Reimgo

Choose your country

Sign in Start free trial
Menu

Privacy policy

This policy explains what personal data Reimgo handles, why, and what you can do about it. Last updated 16 November 2026.

Who we are

Reimgo is an expense management service operated by HRX360 Ltd, a company registered in England and Wales (company number 16253152) with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("we", "us"). Reimgo is the customer-facing brand. Contact: support@reimgo.com.

Reimgo is used by companies ("customers") and their staff ("users"). When a company uses Reimgo to handle its employees' expenses, the company decides what data is collected and why; we process that data on the company's instructions under our terms and a data processing agreement. When you visit this website or sign up for a trial, we decide how your data is used and this policy applies directly.

What we collect

Account data. Name, work email address, password (stored as a salted hash), authenticator secret for two-factor sign-in (encrypted), role, manager, department, cost center, grade, time zone, language, and the company you belong to.

Expense data. Expenses, expense reports, receipts (images and PDFs, including a cleaned copy), amounts, currencies, merchants, dates, categories, projects, notes, policy warnings, approval decisions and notes, and payment status.

Bank details. Where a company uses payment batches, employees' bank account details, encrypted with a key specific to the company. Screens show the last four digits only.

Billing data. The company's subscription status, the number of claiming users each month, and a reference to its customer record at our payment processor. Card numbers are entered on the payment processor's pages and never reach our servers.

Technical data. IP address, browser type, request identifiers and timestamps in server logs and in the audit trail; a session cookie that keeps you signed in.

Website visitors. Our web server logs requests (IP address, URL, time, browser) for security and operations. This website asks before it uses analytics cookies. If you choose Accept, Google Analytics records the pages you view, the page or campaign link that brought you here, clicks on our sign-up and app store buttons, your browser and device type, and your approximate location. If you do not accept, nothing is sent to Google Analytics and no analytics cookie is set. You can change your choice at any time with "Cookie settings" at the bottom of every page. Our cookies page lists the cookies and everything Google Analytics receives.

How we use data

To run the service: read receipts, create expenses, route approvals, prepare reimbursement files, produce reports and exports, send notifications, and bill the company. To keep the service secure: sign-in, two-factor codes, rate limiting, the audit trail, fraud controls such as holding payments to recently changed bank accounts. To support customers and improve the service. With your consent, to count visits to this website and see which pages and campaigns bring people to it; we rely on your consent for this and you can withdraw it at any time.

We do not sell personal data, and we do not use customer data for advertising or to train artificial-intelligence models.

AI features

Receipt reading. When a user captures a receipt, the image is sent to an AI provider (Anthropic, PBC, United States) through its API to extract fields such as merchant, date, total, tax, currency and a category. The image is treated as data, not as instructions, and the result is validated before a person reviews it. We do not send employee names, bank details or salary information to the AI provider, and the provider does not use the content to train its models under the terms we hold with it. The AI never submits, approves or pays anything.

Ask Reimgo. When a user asks the in-app assistant a question, the question, the help articles used to answer it and, when the company has live data switched on, the records needed to answer it are sent to the same AI provider. Live data covers only what the asking person can already see in Reimgo, people's names appear as codes such as person_1, and bank details, card numbers, salaries and contact details are never sent. A company admin can switch live data off in Settings. Conversations are kept for 90 days after their last message, are visible only to the person who had them, and are removed within 24 hours when that person deletes them.

AI apps you connect. A company admin can allow users to connect an outside AI app, such as Claude, to Reimgo. This is off until an admin switches it on, and each user must approve the app on a Reimgo screen. The app can then read, never change, what that user can see in Reimgo, with people's names as codes and without bank details, card numbers, salaries or contact details. Data the app reads goes to that app's provider, which handles it under the customer's or user's own agreement with that provider, not under this policy; it is not our service provider. Every read is recorded in the company's audit trail. A user can disconnect an app in their profile, and an admin can switch AI apps off for the whole company, which ends every connection at once.

Who else receives data

We use service providers to run Reimgo. Each receives only what its task needs:

  • **Hosting and backups**: Amazon Web Services (AWS) in the United States, US West region, with nightly database backups in the same region.
  • **AI receipt reading and Ask Reimgo**: the AI provider named above.
  • **Email**: Amazon Simple Email Service (part of AWS, our host) sends sign-in codes, notifications and invoices, and receives the emails users forward to Reimgo's receipt address. We accept a forwarded email only from a user's own sign-in address, keep the receipt and the text read from it with the expense, and the stored copy of the email is deleted from the mail service within 7 days.
  • **Payments**: Stripe, Inc. for subscriptions and invoices; Stripe holds card details under its own privacy policy.
  • **WhatsApp**: when a user links a WhatsApp number, the receipts and messages they send to the Reimgo number, their phone number and our replies pass through the WhatsApp Business Platform of Meta Platforms, Inc., which handles them under WhatsApp's own terms and privacy policy. We keep the linked number and a record of the messages to run the feature and the audit trail, and remove the link with the user's personal data.
  • **Fonts**: this website loads fonts from Google Fonts, which receives your IP address when a page loads.
  • Website analytics: Google Analytics, a service of Google Ireland Limited, only for visitors to this website who accept analytics cookies. It receives the visit data described under "What we collect"; Google and its affiliates may process it in the United States and other countries where they operate, under Google's data processing terms. It receives nothing from the Reimgo app and no customer data, and we have switched off its advertising features.

We disclose data when the law requires it, to protect our rights or users' safety, or as part of a sale or reorganization of our business, with notice where required. We do not share personal data with data brokers. AI apps a company chooses to connect receive data on the company's instruction, as described above.

Where data is stored

Customer data is stored in a database dedicated to the customer's company, on Amazon Web Services (AWS) in the United States, US West region. Data may be accessed by our staff from the United Kingdom and the United Arab Emirates for support and operations under access controls. Transfers of personal data of UK and EU persons to the United States are covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses in our data processing agreement. If your company needs hosting in another region, ask us before you commit.

How long we keep data

Expense records, receipts, approvals and audit entries are kept for as long as the company's account exists, because they are the company's financial records. When a trial or subscription ends, the company's data becomes read-only and remains available to view and export. We delete a company's data on the company's written request, confirmed by its admin, or 90 days after the account is closed. Ask Reimgo conversations are kept for 90 days after their last message. A connection to an AI app lasts until the user or an admin ends it, and the app must ask again after 30 days without use, or after 90 days at most. Server logs are kept for 90 days. Backups are overwritten on a rolling 14-day schedule. A former employee's personal data can be removed by the company's admin while the financial records stay under a pseudonym. Website analytics: visit data is kept in Google Analytics for 14 months, its cookies last 13 months, and your cookie choice is remembered for 6 months, after which we ask again.

Security

Each company has its own database. Traffic is encrypted in transit. Bank account details and payment files are encrypted at rest. Passwords are hashed. Admin and finance users must use two-factor sign-in. Releasing a payment requires a second person and a fresh authentication code. Every change is written to an append-only audit trail. We hold no security certifications and do not claim any; our security page describes what we do and do not do.

Your choices and rights

Users can see and correct their own profile and expenses in the app, and ask their company's admin for the rest. Companies can export all their data at any time. Depending on where you live you may have rights to access, correct, delete, restrict or port your data, to object to processing, and to complain to a supervisory authority: in the United Kingdom the Information Commissioner's Office (UK GDPR), in the United Arab Emirates the UAE Data Office (PDPL), and in US states with comprehensive privacy laws (such as the California CPRA) the rights those laws give employees and consumers, which we honour through your employer as the business we serve. We do not sell or share personal data for advertising and we do not discriminate against anyone for exercising a right. To exercise a right, write to support@reimgo.com. Where we process data for a company, we will refer the request to that company and help it respond within the time the law allows.

Children, changes and contact

Reimgo is a business service and is not directed to children under 16. We will post changes to this policy on this page and, for material changes, notify customer admins by email. Questions: support@reimgo.com.