PRIVACY
Privacy Policy
Effective date: 1 March 2026 · Last updated: 4 November 2026
Terrapin is built with privacy at its core. Here is a summary before the full policy.
Privacy at a glance
Data not sold. We never sell your personal data to third parties.
Encryption. We protect your data using encryption in transit and at rest.
Your control. You can manage connected accounts and device permissions, disable automatic trip detection, and request access, export or deletion of your data. When you delete your account, connected sources are immediately disconnected and access is revoked. Your data is deleted within 30 days, subject to any legal retention requirements.
Minimal collection. We collect information needed to provide the features you use, maintain and improve the Service, and meet our legal obligations.
No advertising use of financial or location data. We do not use your receipt contents, connected purchase records, precise location or trip routes for advertising or third-party ad profiling.
Optional connections and tracking. Connecting external accounts and enabling automatic trip detection are optional. You control which Google Drive folders Terrapin monitors.
Business-only sharing. Organisation administrators and connected accountants can access business information made available through the Service’s sharing features. Your personal and unclassified trips and their routes are not visible to them.
Learn more about Trust & Security
1. Scope
Terrapin Software Inc. (“Terrapin”, “we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy describes how we collect, use, share and safeguard your information when you use our website, mobile application and related services, including connected-account integrations and supported in-car features (collectively, the “Service”).
This policy applies to users in the United States, Canada and the United Kingdom. We handle personal information in accordance with applicable privacy regulations, including the California Consumer Privacy Act (CCPA), applicable Canadian privacy laws, the UK General Data Protection Regulation (UK GDPR), and the EU GDPR where applicable.
Feature availability may vary by platform, region, account type and release. References to optional features describe how we process information when those features are available and you use or enable them.
2. Information we collect
2.1 Information you provide
We collect your name, email address and account details, together with information you provide when using the Service.
This may include receipt and invoice data, merchant names, itemised expenses, payment details, purchase records, classifications, notes, projects, tags and other information you choose to add. Documents you provide may contain personal or sensitive information.
We also collect information you provide when recording or organising mileage, such as trip classifications, business purposes, saved places, destinations and notes.
When you contact us, we collect your communications with support, including information provided through services such as Intercom.
2.2 Information we collect automatically
We collect device and usage information, session logs, user interaction data, and information needed to diagnose errors, maintain security and operate the Service.
We also use cookies and similar technologies, including those associated with analytics and support tools such as Google Analytics and Intercom. Section 9 explains our use of these technologies.
Location and motion information used for mileage features is described separately in Section 2.4.
2.3 Information from third parties
We may receive information from analytics and marketing platforms, including Google, Meta, TikTok and LinkedIn; payment processors, including Chargebee and Stripe; financial data aggregators, such as Plaid; and authentication providers.
When you connect an account or enable an integration, we may also receive information from email providers, such as Gmail and Outlook, to discover and import receipts and invoices; cloud storage providers, including Google Drive, to discover receipts and invoices in folders you select or deliver exports you authorise; and Amazon Business, to import authorised purchase records and supporting documents.
The information received depends on the integration, the permissions you grant and the records the provider makes available.
2.4 Information from on-device access and mileage features
With your permission, our mobile application may access certain on-device information to provide the features you enable.
Photos. We may access photos to detect and import receipt images.
Messages. Where supported and permitted by your device and operating system, we may access messages you authorise us to process to identify receipts sent through SMS or messaging services.
Calendar. We may access calendar information to assist with receipt and event reconciliation, such as associating travel or dining expenses with meetings, and to support trip context or destination features you enable.
Location and mileage. With your permission, we use location information to associate receipts with locations and to record and manage mileage. Depending on the features you use, this may include precise location coordinates, route points, timestamps, speed, direction, location accuracy, start and end locations, distance travelled, and saved places or destinations.
We use this information to create trip records, display routes, calculate mileage and related expense estimates, recognise arrivals or stops, and help you classify your journeys.
You can record trips manually. Location recording may continue in the background during an active manually started trip.
Where available, you can also opt into automatic trip detection. Automatic detection uses location and motion signals to identify when you are driving and when a trip starts or ends. When you enable this feature and grant the required permissions, this processing can take place in the background, including when the app is not open or your device is locked, subject to your operating system’s controls.
A detected trip and its route may be recorded and synchronised to Terrapin before you review or classify it. Trip information may be buffered on your device before synchronisation.
Motion and activity. Where you enable automatic trip detection and grant the relevant permissions, we use device motion and activity-recognition information, such as indications that you are driving, stationary or walking, to detect and manage trips.
Your controls. You can disable automatic trip detection in Terrapin and manage location and activity permissions in your device settings. Ending an individual trip does not, by itself, disable automatic detection of future trips. Disabling tracking does not delete trips already recorded.
We do not use precise location information or trip routes for advertising.
2.5 Connected accounts and integrations
Connecting an external account is optional. We receive the account identifiers, authorisation information and connection settings needed to provide the integration you enable.
Google Drive and Amazon Business connections use the provider’s authorisation process. We receive authorisation tokens rather than your account password. These tokens allow the integration to operate within the permissions you grant, including checking for new records while you are not actively using Terrapin.
Google Drive: receipt and invoice discovery
When you connect Google Drive for receipt discovery, you choose which folders Terrapin should monitor.
We read supported files in those folders and their subfolders to identify receipts and invoices. Supported files include PDFs, images and saved email files such as .eml. For saved emails, processing may include relevant message information, the receipt-containing body and attachments.
We process file contents and relevant metadata, such as file and folder names, identifiers, file types and modification times. We use this information to extract receipt and invoice details, including merchant, date and amount, create or enrich your expense records, and avoid duplicate imports.
We also access folder names and identifiers so that you can browse and select folders. While the connection and monitoring remain enabled, Terrapin periodically checks the selected folders and their subfolders for new or updated files.
Google’s read-only Drive permission allows an application to view and download files across the connected Drive account. This permission is broader than the folders you select in Terrapin. For receipt discovery, Terrapin limits file-content processing to your selected folders and their subfolders, together with the folder metadata needed for selection and navigation. We do not use receipt-discovery access to read file contents outside those selected folders.
Receipt discovery is read-only. It does not create, edit, move or delete files in your Drive. Copies of imported documents, extracted information and relevant source metadata are stored in Terrapin to provide your receipt and expense records.
You can change the folders you monitor or disconnect the integration through the controls available in Terrapin. You can also revoke Terrapin’s access through your Google Account. Disconnection and deletion are explained in Section 6.
Google Drive: optional exports
Separately, where available, you may authorise Terrapin to export reports and supporting documents to a Google Drive destination you select.
This feature requires permission to create export files and folders. Authorising exports is distinct from enabling read-only receipt discovery. We use the export permission to deliver the exports you request or schedule.
Amazon Business
Where available, you can authorise Terrapin to import records from your Amazon Business account.
Depending on the permissions granted and the records Amazon makes available, these may include account and business identifiers, order references and dates, seller information, purchased items and quantities, prices, taxes, charges, refunds, invoices, credit notes and other supporting purchase documents. Documents may also contain buyer, billing or delivery information.
We use these records to create and enrich your expense records, associate supporting documents, categorise purchases, reconcile charges and refunds, and avoid duplicate imports.
Synchronisation may retrieve historical records and check for subsequent purchases or updates while the integration is enabled. This integration is for expense recordkeeping. It does not place orders or initiate payments on your behalf.
2.6 CarPlay, Android Auto and system integrations
Where supported, Apple CarPlay, Android Auto and system features such as Siri and app shortcuts allow you to control or view Terrapin mileage features. Available controls vary by platform and release.
These features process the commands you issue and relevant trip information, such as recording status, elapsed time and distance, to operate the trip and display its status. The underlying location and trip processing is described in Section 2.4.
Where enabled, CarPlay connection and disconnection events may also help Terrapin recognise a trip interruption or ending. These are connection signals, not direct access to your vehicle’s ignition or diagnostic systems.
Using an in-car interface does not replace the permissions and choices required for background location access or automatic trip detection.
3. How we use your information
We use your information to provide and maintain the Service, manage your account, process subscriptions and payments, and provide support.
This includes discovering, importing, extracting, organising, classifying and categorising receipts, invoices and purchase records, including through optical character recognition and AI models. We may enrich records using information from financial data providers, such as Plaid, and other sources you authorise.
We use information from connected email, Google Drive and Amazon Business accounts to provide the discovery and recordkeeping features you enable. We use authorised on-device information to simplify receipt import, provide context and support classification.
For mileage features, we use information to record and manage trips, detect journeys when you enable automatic detection, display routes, support trip classification, and calculate mileage and related expense estimates.
We also use information to provide the exports, synchronisation, collaboration and sharing features you request or configure.
Other purposes include communicating with you about support, updates and marketing where permitted; improving the Service through analytics and feedback; maintaining security and preventing misuse; and complying with legal obligations.
The Google-specific restrictions in Section 5 apply to information obtained through Google APIs and take precedence over these general purposes.
4. Legal bases for processing
Where the UK GDPR or EU GDPR applies, we rely on the following legal bases, depending on the information and purpose involved:
Contractual necessity. Processing needed to provide the Service you request, including account management, receipt processing, mileage records and billing.
Legitimate interests. Processing needed for purposes such as maintaining security, preventing fraud, diagnosing problems and improving the Service, where those interests are not overridden by your rights.
Consent. Processing for which we request your consent, including relevant marketing, non-essential cookies and optional device-access, location or activity features.
Legal obligation. Processing needed to comply with applicable legal or regulatory requirements.
For users in Canada, we obtain consent where required by applicable Canadian privacy law and rely on permitted exceptions only where applicable.
Where processing relies on consent, you can withdraw it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Disabling a permission or withdrawing access may prevent the associated feature from working.
5. Sharing and disclosure
We do not sell your personal data.
Service providers
We may share information with service providers under contract that help us operate the Service, including hosting, customer support, payment, financial data, document processing, analytics and security providers.
We use Microsoft Azure to host and process Service data, including document contents and location information where needed for the features you use. Relevant document extraction, AI processing and location-processing services are provided through our contracted Azure services.
Other providers may include Intercom, Chargebee, Stripe and Plaid, according to the features you use. Providers receive information needed to perform their services and are subject to appropriate contractual and security requirements.
Our processing agreements and international-transfer arrangements are documented and monitored as part of our data protection and security programme.
Organisations, accounting practices and authorised recipients
We disclose information to people, workspaces, accounting practices and external services you authorise through the Service’s sharing, collaboration, integration and export features.
Access through organisation and accounting-practice features is limited to business information made available through those features, subject to the applicable permissions and sharing settings.
For mileage, authorised organisation administrators and connected accountants can access only trips classified as business, including associated trip details and routes where available. Personal and unclassified trips and their routes are not visible to them through these features.
Legal and security disclosures
We may disclose information to legal authorities when required by law or where necessary to protect our rights, maintain security or investigate misuse, subject to applicable restrictions.
Google user data
Terrapin’s use and transfer of information received from Google APIs, including Gmail and Google Drive, adheres to the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace user data and developer policy.
We use Google user data only to provide or improve appropriate user-facing features clearly presented in Terrapin. We do not sell it, use or share it for advertising, or use it to assess creditworthiness or for lending.
We do not use Google user data or information derived from it to train AI or machine-learning models. Using AI to extract or classify your records is distinct from using those records to train a model.
Transfers are limited to delivering or improving those features with your consent, security purposes, legal requirements, or a merger, acquisition or asset sale with your explicit prior consent.
Human access is limited to your affirmative permission to review specific information, necessary security investigations, legal requirements, or permitted internal operations involving aggregated and anonymised information.
These restrictions apply to information derived from Google user data and to providers processing it on our behalf. They override broader statements about analytics, marketing, sharing or retention elsewhere in this policy.
6. Data retention and deletion
We retain personal information only for as long as necessary to provide the Service, fulfil legal or regulatory obligations, resolve disputes and enforce our terms.
The appropriate retention period depends on the information involved, the features you use, your account status, deletion requests and any applicable legal requirements.
Disconnecting a source
Disconnecting an integration stops future synchronisation through that connection and revokes Terrapin’s access through it.
Disconnection does not automatically delete receipts, invoices, purchase records or other information already imported into Terrapin. Those records remain subject to this retention policy and your applicable deletion rights.
Similarly, disabling automatic trip detection stops future automatic detection but does not delete previously recorded trips or their routes.
Deleting your account or information
When you delete your account, your connected sources are immediately disconnected and Terrapin’s access to those sources is immediately revoked.
We delete your personal data within 30 days of your account-deletion request. You may also request deletion of specific personal information by contacting us using the details in Section 12.
Where we are legally required to retain particular information, we retain only what is necessary for that obligation, restrict its use to that purpose and delete it when the retention requirement ends. We will explain any applicable limitation when responding to your request.
Deleting information from Terrapin does not delete original records held in Google Drive, Amazon Business or other connected services. It also does not automatically delete copies previously exported or shared outside Terrapin. Where applicable law requires us to notify recipients of a deletion request, we will do so.
Anonymised information
Where permitted by applicable law and relevant provider policies, information may be anonymised and retained for analytical purposes. Google API data and information derived from it remain subject to the restrictions in Section 5.
7. Data security and international processing
We use technical and organisational security measures designed to protect your information, including encryption in transit and at rest, access controls, security monitoring and documented data-handling procedures.
Our core infrastructure is hosted on Microsoft Azure in the United States. Your information may therefore be processed outside your country of residence. We maintain documented processing agreements and appropriate international-transfer arrangements where required by applicable data protection law. You can contact us for information about the safeguards applicable to your data.
Terrapin undergoes annual independent SOC 2 Type II audits and annual Google Cloud Application Security Assessment (CASA) assessments. We maintain Cyber Essentials certification and monitor our data protection and security controls as part of our ongoing compliance programme.
We have also completed Microsoft Partner Verification. Further information about our security practices, assessments and assurance programmes is available on Terrapin’s Trust & Security page.
No method of transmission or storage is completely secure. We work to protect your information, but cannot guarantee absolute security.
8. Your rights and controls
Depending on your location, you may have the right to access your personal information, request correction or deletion, object to or restrict processing, obtain a portable copy of your information, withdraw consent, and raise a complaint with an appropriate privacy regulator.
You can manage connected accounts and automatic trip detection through the settings available in Terrapin. You can also revoke Terrapin’s Google permissions through your Google Account and manage location, activity, photo and calendar permissions through your device settings.
Withdrawing access or disabling a feature does not automatically delete information already stored in Terrapin. Section 6 explains the distinction between disconnection and deletion.
You can withdraw consent to marketing communications using the unsubscribe mechanism provided or by contacting us.
To exercise your rights, contact . We may need to verify your identity before fulfilling a request and will request only information reasonably needed for that purpose.
You may also raise concerns with the privacy regulator responsible for your jurisdiction, including the Information Commissioner’s Office in the United Kingdom.
9. Cookies and tracking
We use cookies and similar technologies to maintain login sessions, provide support, analyse website traffic and behaviour, and support marketing activities.
These technologies may include Google Analytics, Intercom and advertising tools provided by Meta, Google and TikTok. Where required by applicable law, we obtain consent before using non-essential cookies or similar technologies.
You may manage cookies through the controls available on our website and through your browser settings. Disabling necessary cookies may affect certain features.
We also use Microsoft Clarity and Microsoft Advertising to understand interactions with our website through behavioural metrics, heatmaps and session replay, and to support website optimisation, security and marketing. Microsoft’s handling of information through its services is described in the Microsoft Privacy Statement.
Receipt and invoice contents, purchase details obtained through connected integrations, precise location information and mileage routes are excluded from advertising use and session-replay capture.
Information obtained through Google APIs, including information derived from it, is not used or shared for advertising, advertising audiences or advertising conversion tracking. The Google-specific restrictions in Section 5 continue to apply.
10. Children’s privacy
Terrapin is not intended for children under 18. We do not knowingly collect personal information from minors.
If you believe a minor has provided personal information to Terrapin, contact us so that we can investigate and take appropriate action.
11. Changes to this policy
We may update this policy from time to time. Changes will be posted on this page with a revised last-updated date.
Where required, we will provide additional notice of material changes and obtain consent before using information in a materially different way or accessing additional information that requires your authorisation.
12. Contact us
For questions or concerns about this Privacy Policy, or to exercise your privacy rights, please contact:
Terrapin Software Inc.
104 Miller Brook Rd
Killington, Vermont 05751
United States
Email: