Privacy Policy for Eny

Last Updated: December 7, 2025

Welcome to Eny (“we”, “our”, “us”). We provide a service that allows users to upload receipt images and convert them into structured data such as JSON.

This Privacy Policy explains what data we collect, why we collect it, how we process it, and the rights you have under the GDPR.

1. Who We Are

Eny

Email: batmend@gege.mn

We are the controller of your personal data unless otherwise stated.

2. Data We Collect

We only collect data that is necessary to operate and improve our service:

2.1 User-Provided Data

Uploaded receipt images (which may contain personal data such as store name, date, prices, etc.)
User account information (email address, password)

2.2 Automatically Collected Data

Usage logs (e.g., feature usage, timestamps)
Analytics data via Google Analytics
Cookies and similar tracking technologies

3. Why We Process Your Data

We process your data for the following purposes:

Purpose	Data Used	Legal Basis
Convert receipts to structured data	Receipt images	Performance of a contract
Provide and maintain your account	Account info	Performance of a contract
Improve and secure the service	Usage logs, Analytics	Legitimate interest
Payment processing	Payment info	Performance of a contract
Error detection and debugging	Usage logs, errors	Legitimate interest
Compliance with legal obligations	Any required data	Legal obligation

4. Consent

We ask for explicit consent through a checkbox during sign-up.

You may withdraw your consent at any time by deleting your data.

5. Data Sharing & Third Parties

To operate Eny, we share data with trusted service providers:

AI Model Providers

OpenAI

Analytics

Google Analytics

Cloud Hosting & Infrastructure

Cloudflare

Payment Processing

Golomt Bank

Error Monitoring

Sentry

All third parties are required to follow GDPR-compliant data protection standards.

6. International Data Transfers

Some of our partners (e.g., AI providers, analytics, cloud services) may process data outside the EU/EEA.

When this happens, we ensure that appropriate safeguards are in place, such as:

Standard Contractual Clauses (SCCs)
Adequacy decisions
Additional technical and organizational measures

7. Security Measures

We take security seriously and follow industry standards, including but not limited to:

Encryption of data in transit and at rest
Data minimization
Access control and audit logging
Secure infrastructure through trusted providers
Regular monitoring and vulnerability mitigation

While no system is 100% secure, we continuously work to safeguard your information.

8. Data Retention

Receipt images: stored until the user deletes them, or removed when the user deletes their account.
Account data: stored until the account is deleted.
Analytics and logs: retained only as long as necessary for service improvement and security.

We do not keep personal data longer than needed.

9. Your Rights Under GDPR

You have the right to:

Access your personal data
Correct inaccurate data
Delete your data
Export your data (data portability)
Withdraw consent
Object to certain types of processing
Lodge a complaint with your local Data Protection Authority

To exercise any of these rights, contact us at: batmend@gege.mn

10. Policy Updates

We may update this Privacy Policy from time to time.
Updates will be indicated by a “Last Updated” date at the top of this page.

11. Contact

For any privacy or GDPR-related questions, please contact:
📧 batmend@gege.mn