Privacy notice

Controller

Kai Schwabe, Silberburgstraße 30, 70176 Stuttgart, Deutschland. privacy@getbonami.com

The website

For audience measurement, we increment separate daily server counters for the public page requested, language, link destination and placement, approved referrer and campaign categories, country, broad browser, operating system and device categories, UTC hour, status class and broad server response time. We store no IP addresses, complete URLs, headers, cookies, visitor identifiers, fingerprints or individual request records for this measurement, and do not link visits. Categories are not combined into visitor profiles. Only daily counters are sent hourly to PostHog EU. Counters are kept at Cloudflare for 90 days and in PostHog for up to one year. Our purpose and legitimate interest is improving the website with minimal data (GDPR Article 6(1)(f)). We honor Do Not Track and Global Privacy Control as an objection; you can also contact us. Separately, the website uses PostHog EU for pseudonymous analytics and masked recordings only after your consent. You can turn this additional collection off through Privacy preferences. Cloudflare processes connection data such as IP addresses and technical requests to serve these pages. If you email us, we process your message to answer your request.

Receipts and shared splits

Bon Ami processes receipt images, recognized items, prices, allocations, display names, tips and self-reported payment status. Saved drafts stay on your device. Automatic receipt recognition uploads the photo for processing as described below. Published splits and invitations synchronize through Convex in EU West. Receipt images are protected in Cloudflare R2 with EU jurisdiction. Guest access is limited to their invitation.

Receipt recognition

Bon Ami automatically reads items and amounts from your receipt photo. The photo passes through Cloudflare to Google Cloud models, including Gemini, using EU endpoints. Automatic receipt scanning is on by default and can be turned off in Scanning & privacy. You review and correct the result before sharing. Without internet or with automatic scanning off, you can enter and edit details yourself. Optional voice input is offered only on devices supporting local speech recognition; audio is not sent to Bon Ami.

Optional authentication and technical data

Clerk handles optional Apple or email-code sign-in, account identifiers and email addresses. Anonymous participation needs no account. Limited technical data, device attestation and in-product operational events without receipt text or images support security and operation. Clerk is not an exclusively European service. Cloudflare Workers may execute globally; EU storage and the EU OCR endpoint do not keep every processing step within the EU.

Optional analytics and recordings

One combined consent enables pseudonymous product interactions, exact bill, tip and repayment amounts in the receipt’s currency, performance and error data, and masked recordings. Names, emails, payment identifiers, invitation tokens, receipt text, images and speech are excluded. Camera, authentication and sensitive payment presentations are not recorded. PostHog processes this data in the EU project. Events are retained for one year and recordings for 30 days. Withdrawal stops future collection. Account deletion includes associated analytics. Receipt deletion stops further receipt-linked collection and requests deletion of linked recordings; existing analytics events remain until account deletion or regular retention expiry. This choice is separate from receipt recognition.

Purposes and legal bases

Processing required for requested splits and accounts provides the service (GDPR Article 6(1)(b)). Security, abuse prevention and general enquiries rely on legitimate interests (Article 6(1)(f)). Optional functions requiring consent are used only with consent (Article 6(1)(a)), which may be withdrawn for the future.

Retention, deletion and your rights

You can delete receipts, published splits and your optional account in the app. Invitations remain valid until sharing closes or the receipt is deleted. Published receipts remain until deleted. Without an account, unpublished drafts are deleted after seven days of inactivity. Operational events are automatically deleted after 30 days. Deletion of protected images and image backups is retried after temporary failures. Database backups transferred over encrypted connections can remain for up to 365 days; restores apply recorded deletions. Deletion identifiers needed for this protection are retained separately from backups.

Contact us if deletion fails. Subject to applicable law, you have rights of access, correction, erasure, restriction, portability, objection and complaint to a data protection authority.

privacy@getbonami.com

Providers and transfers

Convex provides the database, Cloudflare the website and protected images, and Clerk optional authentication. Google processes receipt images for automatic recognition when it is enabled. Providers’ processing terms include data processing agreements and international transfer safeguards where applicable. EU storage does not mean all processing takes place within the EU. PayPal receives the recipient handle and amount when you open its external payment link; PayPal’s privacy notice applies. Bon Ami receives no payment confirmation from PayPal.