WP-Expenses

Privacy policy

As of November 2026

WP-Expenses is expense management for companies: the web app, the iPhone, iPad and Android apps and the server are developed and operated by Waterproof digital media design GmbH. We process personal data under the Swiss Data Protection Act (FADP).

Controller and roles

Waterproof digital media design GmbH
Eggenrain 16
5444 Künten
Schweiz / Switzerland
thomas@waterproof.li

The company using WP-Expenses is responsible for its employees' expense data. We process this data on its behalf and only to provide the service. We are responsible for operating the service, the accounts and security.

Data we process

• Account: name, e-mail address, language and password (stored only as a secure hash).
• Company: role, approver, customers, expense types and settings.
• Expenses: merchant, date, amount, currency, VAT, customer, guests and occasion, notes, status and history.
• Receipts: photos and PDF files. Receipts can show names, shortened card details and other information.
• Technical data: sign-in sessions (IP address, browser or device name, times) and a log of changes within a company.

Camera and photos

The app only uses the camera and photos when you capture a receipt. The text on the receipt is read on our server, and no external services are used for this.

Who sees the data

Employees see their own expenses. Approvers see the expenses of the people assigned to them. Managers and read-only accounts (such as a fiduciary) see the whole company's expenses. Other companies see nothing.

Storage and sharing

The data is held on our server in Switzerland. If a company connects bexio or Abacus, we transfer approved expenses there. Otherwise we share data only where the law requires it. There are no ads and no analytics or tracking services.

Retention

Receipts and expenses are kept for 10 years, because business records must be kept that long. Backups are deleted after 30 days. Deleting a company deletes its data; the company is itself responsible for keeping its records.

Security

Connections are encrypted. Passwords are stored only as a hash, and bexio and Abacus credentials are encrypted.

Your rights

You can request access, correction and deletion, and you can complain to the Federal Data Protection and Information Commissioner (FDPIC). For expense data, contact your company first, otherwise the address above.