Privacy Policy

Last Updated: October 2026

1. Introduction

Welcome to Fidexa. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application.

Fidexa is designed to help users track expenses, mileage, and financial information for accounting and tax deduction purposes. We comply with applicable privacy regulations including the GDPR (Europe) and CCPA (United States).

2. Information We Collect

We collect only the information necessary to provide core features of the app.

Account Information

We collect your email address and authentication tokens through secure authentication providers such as Supabase in order to create and manage your account.

Financial Information

We store financial data entered by you or securely imported from your linked financial institutions, including:

transaction amounts
bank account status
merchant names
dates
categories

We use Plaid Inc. ("Plaid") to connect your Fidexa account with your financial institutions. By using our service, you grant us and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy (https://plaid.com/legal/#end-user-privacy-policy).

Fidexa Pay

If you use Fidexa Pay, we collect and store:

Your Stripe account: the Stripe account ID and its verification and payout status. Identity verification details (such as your name, date of birth, Social Security number, and bank account) are collected directly by Stripe; Fidexa does not receive or store them.
Your business address for Tap to Pay: sent to Stripe to register your location. Fidexa keeps only the resulting location ID.
Your customers, as you enter them: name, email address, invoice items, amounts, tax rate, due date, and notes.
Each payment: amount, tip, sales tax, Stripe fee, status, date, and the card brand and last four digits (or bank account last four) as reported by Stripe. Full card and bank account numbers are handled only by Stripe and never reach Fidexa.

Your customers. When your customer opens an invoice link, Fidexa shows them your business name, their name, the invoice items, and the amounts. Payment details they enter go directly to Stripe. Fidexa processes your customers' information on your behalf, only to provide Fidexa Pay.

Location Data (Mileage Tracking)

Fidexa may optionally collect location data when you enable the Mileage Tracker feature.

Location data is used exclusively to:

calculate distance traveled
generate mileage logs
estimate potential tax deductions

Location tracking may occur in the background only when a trip is actively started by the user or when the user enables automatic trip detection.

We do NOT use location data for:

advertising
selling user data
tracking unrelated activities

Users may disable location access at any time in device settings.

Tap to Pay: while you accept a payment, your device's location is used by Stripe, as Tap to Pay requires, to confirm the payment is taken in a supported country and to prevent fraud. Fidexa does not store this location.

Fidexa Calendar (Online Booking)

If you use Fidexa Calendar on the Fidexa website, we store the services, prices, working hours, closed times and booking settings you enter (including the address and video-call link you give for your appointments), and the bookings made with you.

When someone books an appointment with a business that uses Fidexa Calendar (a "booking customer"), we collect the name, email address, phone number, optional notes, time zone and chosen time they enter on the booking page, how they choose to meet (for example in person, by phone or by video call) and, when the business comes to them, the address they enter. We use this information only to schedule the appointment, show it to the business, send the booking customer their confirmation, reminder, change and cancellation emails, and give them a private link to change or cancel. The business decides what happens with its bookings; Fidexa processes booking customers' information on the business's behalf and does not use it for its own marketing, advertising or AI features. Booking customers who want to access, correct or delete their information should contact the business they booked with, or support@fidexa.tech.

Connected Google Calendar

If you choose to connect Google Calendar to Fidexa Calendar, Fidexa receives limited access to your Google account as described in Section 4 (Google User Data). Connecting is optional; Fidexa Calendar works without it.

Notifications

We store a notification token for each device you sign in on, so we can send you notifications, for example when a payment is received. Payment notifications may show a customer's name and the amount on your lock screen; you can change this in your device's notification settings.

Voice & Media Data

If you choose to use voice input or upload receipt images:

Voice recordings may be temporarily processed to convert speech into structured transaction data.
Images of receipts may be analyzed to extract text such as merchant name or amount.

Voice recordings are processed only for the purpose of providing requested features and are not used for profiling or advertising.

Advertising Measurement

Fidexa advertises on Meta (Facebook and Instagram), TikTok, and Google (YouTube and Google Ads). To learn whether those ads bring people to the app, and to stop paying for ads that do not, the Fidexa mobile apps include the Meta, TikTok, and Firebase Analytics (Google) software development kits (SDKs). They receive:

that the app was installed and opened, and that an account was created
on Android, your device's Google advertising ID and the Google Play install referrer (the ad click, if any, that led to the install)
on iOS, nothing that identifies your device: Fidexa does not ask permission to track you and does not read Apple's advertising identifier. Installs are reported through Apple's SKAdNetwork, which does not identify you.

They do not receive your name, email address, phone number, transactions, bank data, or anything you enter in the app. We use this information only to measure Fidexa's own advertising. On Android you can limit it at any time by resetting or deleting your advertising ID (Settings → Google → Ads). For California residents we enable Meta's Limited Data Use, which restricts how Meta may use this data. The Fidexa website does not include these SDKs.

3. AI Processing Disclosure

Fidexa uses artificial intelligence services to help interpret transaction descriptions, receipts, and voice inputs.

When AI features are used:

Text, voice transcripts, or receipt images may be securely transmitted to AI service providers for processing.
Data is used solely to generate structured transaction information requested by the user.
Data is not used to train public AI models.
Data is processed only as necessary to fulfill the user's request.

Users may choose not to use AI-powered features and still use the core accounting functionality.

Google user data (Section 4) and booking customers' information (Section 2) are never sent to AI service providers.

4. Google User Data

This section applies only if you connect your Google account in Fidexa Calendar (Fidexa Calendar → Settings → Connected calendars on the Fidexa website).

What Fidexa accesses

With your permission, Fidexa requests these Google permissions and nothing more:

Your email address (openid, userinfo.email), to show which Google account is connected.
Your free/busy times (calendar.freebusy) on your primary Google calendar: only when you are busy, not what your events are.
Events on calendars you own (calendar.events.owned), used to add, move and remove the events for bookings made through Fidexa Calendar, and to notice when you move or delete one of those events in Google Calendar. When a booking is a Google Meet video call, Fidexa asks Google to add a Meet link to that booking's event and saves the link with the booking, so the booking customer receives it in their confirmation and reminder emails; the customer is not added as a guest. To notice those changes, Fidexa asks Google for the identifiers, times and status of events changed recently on your primary calendar and uses only the ones that belong to Fidexa bookings. Fidexa does not request the titles, descriptions, attendees or locations of your other events.

How Fidexa uses it

to hide times you are busy from your booking page, so customers can only book when you are free;
to add each booking to your Google Calendar, and move or remove it when the booking changes;
for bookings you offer as Google Meet video calls, to create the Meet link on the booking's event and send it to the booking customer;
when you move or delete a booking's event in Google Calendar, to move or cancel that booking in Fidexa and email the booking customer, as if you had made the change in Fidexa.

Fidexa does not use Google user data for advertising, does not sell it, does not transfer it to data brokers or advertising platforms, does not use it to determine credit-worthiness or for lending, and does not use it to develop, improve or train artificial intelligence or machine-learning models. No Fidexa staff read your Google Calendar data, except with your permission for support, when needed for security or abuse investigations, or to comply with the law.

How Fidexa stores and protects it

Fidexa stores your Google account email, the access and refresh tokens Google issues, and, for each booking, the identifier of the event Fidexa created and, for Google Meet bookings, the Meet link. Tokens are encrypted (AES-256-GCM) before they are stored, and only Fidexa's servers can read them. Free/busy times are fetched when needed and are not stored. All data travels encrypted (HTTPS).

Sharing

Fidexa does not share Google user data with anyone, except the infrastructure providers that run Fidexa on our behalf (Supabase for the database, Vercel for the website), or when required by law (Section 12).

Disconnecting and deletion

You can disconnect Google Calendar at any time in Fidexa Calendar → Settings. Fidexa then asks Google to revoke its access and deletes the stored tokens. You can also remove Fidexa's access from your Google Account at myaccount.google.com/permissions. Events Fidexa already added stay in your Google Calendar until you delete them. Deleting your Fidexa account deletes everything described in this section.

Google API Services User Data Policy

Fidexa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Third-Party Service Providers

We use trusted third-party services to operate our application:

Supabase

Used for:

secure cloud database storage
authentication
data synchronization

Stripe

Used for:

payment processing for Fidexa Pay (Tap to Pay and invoices)
identity verification of businesses that use Fidexa Pay
payouts, refunds, and disputes

Resend

Used for:

delivering Fidexa Pay invoice and receipt emails
delivering Fidexa Calendar booking confirmations, reminders, changes and cancellations

Vercel

Used for:

hosting the Fidexa website, including Fidexa Calendar and its booking pages

OpenAI

Used for:

AI financial assistant and tax Q&A
financial insights generation

We do not send sensitive financial credentials such as bank login information.

DeepSeek

Used for:

transaction text interpretation
voice description parsing
receipt text extraction
automatic transaction categorization

We do not send sensitive financial credentials such as bank login information. Data is processed solely to fulfill the user's request and is not used to train public AI models.

Apple Inc.

Used for:

speech recognition
Face ID authentication
device-level security features
delivering notifications to iPhone (Apple Push Notification service)

Biometric authentication data such as Face ID is processed locally on your device and never leaves your device.

Meta Platforms

Used for:

measuring Fidexa's own advertising on Facebook and Instagram (app install, app open and sign-up events; on Android, the advertising ID)

TikTok

Used for:

measuring Fidexa's own advertising on TikTok (app install, app open and sign-up events; on Android, the advertising ID and install referrer)

Google (Firebase Analytics)

Used for:

measuring Fidexa's own advertising on YouTube and Google Ads (app install, app open and sign-up events; on Android, the advertising ID; no advertising identifier on iOS)
delivering notifications to Android devices (Firebase Cloud Messaging)
Google Calendar API, only if you connect Google Calendar to Fidexa Calendar (see Section 4)

6. Data Retention & Deletion

Your data is stored securely while your account remains active.

You may request deletion of your account at any time through the app settings or by contacting support.

Upon deletion request:

your stored financial records
associated account data

will be permanently removed from our systems within a reasonable timeframe.

When you delete your account, Fidexa deletes your Fidexa Pay records. Your Stripe account, and the records Stripe keeps, are governed by Stripe's policies; you can manage or close your Stripe account from your Stripe dashboard.

Fidexa Calendar bookings, including booking customers' details, are kept as part of the business's records while its account is active and are deleted with the account. Disconnecting Google Calendar deletes the stored Google tokens right away (Section 4).

7. Data Security

We implement reasonable administrative, technical, and organizational safeguards to protect your information, including encryption in transit and secure authentication methods. Access tokens for connected calendars are additionally encrypted at rest (AES-256-GCM).

No system can guarantee absolute security, but we continuously work to protect your data.

8. Children's Privacy

Fidexa is not intended for individuals under the age of 13.

We do not knowingly collect personal information from children under 13. If we become aware that such information has been collected, we will take steps to delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be reflected by revising the "Last Updated" date.

Continued use of the app after changes indicates acceptance of the updated policy.

10. International Data Transfers

Fidexa is operated from the United States and our service providers (including Supabase, Vercel, Plaid, Stripe, Resend, OpenAI, DeepSeek, Apple, Google, Meta, and TikTok) may process your data in the United States and other countries. By using Fidexa you acknowledge that your information may be transferred outside of your country of residence. Where required by law (e.g. GDPR), such transfers are protected by appropriate safeguards such as Standard Contractual Clauses.

11. Your Rights (GDPR / CCPA)

Depending on where you live, you may have the right to:

access the personal data we hold about you
request correction of inaccurate data
request deletion of your data
request a portable copy of your data
object to or restrict certain processing
withdraw consent at any time

California residents have the right to opt out of the sale or sharing of personal information. Fidexa does not sell your personal information. The only information shared with advertising platforms is the advertising-measurement data described in Section 2, used solely to measure Fidexa's own advertising; on Android you can opt out by resetting or deleting your advertising ID in device settings.

To exercise any of these rights, contact support@fidexa.tech.

12. Legal Compliance & Law Enforcement

We may disclose your information if required to do so by law, subpoena, court order, or other valid legal process, or when we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a government request.

13. Contact Us

If you have questions regarding this Privacy Policy, you may contact:

Support Email: support@fidexa.tech