Privacy Policy

Last updated: 21 August 2026

Cloud Pro Expense is provided by Cloud Pro Advisor ("we", "us"), based in the United Kingdom. This policy explains what personal data we collect through Cloud Pro Expense, why, and how it is protected. It applies to organisations that use the service ("Customers") and the staff accounts they create within it ("Users").

What we collect

• Account data: name, email address, and role for each User; organisation name.
• Receipt images: photographs of receipts that Users upload.
• Extracted expense data: vendor, date, amount, currency, category, and line items read from receipt images by an AI model, plus any corrections a User or reviewer makes.
• QuickBooks Online connection data: an OAuth access/refresh token for the Customer's own QuickBooks company, and cached company/account information needed to post approved expenses.
• Usage data: login sessions (via a secure cookie) and basic activity logs (who submitted/approved/rejected a given expense, and when).

How we use it

Solely to provide the service: letting Users submit receipts, using AI to extract the data on them, routing submissions through a review/approval workflow, and — once approved — writing the resulting Bill or Purchase into the Customer's own connected QuickBooks Online company. We do not sell personal data, and we do not use Customer data to train AI models.

Who we share it with

We use the following processors to run the service. Each receives only what it needs to perform its function:

• Anthropic — receives receipt images to extract structured data (vendor, date, amount, etc.) using Claude.
• Cloudflare (R2 object storage) — stores receipt images in a private store, namespaced per organisation.
• Intuit (QuickBooks Online) — receives the expense data a Customer's own reviewer has approved, written into that Customer's own QuickBooks company via their own OAuth connection. This is the Customer's own accounting platform, not a third party we share data with independently.
• Resend — sends account and invite emails on our behalf.
• Railway — hosts the application and its database.

Some of these providers are based outside the UK. Where personal data is transferred internationally, we rely on the legal mechanisms recognised under UK data protection law (such as standard contractual clauses) to protect it.

How we protect it

• QuickBooks OAuth tokens are encrypted at rest (AES-256-GCM) and are never logged.
• Each organisation's data is isolated at the database level — no organisation can access another's receipts, users, or QuickBooks connection through the application.
• Receipt images are stored privately and served only to authenticated Users entitled to view that specific receipt — never via a public URL.
• All traffic to the service is encrypted in transit (HTTPS).

Data retention

We retain account and receipt data for as long as an organisation's account remains active, and for a reasonable period afterward to meet accounting, tax, and legal obligations. A Customer may request deletion of their organisation's data by contacting us, subject to any records we are legally required to keep.

Your rights

If you are in the UK or EU, you have rights under data protection law to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these, contact us at cloudproadvisor@benbloss.com. If you are not satisfied with our response, you may complain to the UK Information Commissioner's Office (ico.org.uk).

Children

Cloud Pro Expense is a business tool and is not directed at or intended for use by children.

Changes to this policy

We may update this policy as the service changes. We will post the updated version here with a new "last updated" date; material changes will be communicated to Customers directly.

Contact

Questions about this policy or your data: cloudproadvisor@benbloss.com.