Expense Go

Privacy Policy

Last updated June 22, 2026 · v1.0

This Privacy Policy describes how Outcubator (“we,” “us,” or “our”) collects, uses, and shares information when you use Expense Go, our expense-management platform. By using Expense Go you agree to the practices described here.

1. Who We Are

Expense Go is an expense-management SaaS service operated by Outcubator. [Company legal name, registered address, and registration number — confirm with legal.]

For questions about this policy or your personal data, contact us at privacy@outcubator.com.

2. Information We Collect

2.1 Account & Identity Data

When you are invited to and sign in to Expense Go we collect:

  • Your email address (used as your login identifier).
  • Your first and last name (collected during profile setup).
  • One-time authentication codes sent to your email.
  • Session tokens stored in your browser to keep you signed in.

Expense Go uses passwordless, email one-time-code (OTP) authentication. We do not store passwords.

2.2 Company & Organisation Data

If you create or belong to a company workspace on Expense Go, we collect and store:

  • Company name, slug/ID, and configuration settings.
  • Your role and permissions within the company (e.g., owner, admin, approver, employee).
  • Invitation records for users you add to your workspace.

2.3 Expense & Line-Item Data

When you create and submit expenses we collect:

  • Expense descriptions, amounts, currencies, categories, dates, and statuses.
  • Line-item details (sub-categories, quantities, unit costs).
  • Merchant information (name, category, location if provided).
  • Approval or rejection decisions and associated comments.
  • Project or trip assignments.
  • Bill-split allocations (if the feature is enabled).

2.4 Receipt Images & Extracted Data

If you upload a receipt image, we store the image in encrypted object storage (Amazon S3 / MinIO). We also send the image to Anthropic’s Claude AI service to automatically extract structured data (merchant name, total amount, date, line items, and other relevant fields). The extracted data is then stored alongside your expense record. See Section 5 (AI Processing) for details.

2.5 Reimbursement & Payment Details

For reimbursement requests we collect payment-related information necessary to process payments through our third-party payment processor. We do not store full bank account or card numbers directly — payment processing is handled by FasterPay and is subject to their privacy practices.

2.6 Usage, Device & Log Data

We automatically collect certain technical information when you use Expense Go, including:

  • IP address, browser type, and operating system.
  • Pages visited, actions taken, and timestamps.
  • Error logs and performance metrics.
  • Device identifiers for mobile app users.

2.7 Cookies & Session Tokens

We use cookies and browser storage to maintain your authentication session and to preserve your preferences (such as the active company context). We do not use third-party advertising cookies. You may disable cookies in your browser settings, but doing so will prevent you from signing in.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Expense Go platform.
  • Authenticate you and manage your session.
  • Process expense submissions, approvals, and reimbursements.
  • Extract structured data from receipt images using AI (see Section 5).
  • Enable collaboration features (multi-member workspaces, approval workflows, bill splitting).
  • Send transactional emails (OTP codes, invitation notices, expense notifications).
  • Monitor service health, diagnose errors, and prevent abuse.
  • Comply with legal obligations (including SOC 2 audit logging).
  • Respond to your support requests.

We do not sell your personal data or use it for behavioural advertising.

4. Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, we rely on the following legal bases to process your personal data:

  • Contract performance — processing necessary to provide the service you have signed up for (e.g., authentication, expense processing, reimbursement).
  • Legitimate interests — service security, fraud prevention, abuse monitoring, and product improvement, where these do not override your rights.
  • Legal obligation — compliance with applicable laws (e.g., SOC 2 audit trails, tax record retention).
  • Consent — where we rely on consent for optional features, you may withdraw it at any time.

5. AI Processing — Receipt Scanning

Expense Go uses Anthropic’s Claude AI to automatically extract structured data from receipt images you upload. When you upload a receipt:

  • The receipt image and any text visible in it are transmitted to Anthropic’s API for processing.
  • Claude extracts information such as merchant name, date, total amount, currency, and line items.
  • The extracted data is returned to Expense Go and stored with your expense record. The original image is stored separately in encrypted object storage.
  • Anthropic’s API usage policies indicate that API inputs and outputs are not used to train their models by default. We encourage you to review Anthropic’s Privacy Policy for authoritative information about how they handle your data.
  • Extraction results are automated and may be inaccurate. You must review and correct any extracted values before submitting an expense. Receipt scanning does not constitute financial, tax, or accounting advice.

6. Sharing & Disclosure

6.1 Within Your Organisation (Multitenant Architecture)

Expense Go is a multitenant platform. Within your company workspace, your expense data — including expense details, receipt images, amounts, and status — is visible to administrators, owners, approvers, and managers in your organisation who have the appropriate permissions. This is a core feature of the service, not incidental sharing.

Data from one company workspace is not shared with or visible to other companies on the platform.

6.2 Service Providers & Sub-Processors

We engage the following categories of third-party service providers who may process your data on our behalf:

  • Anthropic — AI model API for receipt data extraction (see Section 5).
  • FasterPay — payment processor for reimbursements.
  • Email / SMTP provider — transactional email delivery (OTP codes, notifications). [SMTP provider name — confirm with engineering.]
  • Cloud infrastructure & object storage — we use cloud hosting and S3-compatible object storage (MinIO) to store data and receipt images.

We only share personal data with service providers to the extent necessary for them to perform services on our behalf, and we require them to protect data appropriately.

6.3 Legal Requirements

We may disclose your information if required to do so by law or in response to a valid legal process (e.g., a court order or government request), or to protect the rights, property, or safety of Outcubator, our users, or others.

6.4 Business Transfers

If Outcubator is acquired, merged, or undergoes a change of ownership, your information may be transferred as part of that transaction. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

7. Data Storage & Security

Your data is stored on servers located in [data residency region(s) — confirm with engineering]. We implement appropriate technical and organisational measures to protect your data, including:

  • Encryption in transit using TLS for all API and web traffic.
  • Encryption at rest for stored data and receipt images.
  • Role-based access controls and the principle of least privilege.
  • SOC 2 Type II programme: we maintain an audit log of significant system events and data access for security and compliance purposes.
  • Regular security assessments and monitoring.

No method of transmission or storage is 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at privacy@outcubator.com.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are:

  • Account data: retained for [X years] after account closure — confirm with legal.
  • Expense and financial records: retained for [X years] to satisfy applicable accounting and tax obligations — confirm with legal.
  • Audit logs: retained for [X years] for SOC 2 compliance — confirm with legal.
  • Receipt images: retained for the life of the associated expense record.
  • Server logs: retained for [X days] for security monitoring — confirm with engineering.

When retention periods expire, data is securely deleted or anonymised.

9. Your Rights

Depending on where you are located, you may have the following rights regarding your personal data.

9.1 GDPR Rights (EEA & UK)

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure (“right to be forgotten”): Request deletion of your personal data, subject to legal retention obligations.
  • Portability: Request your data in a structured, machine-readable format.
  • Restriction: Request that we restrict processing of your data in certain circumstances.
  • Objection: Object to processing based on legitimate interests.
  • Complaint: You have the right to lodge a complaint with your local data-protection supervisory authority.

9.2 California Privacy Rights (CCPA / CPRA)

California residents have the right to know what personal information is collected, to delete personal information, to opt out of the “sale” of personal information (we do not sell personal information), and to non-discrimination for exercising these rights.

9.3 How to Exercise Your Rights

To exercise any of the above rights, please contact us at privacy@outcubator.com. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling a request.

10. International Data Transfers

Expense Go operates globally. If you are located in the EEA, UK, or another jurisdiction with data-transfer restrictions, your data may be transferred to and processed in countries that may not provide the same level of data protection as your home country. Where required, we rely on appropriate safeguards such as [Standard Contractual Clauses or other approved transfer mechanism — confirm with legal] for such transfers.

Transfers to Anthropic (for AI processing) and FasterPay (for payments) are subject to their own transfer mechanisms and privacy policies.

11. Children’s Privacy

Expense Go is a business expense-management tool intended for use by adults in a professional capacity. We do not knowingly collect personal information from individuals under 16 years of age (or such higher age as required by applicable law in your jurisdiction). If you believe we have inadvertently collected information from a minor, please contact us at privacy@outcubator.com and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (to the address associated with your account) or by posting a prominent notice in the Expense Go platform before the change takes effect. The “Last updated” date at the top of this page always reflects the current version. Your continued use of Expense Go after the effective date constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

You may also review our Terms of Service.