Privacy Policy
Data Controller
The controller under the GDPR and the Turkish Personal Data Protection Law (KVKK) is AID CORE SOLUTIONS TEKNOLOJİ ANONİM ŞİRKETİ (Sarıyer tax office, tax no. 0102290639), Reşitpaşa Mah. Katar Cad. İTÜ Arı Teknokent 3 Binası, Istanbul, Türkiye.
Data We Process
ExpenSheet processes the receipt and invoice files you upload only to produce the text-recognition (OCR) result you asked for. The file is read in memory, sent to the OCR provider and then discarded; it is not stored on our servers. The extracted table exists only in your browser and in the files you download. ExpenSheet has no user accounts.
Service Provider and International Transfer
To read your file, we send it to Amazon Web Services (AWS) Bedrock, where the recognition model runs on our behalf. AWS may process the file in data centres outside your country, including the United States; the transfer takes place under AWS's security and contractual safeguards.
Abuse Prevention (Free Daily Allowance)
To protect the free allowance and the cost of the service, every upload is counted on our server. We store only an irreversible keyed digest (HMAC-SHA256) of your IP address (for IPv6, of its /64 network prefix), the date and the number of pages used that day, plus an irreversible digest of a random identifier given to each upload so the same request is never processed twice. The raw IP address is never stored. These records expire after at most two days and are then deleted automatically by the database, usually within a few days. They are not used for advertising or profiling.
Cookies and Local Storage
ExpenSheet sets no tracking cookies by default. Your browser keeps your language, column layout, cookie choice (“expensheet_consent”) and the on-page counter of free pages in its own local storage; they never leave your device.
Analytics: Google Analytics 4 and Microsoft Clarity are not active by default. If they are enabled in the future, they load only after you give analytics consent, receive no file names, vendor names or amounts, and your consent can be withdrawn at any time through “Cookie preferences”.
Advertising: ExpenSheet does not show ads at present. The site keeps its Google AdSense publisher verification (ads.txt). If ads are introduced later, this notice will be updated beforehand and, where required, advertising choices will be collected through Google's certified consent platform.
Logs
Our hosting provider (AWS) may record technical request data such as IP address, time, requested address and response status for security and operation. Our application logs do not contain your IP address, the file name or the file itself. To diagnose reading problems, some log entries may include a short excerpt of the recognised content, such as an amount, a seller's name or a tax number.
Your Rights
Under KVKK article 11, you may request information about whether personal data is processed, the purpose of processing, recipients in Turkey or abroad, correction or deletion, objection to processing, and compensation for damages. Under GDPR articles 15-21, you may exercise rights of access, rectification, erasure, restriction, portability, and objection. Because we keep no account and do not store your files or results, no record linked to you exists beyond the short-lived digests described above.
Changing Preferences
If analytics is enabled, you can change your choice at any time through the “Cookie preferences” link in the site footer. Clearing your browser data resets your choice and the on-page counter; the server-side counter is not affected.
Contact
For privacy-related questions and requests to exercise your rights, write to info@expensheet.com or use our contact page.
Last updated: 15 October 2026