Privacy Policy

1. Who is responsible for your data?

The data controller is Alan Corral Samaniego (“Finantia”, “we”), with address at Av. Morelos 703 Pte., Col. Centro, Torreón, Coahuila, Mexico.

For anything related to your personal data, write to hola@finantia.app.

2. What personal data do we collect?

We only collect the data Finantia needs to work:

• Identification and contact data: name and email address.
• Account data: password (stored hashed; nobody can read it), language, time zone and app preferences.
• Financial data you enter: accounts, balances, transactions, amounts, merchants, categories, tags, recurring payments, budgets, goals, debts, shopping lists, notes and, if you upload them, photos of receipts.
• Forwarded bank alerts (only if you use Auto-logging): emails from banks, cards and payment apps that you forward to your unique Finantia address, processed instantly to extract amount, merchant, date and account, and not stored.
• Payment data: processed by Stripe. We only receive a customer ID, your subscription status, and your card brand and last 4 digits. We never see or store the full number.
• If you share savings goals, accounts or lists: the email address of the people you invite (only to send them the invitation, which includes your name and the name of what you share) and, inside what you share, your name, photo and contributions, which other members will see.
• Reports and surveys: what you write when reporting a problem, the screenshot you choose to attach, device technical information if you include it, and the reason you pick when cancelling your plan.
• Technical data: device and browser type, IP address, access dates, push notification identifiers, error logs and app usage statistics (screens opened and time spent), without amounts or the content of your transactions.

Your financial data is processed with your express consent, given when you create your account, enter the data and, if applicable, forward your bank alerts to Finantia. To use AI features we also ask for a specific permission inside the app. We do not request sensitive personal data.

3. What do we use your data for?

Primary purposes, required to provide the service:

• Create and manage your account and verify your identity when you log in.
• Store, display, calculate and organize your financial information (reports, budgets, goals, calendar).
• Send you the reminders and notifications you turn on.
• Answer your questions with the AI assistant.
• Process the bank alerts you forward to Finantia and turn them into transactions, if you use Auto-logging.
• Let you share goals, accounts and lists with the people you invite and send them the invitation by email.
• Charge your subscription and manage the free trial, renewals and cancellations.
• Provide support, answer your reports, keep the service secure and prevent fraud.
• Send you important notices about your account, your subscription or the service (for example, maintenance or changes to this policy).
• Comply with legal and tax obligations.

Secondary (optional) purposes: sending you news, tips, promotions and surveys in the app, by push notification or by email, and producing aggregated statistics to improve Finantia. You can turn them off in Settings → Notifications → “Finantia news and promotions” or by writing to hola@finantia.app. Opting out does not affect your service. We will never send you promotional messages by WhatsApp or SMS without your prior consent.

4. How does Auto-logging work and what do we do with your emails?

Auto-logging is optional. We give you a unique email address (for example, name.xxxxxx@in.finantia.app) that you forward your bank alerts to from any email provider, or register as the alert email in your bank’s app. Finantia never accesses your email account or asks for your password.

• We only process transaction alerts from banks, cards and payment apps; other emails are discarded.
• Each email is processed transiently: it is read to extract the transaction and deleted instantly. We don’t store the content of your emails.
• We keep only minimal metadata (sender, processing status and a generated summary of the transaction) for up to 30 days for support and to avoid duplicates; for discarded emails, up to 2 days.
• Before an alert is sent to the AI we redact personal data such as your name and card or account numbers.
• We don’t use this data for advertising, we don’t sell it and we don’t use it to train general-purpose AI models.
• You can stop forwarding alerts or deactivate your address anytime from the app.

In the future we may offer an optional direct connection with an email provider. If we do, it will use read-only permission and comply with that provider’s data policies, and we will update this policy before enabling it.

5. What happens to your data when you use AI features?

AI features (assistant, bank alert reading, receipt scanning and insights) use third-party language model providers: Google (Gemini) as the main one and, as a fallback when it doesn’t respond, DeepSeek and, last, Groq. Receipt photos are only read by Google (Gemini).

We only use AI with your data after you give your explicit permission inside the app. You can withdraw it anytime in Settings → “Use artificial intelligence”. Without that permission we don’t send your information to these providers; Auto-logging keeps working with a basic reader without AI, which may detect fewer details.

Before a bank alert is sent to the AI, we automatically redact personal data such as your name, card and account numbers, CLABE, email and phone. We only send the minimum information needed to answer you.

These providers act as processors: they handle the information only to return the answer to us. Google (Gemini, on its paid tier) and Groq, according to their terms, do not use the content to train their models. DeepSeek processes data on servers located in China and its terms allow it to use the data to improve its services; that’s why we only use it as a fallback when Google (Gemini) doesn’t respond.

AI answers can contain mistakes; review them before making decisions.

6. Who do we share your data with?

We don’t sell or rent your data and we don’t share it with third parties for advertising. To run Finantia we use these providers (processors), who handle your data only on our behalf and under confidentiality and security obligations:

• Supabase: database, authentication, file storage and server functions (servers in the United States, Virginia region).
• Stripe: payment and subscription processing.
• Google: Gemini AI models.
• Cloudflare: receiving and routing the alerts you forward to your Finantia address.
• DeepSeek: fallback AI models (servers in China).
• Groq: last-resort fallback AI models.
• Cloudflare: also serves the website and the app (hosting and content delivery network) and manages the domain.
• Resend: sending your account emails (confirming your email, password-free sign-in, email changes) and the invitations you send to share.
• Your browser or operating system’s push notification services (Apple, Google or Mozilla), only to deliver the notifications you turn on.

Some of these providers may process data outside Mexico (for example, in the United States and, for DeepSeek, in China). These transfers are made to fulfill the purposes of this policy and with equivalent safeguards.

We may also share data when required by a competent authority under the law.

7. Do we use cookies or local storage?

We don’t use advertising cookies or third-party trackers. We use your browser’s local storage (localStorage, IndexedDB and the service worker cache) to:

• Keep you securely logged in.
• Remember your preferences: light or dark theme, language and PIN or fingerprint lock settings.
• Remember the plan you chose when signing up.
• Remember views and notices you have already seen (for example, whether we already offered to install the app).
• Load the app fast and keep it working on a poor connection.

To improve Finantia we measure how the app is used (screens opened, time spent and device type) with our own tools, without third-party cookies or trackers and without recording amounts or the content of your transactions.

Stripe may use its own cookies on payment pages to prevent fraud. You can clear local storage from your browser settings; if you do, you will need to log in again.

8. How do we protect your data?

• All communication is encrypted with HTTPS (TLS).
• The database and backups are stored encrypted.
• Every record is tied to your user, and row-level security rules prevent anyone else from seeing or changing it.
• Only authorized Finantia staff can view an account’s information, solely for support, billing or security, and every view or change is recorded in an audit log.
• To prevent abuse we limit how many requests can be made per minute or hour (for example, AI questions or forwarded emails). For that we keep only a count linked to your user, with no content, deleted after 2 days.
• You can lock the app on your device with a PIN or biometrics.

No system is 100% foolproof. If a security breach significantly affected your rights, we would inform you without delay so you can take action.

9. How long do we keep your data?

We keep your data while your account is active. You can delete your account yourself from Settings: once you confirm, we cancel your subscription, delete your customer data at our payment processor (Stripe) and immediately delete your account, transactions and files. Invoices already issued are kept for as long as tax law requires. If you ask us by email, we do it within 30 days.

Usage statistics are deleted after 180 days. Payment records and the audit log may be kept after you delete your account, unlinked from your profile, as is information we must keep for legal or tax obligations (such as billing records), which is kept only as long as the law requires. Backups are deleted in their normal rotation cycle.

10. How do you exercise your ARCO rights?

You have the right to Access, Rectify and Cancel your data and to Oppose its use (ARCO rights), as well as to revoke your consent and limit the use or disclosure of your data.

You can exercise many of these rights yourself in the app (edit your profile, export or delete transactions, deactivate your Auto-logging address, withdraw AI permission, turn off news and promotions, or delete your account). For anything else, email hola@finantia.app with your name, your account email, a clear description of your request and a document proving your identity (or your legal representative’s).

We will respond within the deadlines set by the LFPDPPP and, if your request is valid, carry it out within the legal deadlines.

11. Is Finantia for minors?

No. Finantia is intended for people 18 and older. If we detect an account belonging to a minor without parental or guardian authorization, we will delete it.

12. Changes to this policy

We may update this policy. We will publish the current version on this page with its update date and, if the change is significant, notify you by email or in the app.

13. Competent authority

If you believe your right to personal data protection has been violated, you may contact the competent data protection authority in Mexico.

14. Contact

Alan Corral Samaniego · Av. Morelos 703 Pte., Col. Centro, Torreón, Coahuila · hola@finantia.app