Privacy Policy

Account data — your name, email, and password (stored hashed), or your Google profile if you sign in with Google.

Receipts & spending data — when you use the Receipt Scanner, we store the receipt image or PDF you upload and the structured data extracted from it (merchant, items, prices, taxes, dates). This is used to power your spending analytics, personal inflation rate, pantry, and restock predictions.

Household data — your household profile (size, dietary preferences, preferred stores, budget), shopping lists, pantry, meal plans, and tracked subscriptions.

Usage data — your searches, watchlist, and price alerts, so the assistant can do its job.

Billing data — if you subscribe, payments are handled by Stripe. We store your subscription status and a Stripe customer ID, but never your full card number — Stripe holds that.

Technical data — privacy-preserving, cookieless analytics (page views and aggregate events) and your approximate country (from your IP) to show local retailers and currency. We do not build advertising profiles.

If you create or join a shared household, the household's data — shopping list, pantry, meal plan, budget, subscriptions, receipts, and spending analytics — is visible to and editable by every member of that household. Personal items like your watchlist and search history remain private to you. The household owner can remove members or disband the household. Only join households you trust.

• To provide receipt scanning, price comparison, analytics, and predictions.
• To personalize results to your household, preferences, and region.
• To send account and transactional email (verification, password reset, alerts, family invites).
• To send optional product tips, which you can unsubscribe from at any time.
• To process subscriptions and prevent fraud and abuse.

Where the GDPR or UK GDPR applies, we rely on:

• Contract — to provide the service you sign up for (accounts, receipts, analytics, billing).
• Legitimate interests — to secure, maintain, and improve the product, and prevent abuse.
• Consent — for optional marketing email and non-essential analytics, which you can withdraw at any time.
• Legal obligation — to keep records required by law (e.g. tax/billing records).

We share the minimum necessary data with trusted processors:

• Vercel — hosting, infrastructure, and receipt file storage (Vercel Blob).
• Neon — our managed PostgreSQL database.
• Anthropic — the AI that reads receipts and powers the assistant. Receipt images/text and queries are processed to generate results; they are not used to train third-party models on your data.
• Stripe — payment processing.
• Resend — transactional and lifecycle email.
• Retailer/product data APIs — to fetch live prices and listings.

We do not sell your personal data, and we do not share your receipts, spending, watchlist, or search history with advertisers.

Cartlyt and its providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for transfers out of the UK/EEA.

We use essential cookies for authentication and security, and privacy-friendly, cookieless analytics. We do not use third-party advertising cookies. You can decline non-essential analytics via the cookie banner.

We retain your data while your account is active. You can delete your account at any time from your profile — this permanently removes your receipts (including stored images), household data, and personal records, cancels any active subscription, and disbands a household you own. Some records may be retained where required by law (e.g. billing). We use industry-standard measures including encryption in transit and hashed passwords.

Depending on where you live (including under the GDPR, UK GDPR, and CCPA), you may have the right to access, correct, export, delete, or restrict processing of your personal data, to object to processing, to withdraw consent, and to lodge a complaint with your local data protection authority. You can export or delete your data yourself in the app, or contact support@cartlyt.com.

Cartlyt is not directed to children under 16, and we do not knowingly collect their data.

We may update this policy; material changes will be noted by the “last updated” date above. Questions? Email support@cartlyt.com.