DipVAT privacy policy

01

Scope

This policy applies to the DipVAT iOS and iPadOS application provided by Metispace LLC. The Metispace Website Privacy Policy applies when you visit this website or contact us by email.

DipVAT is designed so sensitive claim information is processed and stored locally. The current version does not transmit profiles, receipt images, recognized receipt information, claims, reimbursement records, or generated XML to a Metispace-operated server.

02

Information processed locally

Depending on the features used, DipVAT may locally process profile and identification information; payment fields used on the government form; receipt images, selected PDF pages and recognized purchase information; claim and reimbursement records; generated XML; and app preferences.

This information supports the functions requested by the user. Metispace does not receive or remotely access this local content through DipVAT.

03

Camera, photos, and documents

DipVAT requests camera access only when a user scans a receipt. It can access only photographs selected through Apple's photo picker and documents selected through the iOS document browser.

Selected images and rendered PDF pages are used for on-device recognition and are not intentionally retained in the app's persistent data store afterward. Original photos and files remain under the control of their source application or provider.

04

On-device text recognition

DipVAT uses Apple Vision and related Apple frameworks to recognize receipt text on the device. Receipt images and recognized text are not sent to a Metispace server, and Metispace does not use receipt information to train AI or machine-learning models.

05

Local storage and security

Profiles, recognized receipt information, claim history, reimbursement information, preferences, and retained XML are encrypted in the app's private container using AES-GCM through Apple CryptoKit, a device-specific key stored in the iOS Keychain, and Apple file-protection controls.

The key is not configured to synchronize through iCloud Keychain. No device or security measure can guarantee protection from every form of unauthorized access.

06

XML generation and sharing

Generated XML may be retained in encrypted local data. When a user saves or shares XML, iOS may create a temporary export and present Apple's sharing interface. Once a file leaves DipVAT, it is controlled by the selected destination. Deleting information from DipVAT does not delete exported copies.

07

Collection, analytics, and tracking

The current version requires no account, contains no advertising or third-party analytics SDK, uses no cross-app or cross-website tracking, sends no receipt or claim information to Metispace, and contains no Metispace-operated crash reporting or telemetry.

Metispace reports “Data Not Collected” for the current version in Apple's App Privacy disclosure and reviews that disclosure before each release.

08

Apple App Store purchases

Apple processes purchases and refunds under its own terms and privacy policy. Metispace does not receive payment-card details through DipVAT. Any App Store sales or diagnostic information Apple provides is separate from the app's locally stored profiles, receipts, claims, and XML.

09

External services

At the user's request, DipVAT may open external government websites or sharing destinations. Those services are independently operated. DipVAT does not initiate a transfer unless the user selects the external action or destination.

10

Retention and deletion

Local information remains until the user edits or deletes it, uses the in-app deletion command, or removes the app. To delete local data and the Keychain encryption key, open: DipVAT → More → Data & XML → Delete all DipVAT data.

Removing the app deletes its application container, though a Keychain item may remain unless deleted in the app. Exported files and original images stored elsewhere must be deleted separately. Metispace cannot view, recover, correct, or remotely delete records that exist only on the user's device.

11

Website visits and support

Visiting metispace.io may provide limited technical information to the website host. Emailing Metispace provides your address, message, and chosen attachments. Do not send receipt images, identification numbers, dates of birth, bank details, or completed XML by ordinary email unless necessary and you understand the risk.

12

Legal bases and rights

Where applicable law covers information Metispace actually receives, processing may rely on consent, legitimate interests, requested pre-contract steps, legal obligations, or legal claims. Applicable access, correction, deletion, restriction, objection, portability, withdrawal, and complaint rights concern information held by Metispace—not records that exist only inside DipVAT.

13

International processing

Metispace LLC is established in Virginia, United States. Website, email, professional-service, or support information may be processed in the United States or another country. DipVAT's local claim information is not transferred internationally by Metispace because the current app does not transmit it to Metispace.

14

Children

DipVAT is designed for adults managing diplomatic VAT reimbursement records and is not directed to children under 13. Metispace does not knowingly collect personal information from children through DipVAT.

15

Changes

We may update this policy when DipVAT's functions, providers, obligations, or data practices change. The revised policy will be posted here with an updated date, with additional notice where legally required.

16

Contact

Metispace LLC
8401 Mayland Dr Ste A
Richmond, VA 23294
United States

Phone: +1 571 720 0270
Email: legal@metispace.io
Virginia SCC Entity ID: 12056141