Skip to the content

Privacy policy

Last updated 3 November 2026

Who is responsible

Slopchest is run by XXXXX. For the people and expenses a company puts into Slopchest, that company decides what is collected and why (it is the controller), and we process the data on its behalf. For our own contact with you, such as trial requests and billing contacts, we are responsible ourselves. Questions: contact@slopchest.co.uk.

Our approach

We keep the least we can. Slopchest stores what an expense claim needs and nothing more; each company's data is kept apart from every other company's; and you can see, export and delete what is yours. We don't profile anyone, we don't advertise, and we don't sell or share data for others' use.

Legal basis

We process a company's data to perform our contract with that company, and the company processes its people's expenses to run its own business (its legitimate interest, or its own legal duties on bookkeeping and tax). Where a law asks for consent, for example to send marketing, we ask for it separately and you can withdraw it at any time. We never send marketing to a company's employees.

What we keep

  • People: name, employee code, job title, roles in Slopchest and who they submit to; once they link it, their Telegram account (its user ID, username, display name and app language); an optional email and sign-in name; a password, stored only as a one-way hash; and an authenticator secret if they switch that on.
  • Expenses: receipt photos and PDFs and what is read from them (date, vendor, amounts, taxes, currency, receipt and tax numbers), categories, clients and notes, approvals, questions and comments, and the history of every change.
  • Sign-in and security: web sessions with the device type and IP address, sign-in attempts, and when each sign-in happened.
  • Questions to the assistant: the text of what was asked, to answer it and to keep costs in check.
  • Trying the bot before signing up: if you send the bot a receipt before your company uses Slopchest, it is read, shown back to you and not stored. We keep only how many you've tried, against a coded form of your chat (not your Telegram ID itself).
  • Billing: your company's subscription status, number of seats and Paddle customer number. Card and payment details stay with Paddle: we don't keep them, and we remove them from the payment notices Paddle sends us before storing those.

Why we use it

To run Slopchest: filing, reading, numbering, approving and exporting expenses. To keep accounts secure, to bill, to give support and fix problems, and to meet our legal duties. We never use it for advertising and we never sell it.

Who else handles it

  • Anthropic: the AI model that reads receipts and answers questions. It receives the receipt image, or a question together with what's needed to answer it: the person's name and company, their recent lines and the company's categories. When an admin uploads the company's own Excel form, the AI reads its first rows once, to find the table. Under Anthropic's commercial terms, this data is not used to train its models.
  • Telegram: carries the messages between your people and the bot.
  • Paddle: payments, tax and invoices, as our merchant of record.
  • Our server hosting provider: runs the servers and stores the data.
  • Frankfurter and ExchangeRate-API: exchange rates. They receive only currencies and dates, no personal data.

Some of these providers work outside your country, including in the United States. Where the law requires it, we rely on their standard data protection terms.

How long we keep it

  • Receipt files: as long as your company's setting says (3 years unless it's changed, at most 15). A month before files reach that age, accounting is offered a download, and files are removed only after they confirm.
  • Expense lines, numbers and their history: as long as your company uses Slopchest.
  • Backups: the last 14 automatic ones, one a month for 12 months, and the ones an admin makes for 7 days.
  • Questions to the assistant: 90 days. Web sessions: 90 days after they end. Payment notices from Paddle: 400 days. The count of free tries: 180 days after the last one.
  • When your company leaves: on request we delete its data, receipt files and backups within 30 days; the server's own short-term safety copies roll over within a further 30 days.

Your rights

You can ask to see, correct, export or delete your data, or object to how it's used. Your company's admin can correct, export or switch off a person's data in Slopchest; for anything else, or if you'd rather, write to contact@slopchest.co.uk. If you're in the EU or the UK you can also complain to your data protection authority.

Where you are

  • European Union and United Kingdom (GDPR, UK GDPR): the company is the controller and we are its processor under a data processing agreement, which is part of our terms. Transfers to providers outside the EU and UK rely on standard contractual clauses or an adequacy decision. You have the rights listed above and can complain to your supervisory authority.
  • Singapore (PDPA): we collect, use and disclose personal data only for the purposes above and with the consent that the company obtains from its people. Our data protection officer can be reached at the address below.
  • Türkiye (KVKK): this page is also our notice under Article 10 of the law. The company is the data controller for its people's data and we process it on its instructions; personal data may be transferred abroad to the providers named above, on the basis the law allows. Requests under Article 11 can be sent to the address below.
  • United States: we do not sell or share personal information, and we honour deletion and access requests from anyone, in any state.

How it's protected

Everything travels over HTTPS. Passwords are stored as one-way hashes, and people can add an authenticator app. Backups are signed so they can't be altered unnoticed. Every change is recorded, and when our support team opens a company's data, the visit is noted in that company's History. No system is beyond every risk: if we learn that a company's data has been exposed, we tell that company's admin without undue delay, together with what we know and what we're doing about it.

Cookies

Slopchest uses a sign-in cookie to keep you signed in (up to 30 days if you choose to stay signed in), a cookie that remembers light or dark mode, and, for admins and accounting managers, a cookie for viewing the app as one of their people. Small preferences, like a hidden card, are kept in your browser. There are no tracking or advertising cookies.

Children

Slopchest is a business tool and isn't meant for anyone under 16.

Contact

Our data protection officer and contact for every request on this page: contact@slopchest.co.uk.

Changes

When this policy changes, the new version is posted here with a new date, and we tell company admins about changes that matter.