Privacy Policy

Last updated: August 27, 2026

Cardtrack ("we", "our", "us") is an internal expense management service operated by Henderson Companies ("the Company"). This policy describes how the Cardtrack web and mobile applications handle information for authorized Company users.

1. Information We Collect

Cardtrack processes the following data on behalf of the Company:

• Expense transaction data (merchant, amount, date, card last-4 digits)
• Category and location assignments
• Receipt images uploaded by authorized users
• User account information (name, email, role)
• Authentication, session, and multi-factor verification information
• Device installation identifiers, platform, app version, notification preference, and push-delivery tokens
• Plaid and QuickBooks Online connection information for authorized Company accounts

2. How We Use Information

All data is used exclusively for internal business expense management, including:

• Categorizing and tracking business expenses
• Sending an expense-specific alert whose payload includes the merchant and amount
• Suggesting categories and locations from Company expense history and, when rule-based evidence is not enough, an AI service
• Syncing approved expenses to QuickBooks Online
• Generating reports for accounting and tax purposes
• Protecting accounts, troubleshooting failures, and maintaining the service

3. Mobile Permissions

Cardtrack requests notification permission only when you enable expense alerts. The notification payload includes the expense merchant and amount; your device displays those details only when notification previews are enabled. You can hide previews in system settings. Camera or photo-library access is requested only when you choose to photograph or select a receipt. Cardtrack uploads only the receipt image you capture or select; it does not upload the rest of your photo library. You can change system permissions in your device settings and turn expense alerts off within the app.

4. Service Providers and Data Sharing

We do not sell personal information, use it for third-party advertising, or track users across other companies' apps or websites. We use service providers only to operate Cardtrack, including Railway for application/database hosting; Expo, Apple Push Notification service, and Firebase Cloud Messaging for mobile notifications; Plaid for authorized financial-data connections; Intuit for QuickBooks Online synchronization; OpenAI for category and location suggestions; and Mailgun for operational email. For an AI suggestion, OpenAI may receive the expense merchant, amount, date, card last four, cardholder name, and relevant category/location history. A push provider receives a delivery token, an internal expense identifier, and visible alert text containing the expense merchant and amount. Cardtrack does not put the receipt, note, category, location, full card number, or account credentials in the notification payload.

5. Data Storage and Security

Business data and financial-provider connection tokens are stored in an access-controlled PostgreSQL database hosted on Railway. Provider tokens are used only by the Cardtrack server for authorized connections and are not returned to mobile users. Mobile refresh tokens are stored using the device's protected credential storage, and short-lived access tokens are kept in app memory. Network connections use HTTPS/TLS. Access is restricted to authorized Company users and enforced by role and expense ownership.

6. Data Retention

Expense data, receipts, audit history, and accounting sync records are retained for the period required by the Company's accounting, tax, and legal obligations (typically 7 years). Mobile sessions expire or are revoked, and invalid push tokens are disabled. Some records may remain in protected backups until the backup retention period ends.

7. Your Choices and Requests

You can disable mobile alerts in Cardtrack or in system settings. To request access, correction, or deletion of account information, contact your Company administrator or the address below. Expense and accounting records may need to be retained even after account access is removed.

8. Changes

We may update this policy as needed. The "Last updated" date at the top reflects the most recent revision.

9. Contact

For questions, contact: admin@infly.co