CASA is checked
Kvito passed CASA AL1, the external assessment Google requires for sensitive Gmail access.
Kvito
Security
Your trust is our responsibility.
You give Kvito receipts and sometimes Gmail access. Here we explain what that means for you, without jargon and without new claims.
CASA AL1 approved
- iPhone and Android
- Free plan
- 14 day trial
- CASA AL1
- GDPR
What does this mean for you?
Three things that matter day to day, not only in the policy text.
You control access
Gmail is optional. You can disconnect in the app or revoke access in your Google account.
You can delete and export
Request a data export and delete your profile under Account, or write to kontakt@kvito.dk.
What is CASA AL1?
Google requires apps with sensitive Gmail access to be assessed by an external party. Kvito passed AL1 (Assurance Level 1). In short: an independent checklist for whether the app’s security meets what Google expects.
- It is a requirement Google sets when an app needs access to sensitive Google APIs, including Gmail
- The assessment is external: not only something Kvito says about itself
- AL1 is the level Kvito passed. It is an extra layer of assurance on top of our own technical and organisational measures
Gmail: what we may and may not do
When you connect Gmail, access is used to find purchase proof. The app also works without Gmail.
What Kvito may do
- Search for order confirmations and receipts
- Fetch invoices and purchase related documents
- Read relevant fields such as store, amount, date and items
What Kvito may not do
- Use your Gmail data for ads
- Sell your inbox onwards
- Require Gmail to use the rest of the app
We follow the Google API Services User Data Policy, including Limited Use. Gmail is optional. You can disconnect in the app or revoke access in your Google account.
What we document
Only what already appears on the site and in the privacy policy. No claim of full encryption at rest for all data.
- CASA AL1 approvedIndependent assessment linked to Google’s requirements for sensitive API access.
- Encrypted data in transitData between you and the service is sent encrypted, as we already describe on the site.
- GDPRWe are the data controller and process personal data under GDPR to deliver the app’s features.
- You can delete your dataDelete your profile and request a data export under Account, or contact kontakt@kvito.dk.
- Limited Use for GmailGmail data is used only for the features you ask for, under Google’s Limited Use rules.
- Encrypted Gmail refresh tokenWith Premium autoscan we may store an encrypted Gmail refresh token, as described in the privacy policy.
GDPR in short
Kvito is the data controller for personal data in the app and on kvito.dk. We process data to deliver the features you use and follow GDPR. Legal bases, rights and processors are in the privacy policy.
What we read on a receipt
When Kvito reads a receipt or purchase related document, these fields are typically extracted. The goal is to show you something useful, not to collect more than needed.
| Field | Purpose |
|---|---|
| Store | We use store to show you the purchase and link it to store policy when possible |
| Amount | We use amount to show you purchase price, overview and price match |
| Date | We use date to show you deadlines for returns, complaints and similar |
| Items | We use items to show you specific lines you can search and find again |
| Payment method | We use payment method to show it as part of the receipt when it appears |
| Reference numbers | We use reference numbers to show you documentation when you contact the store or support |
Frequently asked questions
Short answers. More detail is in the privacy policy.
How do you protect my data?
We process data to deliver the app’s features and follow GDPR. Kvito is CASA AL1 approved, an independent security assessment Google uses for app verification. Gmail is only used for the features you ask for. Read more in the privacy policy.
Is Kvito security approved?
Yes. Kvito is CASA AL1 approved. It is an independent assessment linked to Google’s requirements when apps need access to sensitive APIs such as Gmail.
Can I delete or export my data?
Yes. You can request a data export and delete your profile under Account in the app, or write to kontakt@kvito.dk.
Does the app work without Gmail?
Yes. Gmail is optional and used to find purchase proof. You can disconnect access anytime, and the rest of the app works without it.
Do you sell my purchases or Gmail data?
No. We use your data to deliver the app’s features. For Gmail we follow Limited Use. We do not use Gmail data for ads and we do not sell your inbox onwards.
Ready to try Kvito?
Get the app when you feel comfortable. Questions about data or Gmail? Write to us.