Privacy policy

Your name, mobile number, email, and date of birth. Your location, only if you turn on location sharing. The receipts and payment confirmations you upload, including the images themselves. The fields we read from them: the merchant, the date and time, the total, the reference or receipt number, and the line items. Device and app usage data.

We never extract the recipient’s mobile number from a payment confirmation. That is a third party’s information, they did not consent to it, and the merchant check reads only the name.

We are not in your payment, so we hold no card data and no wallet credentials.

Paldo does not read your receipts itself. When you upload one, the image is resized and sent through an AI gateway run by ED3N Ventures to Anthropic, in the United States, whose Claude model extracts the fields. That means your receipt and payment confirmation leave the Philippines and are processed on Anthropic’s servers outside the country. This is the single most important thing to understand before you upload anything.

Each image you upload, the receipt and the payment confirmation alike, is also sent to Hive, in the United States, which checks whether it was generated by AI. Hive returns a score and nothing else. A high score holds the claim for a member of staff to look at; it never rejects one on its own.

A payment confirmation usually shows the name of the person or business you paid. When you upload one, that person’s name leaves the country with it. Please only upload confirmations for your own transactions.

If we change who reads your receipts, we ask for your consent again before we read the next one.

The decision is automated. Our servers compare the two documents — the merchant, the amount, and the timing — and credit points when they agree. No person reads your claim to approve it.

When the two documents nearly agree, or an image looks like it may have been edited or generated, the claim is held and a member of Paldo staff looks at it, including the images. That is the one case where a person sees your receipt.

If a claim is rejected, we tell you which check failed and keep your other document so you can retake just the one photo. We cannot currently reverse a rejection by hand.

To award points, verify claims, and prevent fraud.

We also build a profile of what you buy: for each shop you buy from, how often you go, how much you spend, and when you were last there. This is built from your confirmed claims and is what makes Paldo a purchase-intelligence service rather than a receipt scanner.

Location sharing is off until you turn it on, and you can turn it off at any time in the app. While it is on, Paldo collects your location, including when the app is closed or not in use, to pay you points for the time you share it and to show you offers from shops near you.

We never store your exact position or a trail of where you went. Your phone's location is checked on our servers and then discarded. What we keep is coarser: the area you are in, about 1 km across, for 24 hours; places where you stayed 10 minutes or more, as that same 1 km area and the times, for 90 days; and the area where you scanned a receipt, beside that receipt. You can see your places in the app.

Paldo staff see how many people share their location in each area, which can be as few as one, but never a name or account. Partner shops never receive your location. Turning sharing off stops collection straight away and keeps the points you already earned; places already recorded stay until their 90 days run out, and are deleted with your account.

ED3N Ventures, which runs the AI gateway that passes your receipt images to Anthropic. Anthropic, which reads your receipt images, in the United States. Hive, which checks your receipt and payment images for AI generation, in the United States. Clerk, which holds your account and sign-in details, in the United States. Neon, which hosts our database. Cloudflare, which stores uploaded images. WhatsApp, Viber and Telegram, if you choose to link one.

Receipt and payment images are kept for 24 months, then deleted. Points records are kept for as long as your account is open, plus five years for tax and audit purposes.

When you close your account we cut off every way of reaching you straight away, and within 30 days we delete your receipt and payment images and your activity: your check-ins, games, prizes, quests, saved drafts, the profile of where you shop, and any report you filed. Three things outlive that, and this is all of them. Your points records are kept for five years for tax and audit. Your confirmed claims are kept, with your name removed, because the record of which receipt has already been rewarded is what stops someone else claiming it again. And we keep a one-way fingerprint of a mobile number or email address that has already been paid a one-time reward, so that closing and reopening an account cannot claim it twice. That fingerprint cannot be turned back into your number or address.

Under the Data Privacy Act of 2012 you can access, correct, or delete your data, object to processing, and lodge a complaint with the National Privacy Commission.

You can withdraw your consent to us reading your uploads at any time, in Settings under Data & privacy. Withdrawing it stops new claims; it does not undo points already credited.

Write to privacy@paldo.ph and we will respond within 15 working days.