PRIVACY
Privacy Policy
How Grace collects, uses, stores, and protects information.
1. Who we are
Grace is owned and operated by QuaalCo, based in British Columbia, Canada. Privacy questions and requests can be sent to graceapp@quaal.co.
2. Information we collect
Account information
Grace collects your name, email address, authentication information, and identifiers associated with your sign-in method. Grace supports Sign in with Apple. Apple may allow you to use a private relay email address. You can change your name in Grace; email-address changes are not currently supported.
Organization information
Grace stores organization memberships, roles, membership status, and related administrative records.
Expense and reimbursement information
Submitted expenses may include amount, purchase date, fund/category, notes, status, reimbursement status, timestamps, submitter attribution, and administrative history. Once submitted, an expense is an organizational record.
Receipt photographs
Grace can access photos you choose and can use the camera to photograph receipts. Receipt photographs are stored using Firebase Storage. At the time of this policy, receipt photographs may be retained indefinitely while the service is active. Grace intends to change this retention approach in the future and will update this policy when the retention period changes.
Device permissions
Grace may request camera and Photos library access for receipt capture and photo selection. These permissions can be managed in iPhone Settings.
Usage and technical information
Grace and its service providers may process information needed to operate, secure, troubleshoot, and improve the service, including applicable device, app, network, diagnostic, and service-activity information.
Website analytics
Grace's website may use Google Analytics to understand website traffic and visitor interactions. Grace does not use analytics for third-party advertising.
3. How we use information
- Create and authenticate accounts.
- Provide organization membership, roles, expense tracking, approvals, and reimbursement records.
- Store and display receipt photographs and expense information.
- Send service notifications.
- Maintain audit history and record integrity.
- Secure, troubleshoot, maintain, and improve Grace.
- Provide support and beta-testing services.
- Comply with applicable law.
4. Service providers
Grace uses third-party infrastructure and services, including Firebase by Google for authentication, Firestore, file storage, and Firebase Cloud Messaging; Google Analytics for website analytics; and Apple for Sign in with Apple and TestFlight where applicable. These providers may process information on QuaalCo's behalf as necessary to provide their services. Grace does not sell personal information.
5. Receipt parsing
Premium AI receipt parsing is planned but is not enabled in the current beta version. The current beta does not send receipt photographs to OpenAI for parsing. If this feature is introduced, Grace will update its privacy disclosures before enabling it.
6. Sharing
Grace does not sell personal information and does not use personal information for third-party advertising. Information may be visible to members of the same organization according to organization settings and member roles. Information may also be disclosed to service providers, when required by law, to protect security, or to enforce applicable terms.
7. Personal data and organizational records
Grace distinguishes personal account information from organizational accounting records. Once an expense is submitted, it belongs to the organization. Deleting a person's account does not necessarily delete historical expense records required by that organization. Grace provides a personal-data deletion path and may retain the minimum information necessary to preserve an organizational record.
8. Retention and organization deactivation
Organizations can choose an applicable retention or deletion path when deactivating Grace. Current planned retention periods are up to 30 days for Free organizations and up to 90 days for Premium organizations after deactivation or the end of paid Premium service. An organization may choose immediate deletion where offered. Receipt-photo retention while the service is active is currently being refined.
9. Security
QuaalCo uses reasonable technical and organizational measures intended to protect Grace information. No internet service can guarantee absolute security.
10. Children
Grace is not intended for children under 13 and is not directed to children under 13.
11. Your choices
You can manage certain information in the app, including your name. You can request deletion or other privacy assistance through Privacy Choices or by contacting graceapp@quaal.co.
12. Changes
We may update this policy as Grace develops, services change, or legal requirements change. The updated version will be posted here with a revised date.
13. Contact
QuaalCo
British Columbia, Canada
graceapp@quaal.co