← Back to ReceiptWave

1. Who We Are

ReceiptWave Pty Ltd (ABN 25 696 339 992) ("ReceiptWave", "we", "us") provides digital receipt delivery and management services for businesses and consumers in Australia. This policy explains how we collect, use, and protect your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What Personal Data We Collect

We collect the following categories of personal information:

• Business users: Name, email address, phone number, ABN, business address, and payment information (processed by Stripe).
• Consumers: Email address (if provided), device identifiers, and NFC tap activity. We do not require consumers to create an account.
• Receipt data: Transaction amounts, line items, payment method type (e.g. "Visa ****4242"), date/time, and store location. Receipt data is provided by the merchant's point-of-sale system.

3. Why We Collect This Data

• To deliver digital receipts to consumers via NFC tap, claim code, or direct link.
• To provide business analytics, reporting, and sustainability metrics to merchants.
• To process subscription payments and manage billing.
• To send transactional communications (receipt delivery, account notifications).
• To improve our service, monitor performance, and prevent fraud.

4. Third Parties We Share Data With

We share data only with the following service providers, each under appropriate data processing agreements:

• Microsoft Azure (Sydney region) — hosting, database, storage.
• Stripe — payment processing for business subscriptions.
• Square, Shopify, Xero — POS and accounting integrations (only when connected by the merchant).
• SendGrid — transactional email delivery.
• Sentry — error monitoring and crash reporting (anonymised).

We do not sell, rent, or trade personal information to any third party.

5. How Long We Retain Data

• Receipt claim links: Active for 48 hours after generation.

6. Data Security

We protect your data using:

• HTTPS/TLS encryption for all data in transit.
• AES-256 encryption for data at rest in Azure SQL and Azure Blob Storage.
• API key and JWT authentication for all API access.
• Role-based access controls for business staff and admin users.
• Rate limiting on all authentication and sensitive endpoints.

7. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate or incomplete information.
• Request deletion of your personal information (subject to legal retention requirements).
• Complain to us or to the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached.

7.1 Deleting a customer account

If you have the app, you can delete your account yourself: Profile → Delete account. It asks you to confirm twice, and it cannot be undone.

7.2 If you have only ever opened a receipt in a browser

We cannot action a deletion request from you, and we want to be straightforward about why. Opening a receipt link does not create an account. We do not learn your name, your email address or anything else that identifies you — there is nothing on our side we could match a request against, and no way for us to check that a request was really yours.

What we do store is a random code on your device, described in section 8. You can remove that yourself at any time by clearing cookies and site data for this website in your browser settings, and you do not need to ask us. That is the whole of what is held.

If you later install the app and sign in, you get an account with a deletion right, and section 7.1 applies from that point on.

7.3 Businesses: closing an account ends your access, and keeps the receipts

Closing a business account does not delete it. Your access ends immediately: sign-ins stop, API keys are revoked, and any point-of-sale connection is disconnected and its access tokens are erased.

The business record and the receipts already issued to customers are kept. Those receipts belong to the customers holding them — some will need one for a warranty claim or a tax return years later — and they show your trading name and ABN, so the record has to survive for them to keep working. Deleting it would leave a customer holding a receipt from nobody.

Contact details we no longer need for a closed account are removed on our retention schedule.

8. Cookies and Tracking

Our web application uses essential cookies for authentication session management. We do not use advertising cookies or third-party tracking pixels, and we do not track you across other websites.

When you open a receipt at /r/{code} we store a random code on your device: a cookie named rw_device_id. It contains no personal information and is not shared with anyone. Its only use is to keep any stamps you have collected on that device attached to it until you install the app.

If you open a merchant offer page we store a second, separate random code in your browser's local storage, under rw_device_token. It is generated in your browser, is not linked to the cookie above, and is used only to remember that this browser has already responded to an offer.

You can remove both at any time by clearing cookies and site data for this website in your browser settings. Doing so does not delete your receipts.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to registered business users. The "last updated" date at the top of this page indicates when the policy was last revised.

10. Contact Us

For privacy enquiries, data access requests, or complaints:

• Email: privacy@receiptwave.com
• Security issues: security@receiptwave.com

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner.