Privacy policy

xReceived is an app for receipt vouchers, cheques and cash custody, made for companies in the United Arab Emirates. It is operated by Bilal Ahmed Nagman in the UAE ("we", "us").

Questions about this policy or your data: [email protected].

The xReceived phone app, the admin panel, the Tally Connector for Windows, our websites (xreceived.com) and the receipt check page. When a company uses xReceived, the company decides what its staff record about its customers; we process that data for the company.

• Account: your name, email address, phone number, and how you sign in (Google, Apple, Microsoft or email).
• Company: company name, trade licence and TRN, address, logo, brand colours, people, roles and branches.
• Customers and money: customer names and contact details, receipts, amounts, cheque details, payment types, handovers and deposits that your company records.
• Photos and signatures: cheque photos, customer signatures and stamps captured in the app.
• Precise location: when you allow it on your phone, the app records the precise (GPS) location when a receipt is issued, as audit evidence for your company. If you say no, that is recorded too; your company can make location required. Receipts issued in the admin panel are marked “office”. We do not track you in the background.
• Device and security: device model and system version, app version, device and push notification IDs, sign-in history (time, device, IP address) and the audit log of changes.
• Problems: crash reports and error details, without the content of your receipts.

• To run the service: sign you in, issue and share receipts, keep the books in step, and sync your phone and the admin panel.
• To keep accounts safe: two-step sign-in, sign-in alerts, the audit log and fraud checks.
• To send emails and notifications you need, such as sign-in codes, receipts and reminders.
• To keep an audit trail of where each receipt was issued (precise location, only when you allow it).
• To fix problems and improve the app.
• To bill subscriptions (payments are handled by Google Play, Apple or our payment provider; we never see your full card number).
• To meet legal duties, such as keeping accounting records.

When you scan a cheque, the photo is first read on your phone. If fields are still missing and your plan includes AI reads, the photo is sent encrypted to our AI provider (Anthropic) only to read those fields. We do not keep that copy of the photo, and the AI provider does not use it to train its models. Your company can turn AI reading off.

The Tally Connector runs on your company's own Windows PC. It reads and writes your company's TallyPrime data only on that PC, to post receipts and keep customer balances in step. It sends to xReceived only what is needed for that, such as receipts, customers and balances.

We use these service providers. They process data only on our instructions:

• Supabase: database, sign-in and file storage, in the EU (Frankfurt).
• Cloudflare: websites, security checks and network.
• Resend: sending emails.
• Sentry: crash and error reports.
• Google / Firebase: Google sign-in, push notifications, Play app checks and Play billing.
• Anthropic: AI reading of cheque photos.

We do not sell your data, and we do not show ads.

Your data is stored in the European Union (Frankfurt). Some providers above may process data in other countries; we use providers with appropriate safeguards.

• Team, Business and Enterprise: the company owner sets how long records are kept, never less than the legal minimum (5 years in the UAE by default).
• Solo: kept while you subscribe. After the subscription stops, kept read-only for 5 years with export available, then deleted. We email you before deletion.
• Free: kept while you use it. An account not signed into for 6 months is deleted; we warn you at 5 months, then 30 and 7 days before.
• Unpaid accounts are locked until paid; the owner can ask for a one-time export.
• Deleted receipts leave a small stub (number, date, status) so the numbering stays complete. Backups expire on a rolling schedule.

Data is encrypted in transit and at rest. Each company's data is kept separate. Roles decide who sees what, two-step sign-in is available, and important changes are written to an audit log that cannot be edited.

You can see and update your details in the app, export your data, and delete your account (see Delete your account). You can also ask us to access, correct or delete your personal data, or object to how we use it, by writing to [email protected]. If your data was added by a company you deal with, we may pass your request to that company.

xReceived is a business tool and is not meant for anyone under 18. We do not knowingly collect data from children.

If we change this policy we will update the date below, and tell you in the app or by email when the change is important.