploaded)
  • Your role within the company (admin or employee)

3. How We Use Your Information

We use the information we collect to:

  • Provide and maintain our service
  • Process your expense tracking requests
  • Enable offline functionality with local data storage
  • Sync your data across devices when online
  • Process payments and manage subscriptions
  • Send you important updates about the service
  • Respond to your inquiries and support requests

3.1 Legal Basis for Processing

Under Swiss Data Protection Act (nDSG) and GDPR, we process your personal data based on the following legal bases:

  • Contractual necessity: To fulfill our service agreement with you
  • Legitimate interests: To improve our services, ensure security, and prevent fraud (in accordance with Swiss law)
  • Consent: For marketing communications (where applicable)
  • Legal obligation: To comply with applicable laws and regulations, including Swiss law

4. Data Storage and International Transfers

4.1 Local Storage

Axpense uses an offline-first architecture. Your data is stored locally on your device using IndexedDB. This allows you to use the application without an internet connection.

4.2 Cloud Storage

When you're online, your data is automatically synced to Firebase (Google Cloud Platform) for:

  • Backup and data recovery
  • Access across multiple devices
  • Real-time synchronization

4.3 International Data Transfers

Your data may be transferred to and stored in servers located outside Switzerland, including the European Economic Area (EEA) and the United States. When we transfer your data internationally, we ensure appropriate safeguards are in place:

  • Google Cloud Platform (Firebase) operates under Standard Contractual Clauses (SCCs) approved by the European Commission and Swiss authorities
  • We only transfer data to countries with adequate data protection laws or appropriate safeguards recognized by Swiss law
  • All transfers comply with Swiss Data Protection Act (nDSG) and GDPR requirements for international data transfers
  • For transfers to countries without adequate protection, we implement additional safeguards as required by Swiss law

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

  • Data encryption in transit (HTTPS/TLS)
  • Data encryption at rest in Firebase
  • Firebase Authentication for secure access
  • Access controls ensuring users can only access their own data
  • Regular security updates and monitoring
  • Secure password hashing (never stored in plain text)
  • Regular security audits and vulnerability assessments

5.1 Data Breach Notification

In the event of a data breach that may affect your personal data, we will:

  • Notify the Federal Data Protection and Information Commissioner (FDPIC) of Switzerland as required by Swiss Data Protection Act (nDSG)
  • Notify affected users without undue delay if the breach poses a high risk to their rights and freedoms
  • For EU/EEA users, notify the relevant supervisory authority within 72 hours as required by GDPR
  • Provide clear information about the nature of the breach and measures taken to address it

6. Data Sharing and Third-Party Services

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

  • Within Your Company: Company admins can view company settings, categories, and departments, but cannot view individual employee expenses.
  • Service Providers: We use trusted third-party services that process data on our behalf:
    • Firebase (Google Cloud Platform): For data storage, authentication, and hosting. Subject to Google's Privacy Policy and GDPR compliance.
    • PayPal: For payment processing. Subject to PayPal's Privacy Policy.
  • Legal Requirements: We may disclose information if required by law, court order, or to protect our rights, property, or safety.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction.

All third-party service providers are contractually obligated to protect your data and use it only for the purposes we specify.

7. Your Privacy Rights

You have the following rights regarding your personal data:

7.1 Swiss Data Protection Rights

Under the Swiss Data Protection Act (nDSG), you have the following rights:

  • Right of Access: Request information about what personal data we process about you
  • Right to Rectification: Request correction of inaccurate or incomplete data
  • Right to Erasure: Request deletion of your data, subject to legal retention requirements
  • Right to Restrict Processing: Request limitation of data processing in certain circumstances
  • Right to Data Portability: Receive your data in a structured, machine-readable format
  • Right to Object: Object to processing based on legitimate interests
  • Right to Withdraw Consent: Withdraw consent where processing is based on consent
  • Right to Lodge a Complaint: File a complaint with the Federal Data Protection and Information Commissioner (FDPIC) of Switzerland

7.2 GDPR Rights (EU/EEA Users)

EU/EEA users also have rights under GDPR, which are similar to Swiss rights but may have specific procedural requirements.

7.3 US State Privacy Rights

Residents of US states with comprehensive privacy laws (including California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, and others) have rights under applicable state privacy laws, which may include:

  • Right to Know/Access: Know what personal information is collected, used, shared, or sold, and request access to your personal information
  • Right to Correct: Request correction of inaccurate or incomplete personal information
  • Right to Delete: Request deletion of your personal information
  • Right to Data Portability: Obtain a copy of your personal information in a structured, machine-readable format
  • Right to Opt-Out: Opt-out of the sale of personal information, targeted advertising, or certain profiling (we do not sell your data)
  • Right to Non-Discrimination: Exercise your rights without discrimination (California residents)

Specific rights may vary by state. These rights apply subject to applicable state law thresholds and requirements. For example, California residents have rights under the California Consumer Privacy Act (CCPA), while residents of other states have rights under their respective state privacy laws.

7.4 How to Exercise Your Rights

To exercise any of these rights, please contact us at info@axpense.com. We will respond to your request within 30 days (or as required by applicable law). You may also export your expense data directly from the application via PDF export.

If you are not satisfied with our response, you can file a complaint with:

  • Switzerland: Federal Data Protection and Information Commissioner (FDPIC) - www.edoeb.admin.ch
  • EU/EEA: Your local data protection authority (find at edpb.europa.eu)

8. Data Retention

We retain your data for as long as your account is active or as needed to provide services. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal purposes.

Specific retention periods:

  • Account data: Retained while your account is active, deleted within 30 days of account deletion
  • Expense data: Automatically deleted 10 years after creation date. Expenses are retained while your account is active, but will be automatically removed 10 years from their creation date, along with associated receipt images. If you delete your account, all expense data is deleted within 30 days.
  • Payment records: Retained for 7 years as required by financial regulations
  • Legal compliance: Some data may be retained longer if required by law or for legal claims

Note: The 10-year automatic deletion policy helps us manage storage costs and ensures compliance with data minimization principles. We recommend exporting important expense reports before the 10-year period expires if you need to retain them longer.

9. Cookies and Tracking Technologies

We use minimal tracking technologies to provide and improve our service:

  • Essential cookies: Required for authentication and core functionality
  • Local storage: Used for offline functionality and data caching
  • Analytics cookies: Firebase Analytics may collect aggregated usage information such as page views and general interaction patterns

You can control cookies through your browser settings. Note that disabling essential cookies may affect the functionality of the application, while blocking analytics cookies may limit our ability to understand overall product usage.

10. Children's Privacy

Our service is not intended for users under the age of 18 (the age of majority in Switzerland). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at info@axpense.com, and we will delete such information in accordance with Swiss law.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or significantly affects you. All expense processing and categorization is based on your manual input and preferences.

12. Contact Information

If you have questions, concerns, or wish to exercise your privacy rights, please contact us:

We will respond to your inquiry within 30 days as required by Swiss Data Protection Act (nDSG) and other applicable privacy laws.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

  • Posting the new Privacy Policy on this page
  • Updating the "Last updated" date
  • Sending you an email notification (for significant changes)
  • Displaying a notice in the application (for less significant changes)

Your continued use of the service after changes become effective constitutes acceptance of the updated policy.