Privacy Policy

1. Who is responsible

The operator of Receive is responsible for the account and service information described in this Policy. For questions, support, cancellation requests, or privacy requests, email tehila@receive.technology. You may request the operator's legal name and business contact address using this email before purchasing.

The legal identity of the seller may also appear in your purchase confirmation or written service agreement. If your organization provides information about employees, applicants, or other individuals, your organization remains responsible for its own notices, permissions, and lawful use of that information.

2. Information we collect

We collect information you provide and records needed to operate your account and requested services.

• Account and profile information: name, email, organization, optional contact details, preferences, and a securely hashed password for password accounts. Google sign-in supplies an account identifier and basic verified profile information; we do not receive your Google password.
• Grant materials: uploaded files, extracted document text, application requirements, instructions, messages, drafts, revisions, comments, and exports. These may include personal, organizational, financial, or confidential information that you choose to provide.
• Billing information: billing contact details, purchase amounts, allowances, payment status, transaction identifiers, and payment history. Paddle handles payment credentials; Receive does not store full card numbers or card security codes.
• Operational and security records: session identifiers stored as hashes, request and error records, service timings, model/provider information, token usage, internal cost estimates, and legal-agreement acceptance records.
• AI request records: prompts and responses used to generate, investigate, and recover your requested work. These records may include grant text and information from your uploaded documents.

3. Why we use information

We use information to create and secure accounts, authenticate users, process documents, generate and revise grants, provide exports, manage payments and allowances, send necessary account messages, resolve support requests, investigate errors, prevent misuse, and meet legal obligations.

Where a law requires a legal basis, these activities may rely on performing a contract or taking requested pre-contract steps, meeting legal obligations, or legitimate interests such as operating and securing the service, subject to the rights and safeguards required by that law. When consent is legally required for a separate optional activity, that activity requires separate consent. Accepting the Terms or acknowledging this Policy is not a general consent to every possible use.

4. Whether information is required

Providing information is generally your choice, rather than a legal obligation to provide it to Receive. We need an email or verified sign-in identity to create an account, relevant documents and instructions to perform grant work, and the necessary purchase details to process a payment. If you do not provide these, the relevant service may not be available. Optional profile fields are identified as optional. You can choose not to upload a document.

5. Service providers and other recipients

We disclose information only as needed for the service, security, support, legal compliance, or another lawful purpose described here. Providers may act as processors for some data and as independent controllers for other data under their own terms.

• Google Cloud provides hosting and related infrastructure. Google sign-in provides authentication when you choose it.
• Google Gemini and, where configured, model providers reached through the LiteLLM gateway process prompts and responses. The content sent depends on the operation and may include selected grant documents and instructions.
• Reducto may process uploaded files for document extraction and related document operations.
• Paddle.com, our reseller and Merchant of Record, processes checkout, payment credentials, taxes, invoices, fraud checks, refunds, and payment confirmations under its own privacy notice.
• Resend handles account emails such as password-reset and email-verification messages when email delivery is enabled.
• PostHog receives limited product-event metadata for signed-in accounts. Product analytics is enabled by default. Uploaded document contents, grant text, passwords, card data, and raw search text are excluded from these product events.
• Authorized operators may access relevant account or request records for support, security, recovery, or quality investigation. We may disclose information when lawfully required, to protect rights and safety, or in a business transfer subject to applicable safeguards and notice requirements.

• Google privacy information
• Gemini API data-use terms
• Paddle privacy information
• PostHog privacy information
• Resend privacy information

6. AI data handling and product analytics

Receive does not sell your uploaded grant documents or use them to train its own foundation model. External AI and document providers process data under the service and account settings in use. Their retention and model-improvement practices can differ between products and paid or unpaid services. Contact us before uploading material with restrictions that require specific provider commitments.

Prompts and responses may be retained in restricted operational records so interrupted work can be recovered and failures or output quality can be investigated. Product analytics is enabled by default for signed-in accounts and uses limited event metadata, such as account identifiers, application identifiers, document counts, page categories, and revision numbers. It does not use session replay or automatic capture of form contents. These measurements help us find failures and improve the service. They do not include advertising tracking. You can request that we stop product analytics for your account by contacting us. Where applicable law requires consent before collection, the operator must obtain that consent before enabling collection.

7. Cookies and local storage

We use an essential session cookie to keep you signed in and a short-lived security cookie for Google sign-in. The app may store pending edits, interface preferences, or recovery information locally in your browser. These support core functions and are separate from product analytics. Signing out revokes the current server session; it does not necessarily erase every file or local browser setting. Use your browser controls to manage local storage on shared devices.

8. Retention, deletion, and security

We retain account and grant information for as long as reasonably needed to provide the service and your account, handle requests, meet legal and accounting duties, resolve disputes, and protect service security. Different records have different retention needs. Payment and agreement records may need to be kept after an account closes. Operational records and backups may remain until they are no longer needed for recovery, security, or legal purposes.

You may request account closure or deletion using the contact above. We will review what can be deleted, what must be retained, and any applicable legal requirements. Limited backup copies may remain until their normal replacement or deletion. We use access restrictions, secure authentication, and infrastructure safeguards to protect information, but no system can guarantee absolute security. Avoid providing unnecessary sensitive information.

9. International processing

Information may be hosted or processed in Israel and other countries where our hosting, authentication, payment, email, document, and AI providers operate. Those countries may have different privacy laws. Where required, international processing must use applicable contractual safeguards, adequacy mechanisms, or another lawful transfer basis. Contact us for information about the safeguards relevant to your data.

10. Your rights and requests

Depending on applicable law, you may have rights to access, obtain a copy of, correct, or request deletion of personal information, and to restrict or object to certain processing or request portability. Where processing relies on consent, you may withdraw that consent without affecting prior lawful processing. Email tehila@receive.technology to make a request. We may need to verify your identity and may apply lawful exceptions.

You may raise a concern with the Israeli Privacy Protection Authority or another supervisory authority where you have that right. We do not restrict your right to make a complaint. Information about another person may need to be handled through the organization that provided it.

11. Children and Policy updates

Receive is intended for adults aged 18 or older and is not directed to children. Do not create an account or upload information on behalf of a child unless the service and applicable law expressly permit the relevant activity.

We may update this Policy as the service changes. The current version and date are shown here. We will provide appropriate notice of material changes where required. Contact us if you need a copy of a version linked to your account's acceptance record.