帳單捕手 BillCatchBillCatch 帳單捕手 隱私權政策
最後更新日期：2026-10-27
本政策由 瑋瑄科技有限公司（以下稱「我們」）訂定，適用於 BillCatch iOS 應用程式、https://bill.apgo.tw 網站及相關服務。
1. 我們是誰
瑋瑄科技有限公司，統一編號 94071421，地址 新北市新莊區龍安路66之28號10樓。隱私相關聯絡信箱：wadeyeh@apgo.com.tw。
2. 我們蒐集的資料
2.1 帳號資料：您註冊時提供的電子郵件、顯示名稱，以及登入憑證的雜湊值。
2.2 Gmail 資料（經您授權後）
我們透過 Google Gmail API 的唯讀權限（gmail.readonly）存取您的 Gmail，且僅限於：
- 寄件者屬於我們維護之台灣發卡機構白名單、且含附件的電子郵件；
- 該等郵件的郵件識別碼、寄件者、收件日期、主旨，以及信用卡電子對帳單 PDF 附件。
我們不會讀取、儲存或顯示白名單以外的任何郵件，不會存取您的聯絡人、草稿、標籤或設定，也不會修改、封存、刪除、撰寫或寄送任何郵件。我們不儲存郵件內文。
2.3 解析後的資料：由對帳單 PDF 解析出的交易日期、商店名稱、金額、卡號末四碼、帳單期間、繳款截止日，以及我們為每筆交易指定的消費分類與統計。
2.4 對帳單開啟密碼：部分發卡機構的對帳單 PDF 設有開啟密碼。您輸入密碼時可選擇只用於本次解析（不保存），或選擇「記住密碼」；記住的密碼以 AES-256-GCM 於應用層加密後保存，僅用於自動開啟同一張卡日後的對帳單，您可隨時於 App 內刪除。
2.5 裝置與使用資料：裝置型號、作業系統版本、App 版本、當機紀錄、匿名化且彙總的功能使用統計（不含郵件或對帳單內容）。
3. 蒐集目的與利用方式
我們僅為下列目的使用上述資料：
- 在 App 內顯示您的對帳單、消費分類與即將到期的繳款金額；
- 維持 Gmail 連線以持續匯入新的對帳單；
- 提供客服、處理您的請求；
- 維護服務安全、偵測濫用、履行法律義務。
我們不會將您的資料用於廣告、不會販售您的資料、不會提供給資料仲介或廣告平台、不會用於信用評估或放貸，也不會用於訓練任何人工智慧模型。
4. 利用之期間、地區、對象及方式
- 期間：見第 6 節。
- 地區：資料儲存於新加坡（見第 6 節）；第 7 節所列服務供應商可能於其營運地區處理資料。
- 對象：僅限我們及第 7 節所列之受委託處理者；法律要求時提供予主管機關。
- 方式：以自動化方式於加密之雲端環境處理。
5. Google 使用者資料之使用與 Limited Use 聲明
BillCatch 對於自 Google API 取得之資訊的使用，將遵守 Google API Services User Data Policy，包括其 Limited Use 規定；對於自 Google Workspace scopes 取得之資訊的使用，將遵守 Google User Data Policy，包括其 Limited Use 規定。（原文："BillCatch's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements." / "The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements."）
具體而言：
- 我們僅將 Gmail 資料用於提供或改進 App 內使用者可見的功能；
- 除為提供上述功能、經您明確同意之第三方處理（第 7 節）、安全目的、法律要求外，不會將 Gmail 資料轉移給他人；
- 除下列情形外，我們的人員不會閱讀您的 Gmail 資料：(a) 您就特定對帳單或郵件明確同意並經我們記錄（例如您在 App 內授權客服查看）；(b) 為調查錯誤、濫用或安全事件所必要；(c) 法律要求；(d) 資料已彙總且匿名化，僅用於內部營運統計；
- 我們不會使用 Gmail 資料或其衍生資料來建立、訓練或改進任何機器學習或人工智慧模型（無論是我們或第三方的），僅限於為您個人提供功能所需的即時處理；我們委託的 AI 服務供應商亦依其條款不得將該等資料用於模型訓練（見第 7 節）。
6. 儲存地點、安全措施與保存期間
- 地點：資料庫與物件儲存位於 Supabase 新加坡區域（ap-southeast-1）；API 伺服器位於 Railway 新加坡區域。
- 加密：傳輸全程使用 TLS；資料庫、物件儲存與備份靜態加密（AES-256）；Gmail refresh token 另以 AES-256-GCM 於應用層加密後才寫入資料庫；原始 PDF 儲存於不可公開存取之私有儲存空間。
- 存取控制：資料庫啟用列層級安全（Row Level Security），每位使用者僅能存取自己的資料；系統日誌不記錄 token、寄件者地址、郵件主旨、郵件內容、附件內容或交易明細，僅記錄郵件識別碼、處理狀態與錯誤代碼。
- 保存期間：
| 資料 | 保存期間 |
|---|---|
| Gmail refresh token | 至您中斷 Gmail 連結或刪除帳號時立即刪除 |
| 記住的對帳單開啟密碼 | 至您於 App 內刪除該密碼或刪除帳號時立即刪除 |
| 對帳單 PDF、郵件識別資訊 | Gmail 連線有效期間；中斷連結後 30 天內刪除 |
| 解析後的交易資料 | 至您刪除帳號；或中斷連結後 30 天內刪除 |
| 帳號資料 | 至您刪除帳號 |
| 備份 | 自刪除日起最多 30 天後自備份輪替中移除 |
7. 受委託處理之第三方
| 服務供應商 | 用途 | 處理地區 | 備註 |
|---|---|---|---|
| Supabase | 資料庫、物件儲存、身分驗證 | 新加坡 | 靜態 AES-256 加密 |
| Railway | API 伺服器主機 | 新加坡 | |
| Google Gemini API（Google LLC） | 解析對帳單文字／影像、商店名稱分類 | 待確認 | 該供應商對所送資料之保留期間、是否用於其模型訓練、人工審閱政策：待確認，確認後更新於此 |
| Apple | App 發佈、當機回報 | 依 Apple 政策 |
對帳單內容只會在您於 App 內明確同意後才送交 Google Gemini API 處理；該同意畫面於 App 內顯示，並在首次送交前取得。您可隨時於設定中撤回同意，撤回後我們停止送交新資料。
8. 您的權利
依個人資料保護法第 3 條，您得就您的個人資料行使下列權利，且不得預先拋棄或以特約限制：查詢或請求閱覽、請求製給複製本、請求補充或更正、請求停止蒐集／處理／利用、請求刪除。在 App 內您可以：
- 中斷 Gmail 連結（設定 → 中斷 Gmail）：我們會向 Google 撤銷授權、立即刪除 refresh token，並依第 6 節刪除 Gmail 衍生資料。您亦可於 Google 帳號的第三方存取權頁面自行移除。
- 匯出資料（設定 → 匯出）：取得解析後交易資料的 CSV 檔。
- 刪除帳號（設定 → 刪除帳號）：刪除您的全部資料，包含對帳單、交易、PDF 與 token。
完整操作說明請見 https://bill.apgo.tw/support 。其他請求請寄 wadeyeh@apgo.com.tw。依個人資料保護法第 13 條，查詢、閱覽或製給複製本之請求，我們於 15 日內為准駁決定；補充、更正、停止蒐集處理利用或刪除之請求，於 30 日內為准駁決定；必要時得延長一次（分別不逾 15 日、30 日），並以書面通知您延長原因。若您不提供 Gmail 授權，仍可手動上傳 PDF 使用部分功能。
9. 兒童
本服務不針對未滿 18 歲者提供；若發現誤蒐集，將立即刪除。
10. 政策變更
重大變更時我們會於 App 內通知並更新本頁日期。
11. 聯絡我們
瑋瑄科技有限公司，wadeyeh@apgo.com.tw，新北市新莊區龍安路66之28號10樓。
BillCatch Privacy Policy
Last updated: 2026-10-27
This policy is issued by 瑋瑄科技有限公司 (Wei Xuan Technology Co., Ltd.) ("we", "us") and applies to the BillCatch iOS app, the website at https://bill.apgo.tw, and related services.
1. Who we are
瑋瑄科技有限公司, Taiwan business registration no. 94071421, 10F., No. 66-28, Long'an Rd., Xinzhuang Dist., New Taipei City, Taiwan (新北市新莊區龍安路66之28號10樓). Privacy contact: wadeyeh@apgo.com.tw.
2. Data we collect
2.1 Account data: the email address and display name you provide at sign-up, and a hash of your login credential.
2.2 Gmail data (only after you authorize it)
We access your Gmail through the read-only Gmail API scope (gmail.readonly), limited to:
- emails whose sender is on our allowlist of Taiwanese card issuers and which carry an attachment;
- for those emails: the message ID, sender, received date, subject, and the credit-card e-statement PDF attachment.
We do not read, store, or display any email outside that allowlist; we do not access your contacts, drafts, labels, or settings; and we never modify, archive, delete, compose, or send email. We do not store the body text of your emails.
2.3 Parsed data: transaction date, merchant string, amount, last four digits of the card, statement period and due date parsed from the PDF, plus the spending category and totals we derive.
2.4 Statement PDF passwords: some card issuers protect statement PDFs with an opening password. When you enter it you can choose to use it for this parse only (not stored) or to have us remember it; a remembered password is encrypted at the application layer with AES-256-GCM, is used only to open future statements for the same card, and can be deleted by you in the app at any time.
2.5 Device and usage data: device model, OS and app version, crash reports, and anonymized, aggregated feature-usage statistics (which never include email or statement content).
3. Purposes and how we use data
We use the data above only to:
- show your statements, spending categories and upcoming payment amounts inside the app;
- keep your Gmail connection alive so new statements are imported;
- provide support and handle your requests;
- keep the service secure, detect abuse, and comply with law.
We do not use your data for advertising, do not sell it, do not transfer it to data brokers or ad platforms, do not use it to assess creditworthiness or for lending, and do not use it to train any artificial-intelligence model.
4. Period, region, recipients and method of use
- Period: see Section 6.
- Region: stored in Singapore (Section 6); the processors in Section 7 may process data in their operating regions.
- Recipients: only us and the processors listed in Section 7; authorities where legally required.
- Method: automated processing in an encrypted cloud environment.
5. Use of Google user data and Limited Use disclosure
BillCatch's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
In particular:
- we use Gmail data only to provide or improve user-facing features that are prominent in the app;
- we do not transfer Gmail data to others except to provide those features, to processors you have explicitly consented to (Section 7), for security purposes, or as required by law;
- no human at 瑋瑄科技有限公司 reads your Gmail data except: (a) with your explicit consent for specific statements or messages, which we document (for example when you authorize support in the app to view a statement); (b) where necessary to investigate a bug, abuse or a security incident; (c) where required by law; or (d) where the data has been aggregated and anonymized and is used only for internal operational statistics;
- we do not use Gmail data or data derived from it to create, train or improve any machine-learning or artificial-intelligence model, whether ours or a third party's; such data is used only for the real-time processing needed to provide features to you personally, and our AI service provider is likewise bound by its terms not to use that data for model training (see Section 7).
6. Storage location, security and retention
- Location: database and object storage in Supabase's Singapore region (ap-southeast-1); API servers in Railway's Singapore region.
- Encryption: TLS in transit; AES-256 encryption at rest for the database, object storage and backups; Gmail refresh tokens are additionally encrypted at the application layer with AES-256-GCM before being written to the database; original PDFs are kept in a private, non-public storage bucket.
- Access control: PostgreSQL row-level security so each user can only reach their own rows; system logs never record tokens, sender addresses, email subjects, email content, attachment content or transaction details, and record only message identifiers, processing status and error codes.
- Retention:
| Data | Retention |
|---|---|
| Gmail refresh token | Deleted immediately when you disconnect Gmail or delete your account |
| Remembered statement PDF passwords | Deleted immediately when you delete the password in the app or delete your account |
| Statement PDFs and message identifiers | While the Gmail connection is active; deleted within 30 days after disconnection |
| Parsed transactions | Until you delete your account, or within 30 days after disconnection |
| Account data | Until you delete your account |
| Backups | Removed from backup rotation within 30 days after deletion |
7. Processors
| Provider | Purpose | Region | Notes |
|---|---|---|---|
| Supabase | Database, object storage, authentication | Singapore | AES-256 at rest |
| Railway | API hosting | Singapore | |
| Google Gemini API (Google LLC) | Parsing statement text/images; categorizing merchant strings | To be confirmed | The provider's retention period, use of submitted data for its own model training, and human-review policy are to be confirmed and will be published here once confirmed |
| Apple | App distribution, crash reporting | Per Apple's policies |
Statement content is sent to Google Gemini API only after you give explicit consent in the app; the consent screen is shown inside the app and your consent is obtained before the first transfer. You can withdraw consent in Settings at any time, after which no new data is sent.
8. Your rights
Under Taiwan's Personal Data Protection Act (Article 3) you may, and cannot waive the right to: inquire about or access your data; obtain a copy; supplement or correct it; demand that collection, processing or use cease; and demand deletion. In the app you can:
- Disconnect Gmail (Settings → Disconnect Gmail): we revoke the grant with Google, delete the refresh token immediately, and delete Gmail-derived data per Section 6. You can also remove access from your Google Account's third-party access page.
- Export (Settings → Export): download your parsed transactions as CSV.
- Delete account (Settings → Delete account): erase all of your data, including statements, transactions, PDFs and tokens.
Step-by-step instructions for managing and deleting your data are available at https://bill.apgo.tw/support. For other requests write to wadeyeh@apgo.com.tw. As required by Article 13 of the Personal Data Protection Act, we decide on requests to access or copy your data within 15 days, and on requests to supplement, correct, stop processing or delete your data within 30 days; where necessary we may extend each period once (by up to 15 and 30 days respectively) and will tell you the reason in writing. If you choose not to connect Gmail you can still use part of the app by uploading PDFs manually.
9. Children
The service is not directed to persons under 18; if we learn we have collected such data we delete it.
10. Changes
We notify you in the app of material changes and update the date above.
11. Contact
瑋瑄科技有限公司, wadeyeh@apgo.com.tw, 10F., No. 66-28, Long'an Rd., Xinzhuang Dist., New Taipei City, Taiwan (新北市新莊區龍安路66之28號10樓).