ExpenCPrivacy Policy
Last updated: 22 October 2026
In short: everything ExpenC stores is kept in Ireland. Your employer decides how the ExpenC app is used and is responsible for your expense data; we look after it for them. This website uses no cookies, tracking or advertising.
Who we are
ExpenC (“we”, “us”) runs this website, www.expenc.org, and the ExpenC expense claims service: the web app and the Android and iPhone apps.
ExpenCAcorn Business Centre, Mahon Industrial Estate
Blackrock, Cork, T12 K7CV, Ireland
For any privacy question or request, email sales@dikoro.com.
Our role depends on the data:
- This website and enquiries: we are the data controller. We decide why and how that data is used.
- Expense data in the ExpenC app: the organisation you work for is the data controller, and we are its data processor. We handle that data only to provide the service, on your employer's instructions and under a data processing agreement with them.
This website
When you use the Talk to Sales form, we collect your name, email address, phone number (optional) and your message. We use them to answer your enquiry and, if you ask, to arrange a demo or send you information about ExpenC.
Our legal basis is taking steps at your request before entering into a contract, and our legitimate interest in responding to people who contact us (Article 6(1)(b) and (f) GDPR).
When you simply visit the site, our hosting provider automatically processes technical data such as your IP address, browser type and the pages requested, as any website must in order to deliver pages and protect against abuse. We don't use this to identify you.
The ExpenC app
If your employer uses ExpenC, the app holds the following about you.
| Type | What it includes |
|---|---|
| Account | Name, work email, employee code, role, company, manager, and your default settings (such as a start location for mileage) |
| Sign-in | Your password, stored only in a scrambled one-way form that nobody at ExpenC can read |
| Expense claims | Dates, amounts, VAT, descriptions, supplier, payment method and cost codes |
| Receipts | Photos or PDFs of receipts, and the details read from them |
| Mileage | Start and end locations, stops, distance and tolls you enter |
| Approvals | Who approved or rejected each item, when, and any comment |
| Activity record | A log of changes to claims and settings, kept for audit |
It is used to let you submit and track claims, let managers and finance approve them and export them to accounting software (such as Sage), keep the records your employer needs for Revenue and audits, send you emails about your claims, and keep the service secure.
Your employer decides the legal basis. Typically this is your employment contract, your employer's legitimate interest in managing expenses, and their legal duty to keep tax records.
We do not collect your fingerprint or face data, your phone's location, your contacts, or anything on your device outside the ExpenC app. We never sell your data or use it for advertising.
Receipt scanning
Scanning a receipt is optional; you can always type the details in yourself. If you tap Scan receipt, only the receipt photo is sent to Anthropic (in the USA), without your name, email or company. It reads the shop name, date, total and VAT, which you check before saving, and may flag a receipt that looks altered for your approver to check. No decision about you is made by a computer alone: every approval is decided by a person. Anthropic may not use the photo to train its AI models.
The mobile app
- Camera and photos: used only when you take or choose a receipt.
- Fingerprint or Face ID: optional. Your phone checks it; ExpenC never receives it.
- Sign-in: kept in your phone's encrypted secure storage.
- Notifications: if you turn them on, they say only things like “Your claim was approved”, never names or amounts. You can turn them off in the app or in your phone's settings.
Cookies and local storage
Neither this website nor the ExpenC app sets cookies or runs analytics or advertising trackers.
- This website stores one item in your browser (
expenc.introSeen) to remember that you've seen the introduction video. It contains no personal data and never leaves your device. - The ExpenC app stores your sign-in session and a few display preferences (such as light or dark mode) in your browser or phone, because the app can't work without them. Your sign-in is removed when you sign out; clearing the app's data removes the rest.
Who we share it with
We use a small number of trusted service providers, who may use the data only to provide their service to us:
- Amazon Web Services, in the EU (Ireland): hosts this website and the ExpenC service, stores all data and backups, and sends emails.
- Anthropic, in the USA: reads receipt photos, only when someone uses Scan receipt.
Inside your organisation, people see your data according to their role: managers see the claims they approve, and your organisation's administrators see all its claims. ExpenC staff look at your organisation's data only when it asks us for help, or when the law requires it. We may also disclose data where the law requires us to.
Where your data is stored
Everything ExpenC stores is kept in Amazon's data centre in Ireland. The one exception is a receipt photo sent for optional scanning, as described above. That transfer is protected by the European Commission's Standard Contractual Clauses.
How long we keep it
- Enquiries from this website: as long as we need to deal with them, and no longer than 24 months after our last contact with you, unless you become a customer.
- Receipts: 12 months. Before they are deleted, your organisation is given a full archive to keep for its own records, such as the six years Revenue expects.
- Claim details (dates, amounts and descriptions): for as long as your organisation uses ExpenC.
- When your organisation stops using ExpenC: its data is deleted within 30 days, after it has had the chance to export it, and removed from backup copies within 90 days.
- Technical logs: 30 days. Backups: 14 days.
Your rights
Under the GDPR you have the right to:
- access the personal data held about you
- have inaccurate data corrected
- have your data erased, where it no longer needs to be kept by law
- restrict or object to how it is used
- receive your data in a portable format
For this website and enquiries, email sales@dikoro.com. For your expense data in the app, please ask your employer first, as they control it; you can also email us and we will pass your request to them and help them answer. Requests are answered within one month.
If you're unhappy with how your data has been handled, you can complain to the Data Protection Commission at www.dataprotection.ie.
Security
All connections are encrypted (HTTPS), and the database, receipts and backups are encrypted where they are stored. Each organisation can see only its own data, and access within it follows each person's role. See our Security page for more detail.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed.