Data Privacy

Each Operator manages a company workspace containing its authorised users and financial records. The organisation decides who may act as an administrator, which pilots and accounting staff receive access, which cards are assigned to each pilot and which optional connections are enabled. These decisions form an important part of the organisation’s instructions for processing information within the service.

AeroXpense processes workspace information to supply expense and reconciliation functions. The application is not an independent authority on whether an expense is deductible, reimbursable or operationally justified. Those decisions remain with the Operator. An enterprise customer should confirm any requirements for processing location, retention, legal holds or access review in a written agreement before introducing data subject to those requirements.

In Starter, pilots provide expense information and receipts manually, and the company performs reconciliation manually. In Pro, the same receipt-led workflow is supplemented by AI extraction and assistance when the administrator uploads a statement. These plans do not receive an automatic Plaid card feed; the receipt and manually entered expense are therefore the company’s source record for the pilot’s spending.

In Premium, authorised corporate credit-card transactions arrive through Plaid and are associated with the company and the pilot assigned to the card. The administrator uploads the relevant statement to verify existing charges. Premium pilots are not required to upload receipts for those charges. A transaction that has not yet been verified remains a company reconciliation exception, not a demand that the pilot supply a receipt. Statement uploads are used for comparison and verification, not to create additional spending records.

Plaid Link provides the financial institution connection experience. Subject to the administrator’s authorisation and provider availability, AeroXpense receives corporate credit-card metadata and transaction information such as institution, card name, masked reference, merchant description, transaction date, amount, currency and pending status. This information supports attribution, spend reporting and reconciliation. General bank-account transactions are not the intended source for the application’s card expense workflow.

AeroXpense does not collect the banking password entered in Plaid Link, and the connection does not provide full card numbers, CVVs or PINs for use by the application. Connection credentials used for retrieval are handled server-side. Plaid and the financial institution control aspects of consent, supported accounts and data delivery. Newly incurred charges may not appear immediately, and pending entries may change when posted.

Uploaded receipts and statements can contain more information than the fields needed for reconciliation. The Operator should review documents before upload and avoid submitting unrelated personal records or unnecessary sensitive information. The service may store the document alongside extracted dates, merchants, currencies, amounts and reconciliation associations so that the source evidence can be referred to during review.

A statement verification indicates that an existing transaction has been associated with supporting statement evidence. A receipt match indicates an association with an expense receipt. These are distinct evidence types and should not be treated as interchangeable with a formal audit certification. Finance personnel should investigate material mismatches, duplicated source entries and incomplete statement periods before relying on a report.

Anthropic Claude is used for AI-assisted receipt extraction and statement analysis. Depending on the task, the information processed may include the uploaded image or document, its extracted text and relevant transaction details for a comparison. Processing is undertaken to produce structured fields and reconciliation assistance. AeroXpense does not use customer financial or flight information to train third-party AI models.

Automated processing may be affected by poor scans, unusual layouts, mixed currencies, ambiguous dates or merchant naming differences. The Operator should review significant output against the original source rather than assume that an AI result is conclusive. Enterprise questions concerning provider retention or contractual processing protections should be assessed against the applicable provider arrangement and any signed customer terms, rather than an assumed zero-retention guarantee.

Company-scoped permissions are used to separate one Operator’s information from another’s. Within an organisation, access depends on the assigned role and relevant card or record assignments. Administrators and authorised finance personnel require broader access for reconciliation, whereas pilot visibility is tied to their authorised records. The Operator should periodically review membership and card assignments and remove access when a person leaves or changes responsibilities.

The service may display last sign-in information and session presence to help administrators manage accounts. Such indicators are not a continuous monitoring record or a guarantee that a specific individual is currently using a device. Shared credentials weaken accountability and should not be used. Initial access details should be delivered securely by the administrator when email invitations are not configured.

Enabled flight-operations connections may supply aircraft identifiers, flight dates, airport pairs, trip references and crew assignments to place expenditure in context. Only available, configured integrations participate in a workspace. A provider reference in product or policy material does not establish that the customer has connected that provider or that all of its data fields will be imported.

Other providers may process information for authentication and storage, application hosting, authorised financial retrieval, AI document analysis, subscription payments and transactional communications. Relevant examples include Supabase, Plaid, Anthropic and Stripe where the associated service is enabled. Customers requiring a current subprocessor inventory, deployment locations or formal data processing terms should request a verified description for their intended deployment.

Application controls include authenticated access, company-scoped data permissions and server-side handling of integration credentials. Customers must protect user devices, enable available account protections, control access to exports and avoid disclosing credentials through support requests or document uploads. No platform can guarantee that unauthorised access, outages or data loss will never occur.

Suspected compromise, incorrect access or unintended disclosure should be reported to hi@sidd.hu with a description of the issue and the affected workspace. Do not include a password, full card number or live integration secret in the initial report. Specific incident notification requirements, technical assurance evidence and recovery objectives should be established through the applicable agreement; this page is not a certification or a service-level commitment.

Disconnecting an integration is a prospective access control: it stops future retrieval through that connection. It is separate from erasing transactions, uploaded documents or flight references already used in a historical report. Keeping those records may be necessary for the Operator’s audit trail, tax duties, dispute handling or other lawful purposes. The organisation should define its required retention periods and communicate any special restrictions.

Authorised deletion requests are assessed against the data concerned, the organisation’s instructions and any legal preservation obligations. Active-system removal and expiry of backup copies may follow different schedules. A precise deletion deadline or backup cycle should be confirmed contractually rather than assumed. Where a legal hold applies, the Operator should identify it before requesting removal of relevant records.

Authorised users can use available reporting functions to obtain records for internal review, including period-based reconciliation reports. Downloaded files are outside the application’s access controls once saved or shared, so the Operator is responsible for storing them securely and restricting distribution. Exports should be reviewed to confirm that the selected company records, dates, currencies and statuses match the intended purpose.

Individuals may request access, correction, deletion or other rights available under applicable law. Requests involving employer-controlled records may require the Operator’s instructions and identity verification. For privacy requests, procurement documentation, data processing terms or questions about an integration, contact hi@sidd.hu. Do not assume a particular certification, data residency commitment or legal transfer mechanism without confirmation for the service arrangement concerned.