Privacy policy

1. Data controller

• Matías Ezequiel Carrera — NIF Y8631225Y
• Calle Padre Tomás de Montañana 6, 46023 Valencia, España
• Contact and privacy: spendqore@gmail.com

2. Data we process

We only process the data needed for the service to work:

• Account: email, password (managed securely by the authentication provider and stored using hashing mechanisms, not in readable form) and, if you sign in with Google, the basic data Google shares (email, name and profile picture).
• Profile and plan: user identifier, assigned plan and access status.
• Spaces: space names, members and their role. When sharing a space you enter the email of another registered person, used only to add them.
• Financial data you enter: transactions (amount, date, description, category, account, payment method), accounts, categories, payment methods, budgets and reminders.
• Photos you voluntarily attach to a transaction.
• Internal service usage data: a small number of events (for example opening the app or creating a transaction) linked to your account, to manage and improve the service.
• Technical data: IP address and browser data logged by providers when delivering the service.
• Web analytics: only if you accept it, aggregated browsing data via Google Analytics.

3. Purposes and legal bases

• Creating and managing your account and providing the service, including shared spaces and photos: performance of a contract (Art. 6(1)(b) GDPR).
• Handling your enquiries and requests: performance of a contract or legitimate interest in replying.
• Security, abuse prevention and internal usage events to improve the service: legitimate interest (Art. 6(1)(f) GDPR).
• Web analytics with Google Analytics: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Complying with legal obligations: legal obligation (Art. 6(1)(c) GDPR).

4. Retention

We keep your data while your account exists. When you delete your account or request its deletion, your data will be deleted or blocked in accordance with the applicable legal obligations and periods. Analytics data is kept according to the Google Analytics configuration.

5. Providers and recipients

We do not sell your data. Members of a shared space see that space's data. In addition, SpendQore uses the following providers to deliver certain features. Their respective roles and processing are subject to their applicable terms and data protection agreements:

• Supabase Inc.: database, authentication and storage.
• Vercel Inc.: hosting and delivery of the application.
• Google LLC / Google Ireland Ltd.: Google sign-in (if you use it) and, only with your consent, Google Tag Manager and Google Analytics.

6. International transfers

Some of these providers are based in the United States, so international data transfers may occur. You can request information about the providers involved and the applicable transfer mechanisms by writing to spendqore@gmail.com.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent, by writing to spendqore@gmail.com. We may ask you to verify your identity.

If you believe your request was not handled properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

We apply reasonable technical and organisational measures: encrypted connections, per-user and per-space access control in the database, and private photo storage with temporary links. No system is risk-free, but we work to reduce risks.

9. Minors

SpendQore is not specifically aimed at minors.

10. Changes to this policy

We may update this policy when the service or the law changes. We will show the date of the latest update and, for relevant changes, inform you appropriately.