1. DATA CONTROLLER
Controller: Antón Shapoval
Trade name: Presupuesto PRO
Contact email: soporte@presupuesto-pro.com
The controller is the sole natural person responsible for processing personal data within this application. No third party holds ownership, control, or administrative access over the application or its data, except for expressly contracted technical providers (see section 5).
2. SCOPE OF APPLICATION
This Privacy Policy applies to the Presupuesto PRO mobile application (hereinafter «the Application»), available on Google Play Store and Apple App Store, as well as any associated web service or API. By installing or using the Application, the user fully accepts this policy.
3. PERSONAL DATA WE COLLECT
a) Data directly entered by the user:
- Full name of the professional or company
- Email address (only if an account is created)
- Tax ID (NIF / CIF / NIE) — stored locally in encrypted form and, if you sign in, synced to your cloud profile
- Bank account number / IBAN — stored locally in encrypted form and, if you sign in, synced to your cloud profile
- Client data: name, address, phone, email, tax ID
- Quote and invoice information
- Voice recordings, only if you use voice dictation to create a quote (see section 5)
- Material entries you choose to publish to the shared catalogue (name, unit, category, price and supplier). These are public by definition: they stay visible to every user of the Application. If you do not want a supplier price to be public, keep it on your device only. Deleting your account removes them from the catalogue.
b) Data collected automatically:
- None. The Application bundles no analytics or advertising SDK, generates no device identifier and sends no usage statistics. The figures on the Analytics screen are computed on your own device from your own quotes and never leave it.
- Anonymous crash reporting is implemented but switched off in published builds. If it is ever switched on, this policy will say so first.
c) Data we do NOT collect:
- GPS location
- Phone contacts
- Calls or messages
- Biometric data
4. PURPOSE AND LEGAL BASIS FOR PROCESSING
Purpose | Legal basis
- Providing the quote and invoice generation service → Contract performance (Art. 6.1.b GDPR)
- Cloud synchronization (any plan, if you sign in) → Contract performance
- Subscription and payment management → Contract performance and legal obligation
- Technical support communications → Legitimate interest / Consent
- Compliance with legal obligations → Legal obligation (Art. 6.1.c GDPR)
5. RECIPIENTS AND INTERNATIONAL TRANSFERS
Data may be processed by the following technical providers, contractually bound to GDPR compliance:
- Supabase Inc. (USA) — Cloud storage under Standard Contractual Clauses approved by the European Commission. Servers located in the European Union.
- Groq, Inc. (USA) — Transcribes voice recordings and extracts quote line items from them when you use dictation. Audio is sent through our own server, processed for that sole purpose, and is not retained either in the Application or on our servers. Transfer covered by Standard Contractual Clauses.
- RevenueCat, Inc. (USA) — Manages your subscription state (active plan, renewal dates and a user identifier). It receives no client, quote or invoice data.
- Google LLC — Distribution via Google Play Store.
- Apple Inc. — Distribution via App Store.
- Expo (Expo Technology Inc.) — Development framework; does not access user data in production.
Personal data is never sold, rented, or transferred to third parties for commercial or advertising purposes.
6. DATA SECURITY
- Sensitive fields (tax ID, IBAN) are stored locally using AES-256 encryption via expo-secure-store. If you sign in, these fields are also saved to your cloud profile, protected there by encryption at rest and Supabase Row Level Security policies, accessible only by your own account.
- Server communications are exclusively via HTTPS/TLS 1.2+.
- Cloud data (for any account, not only PRO/Business) is protected by Supabase security measures (encryption at rest and in transit, Row Level Security).
- Account access is password-protected. Passwords are never stored in plain text.
In the event of a security breach affecting personal data, the Spanish Data Protection Agency (AEPD) will be notified within 72 hours of detection.
7. RETENTION PERIODS
- Account data: while the user keeps the account active. Deleted within 30 days after account deletion request.
- Billing data: retained for 4 years, the limitation period set by article 66 of the Spanish General Tax Act.
- Crash reports: not collected while reporting is switched off. If it were switched on, they would be kept for at most 90 days.
- Locally stored data: the user can delete it at any time by uninstalling the app.
8. USER RIGHTS
Under the GDPR, the user has the following rights:
- Access: know what personal data is being processed.
- Rectification: correct inaccurate or incomplete data.
- Erasure («right to be forgotten»): request deletion of personal data.
- Objection: object to processing based on legitimate interest.
- Restriction: request restriction of processing.
- Portability: receive data in a structured, machine-readable format.
To exercise any of these rights, send an email to soporte@presupuesto-pro.com with subject «GDPR Rights Exercise» attaching a copy of your ID. The controller will respond within 30 days.
9. MINORS
The Application is not intended for users under 16 years of age. We do not knowingly collect data from minors. If the controller detects that data from a minor has been collected without guardian consent, it will be immediately deleted.
10. COOKIES AND TRACKING TECHNOLOGIES
The mobile Application uses no cookies, generates no device identifier, does not use the Android advertising ID and performs no tracking across apps or websites. There is nothing to turn off in your operating system's privacy settings, because nothing is collected.
11. CHANGES TO THIS POLICY
The controller reserves the right to modify this Privacy Policy at any time. Substantial changes will be notified to the user via an in-app notice or email. The updated version will always be available within the Application.
12. USER INDEMNIFICATION
The user agrees to indemnify, defend and hold harmless Antón Shapoval, his heirs, successors and assigns, from any claim, demand, damage, loss, cost or expense arising from:
- The user's use of the Application in violation of these terms
- Personal data of third parties introduced without their consent
- Illegal or fraudulent activities carried out through the Application
- Non-compliance with any legal obligation applicable to the user's business
13. WAIVER OF CLASS ACTIONS
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE USER EXPRESSLY WAIVES THE RIGHT TO PARTICIPATE IN CLASS ACTION LAWSUITS OR COLLECTIVE ARBITRATION PROCEEDINGS AGAINST THE CONTROLLER. ANY CLAIM MUST BE BROUGHT ON AN INDIVIDUAL BASIS.
14. SEVERABILITY AND NON-WAIVER
If any provision of this Privacy Policy is declared null, invalid, or unenforceable by a competent court, the remaining provisions will remain in full force and effect.
The Controller's failure to exercise or enforce any right or provision of this Policy shall not constitute a waiver of such right or provision.
15. CONTACT AND COMPLAINTS
For any queries regarding this Privacy Policy:
Antón Shapoval — Sole owner of Presupuesto PRO
Email: soporte@presupuesto-pro.com
You have the right to file a complaint with the competent supervisory authority:
Spanish Data Protection Agency (AEPD)
C/ Jorge Juan, 6, 28001 Madrid
www.aepd.es