Privacy Policy

1 Data controller

The data controller responsible for the personal data collected through the PresupuestAPP application is:

• Name: Alan Rodríguez Rueda
• NIF: 53553733G
• Address: C/ Carlos III, Nº 6, 33201 Gijón (Asturias), Spain
• Website: https://presupuesta.eu
• Email: soporte@presupuesta.eu

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), PresupuestAPP is committed to processing your data lawfully, fairly and transparently.

2 Data we collect

2.1 Account data

When you register with PresupuestAPP, we collect:

• Full name (or business/trading name)
• Email address
• Password (stored as an irreversible hash; never in plain text)
• Business profile data: trading name, VAT/tax number, address, phone number, logo (optional)

2.1.bis Data hosting and location

Your data is hosted on servers of SpectraIP B.V. (Bruynvisweg 11, 1531AX Wormer, spectraip.net) in Amsterdam, Netherlands, within the European Economic Area (EEA). We do not transfer your data outside the EEA except to specific third-party processors listed below, each under appropriate safeguards (Standard Contractual Clauses).

2.2 Data obtained via Google OAuth

If you register or sign in using Google, we receive only the following minimum data from Google:

• Display name
• Google account email address
• Google account unique identifier (sub)
• Profile picture (optional; not stored permanently)

We do not request access to your contacts, calendar, Gmail or any other Google service.

2.3 Usage and analytics data

We collect anonymous usage events (e.g. "quote created", "PDF downloaded", "signature received") to improve the application. These events may be associated with your user account for technical support purposes, but are not shared with third parties.

2.4 Technical data

• IP address of the device you access from
• Browser or device type and version
• Server access logs

2.5 Your clients' data (entered by you)

When you create quotes, you enter data about your own clients (name, email, phone, address). You are the data controller for this data in relation to your clients under the GDPR. PresupuestAPP acts as a data processor for this data, storing and processing it solely to provide you with the service.

3 Purpose & legal basis for processing

3.1 Account management and service delivery

Purpose: To create and manage your account, authenticate you, enable you to create and send quotes, and manage subscriptions (Free and Pro plans) and payments.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) — processing is necessary to provide the service you have signed up for.

3.2 Service improvement and internal analytics

Purpose: To analyse how the application is used in order to improve features, detect errors and personalise the experience.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) — our interest in improving the service, provided this does not override your fundamental rights.

3.3 Service communications

Purpose: To send you notifications related to your account (registration confirmation, password reset, payment reminders triggered by you, changes to the service or this policy).

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and legal obligation.

3.4 Security and fraud prevention

Purpose: To detect and prevent unauthorised access, abuse of the service and fraud.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

3.5 Marketing communications

We will only send you marketing communications (news, plan offers) if you have given your explicit consent (Art. 6(1)(a) GDPR), or if you are an existing customer and the communications relate to similar products or services (legitimate interests). You may unsubscribe at any time via the opt-out link included in every email.

4 Retention periods

• Account data: For as long as you have an active account. If you request deletion, data is erased within a maximum of 30 days, unless we are legally required to retain it.
• Quote and client data: Until you delete your account or manually delete it from within the application.
• Access logs (IP and technical records): Maximum 90 days, unless required by a court order or competent authority.
• Payment data: Managed directly by Stripe (see section 5). PresupuestAPP does not store card data. Billing records (amount, date, plan) are retained for 5 years to comply with tax obligations.
• Analytics events: Maximum 24 months in aggregated form.

After the stated retention periods, data will be securely deleted or anonymised.

5 Recipients & international transfers

5.1 We do not sell your data

PresupuestAPP does not sell, rent or disclose your personal data to third parties under any circumstances.

5.2 Data processors (sub-processors)

We use the following service providers who act as data processors:

• Stripe Inc. (payment processing) — headquartered in the USA, covered by the EU–US Data Privacy Framework and EU Standard Contractual Clauses. Stripe Privacy Policy.
• Google LLC (OAuth authentication, Firebase if used) — headquartered in the USA, subject to Standard Contractual Clauses. Google Privacy Policy.
• SpectraIP B.V. (hosting provider) — based in Amsterdam, Netherlands (EU), within the European Economic Area (EEA). spectraip.net.

5.3 International transfers

Where your data is transferred outside the European Economic Area (EEA) — in particular to the USA via Google or Stripe — this is done under the appropriate safeguards provided for by the GDPR: adequacy decisions, Standard Contractual Clauses (Art. 46 GDPR) or the EU–US Data Privacy Framework.

5.4 Legal obligations

We may disclose data when required by law, court order or competent authority, to the extent strictly necessary.

6 Your rights

As a data subject, you have the following rights under the GDPR (and, for UK residents, under the UK GDPR), which you may exercise at any time:

• Right of access (Art. 15 GDPR): Obtain confirmation of whether we process your data and receive a copy of it.
• Right to rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17 GDPR): Request deletion of your data when it is no longer necessary for the purpose for which it was collected, among other grounds.
• Right to restriction of processing (Art. 18 GDPR): Request that we temporarily suspend the processing of your data.
• Right to data portability (Art. 20 GDPR): Receive your data in a structured, commonly used and machine-readable format (JSON/CSV) and transmit it to another controller.
• Right to object (Art. 21 GDPR): Object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

How to exercise your rights

Send your request to soporte@presupuesta.eu, stating the right you wish to exercise and providing a copy of a valid identity document. We will respond within a maximum of 30 days of receipt.

Right to lodge a complaint — EU residents

If you consider that the processing of your data does not comply with the GDPR, you have the right to lodge a complaint with the competent national data protection authority in your country of residence within the EU.

Right to lodge a complaint — UK residents

If you are based in the United Kingdom, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7 Cookies & local storage

7.1 Simplified cookie policy

PresupuestAPP is a web application (PWA) that uses only functional and technical cookies, strictly necessary for the service to operate. We do not use tracking, advertising or third-party analytics cookies.

7.2 Cookies and storage we use

• localStorage / sessionStorage: We store your user session, language and currency preferences, and temporary application data on your device. This data never leaves your device for third parties.
• Session cookie (session_token): A technical cookie necessary to maintain your authenticated session. It is deleted when you close your browser, or after 30 days if you select "Remember me".
• Service Worker (PWA): We cache app resources for offline use. These do not contain personal data.

7.3 No cookie banners

As we do not use non-essential or tracking cookies, no consent banner is required. If we were to introduce third-party analytics cookies in the future, we would update this policy and request your consent.

8 Google OAuth & third-party services

8.1 Sign in with Google

PresupuestAPP offers the option to register and sign in using Google OAuth 2.0. When you use this feature:

• You will be redirected to Google's servers to authenticate.
• Google will show you what data it will share with PresupuestAPP (name, email, profile picture).
• PresupuestAPP does not access your Google password or any other data or service on your Google account beyond what is described in section 2.2.
• You can revoke PresupuestAPP's access to your Google account at any time from myaccount.google.com/permissions.

Use of Google OAuth is subject to Google's Privacy Policy and Terms of Service.

8.2 Stripe (payments)

Subscription payments are processed by Stripe. PresupuestAPP never receives or stores credit or debit card data. All payment data is handled directly by Stripe under their own PCI-DSS security standard. See Stripe's Privacy Policy.

9 Minors

PresupuestAPP is a service intended exclusively for professionals aged 18 and over. We do not knowingly collect data from minors. If we detect that a minor has registered without parental consent, we will delete their account and data immediately.

If you are a parent or guardian and believe that a minor in your care has provided data through this app, please contact us at soporte@presupuesta.eu.

10 Changes to this policy

We may update this Privacy Policy periodically to reflect changes in the service, applicable law or our practices. When we make material changes:

• We will update the "last updated" date at the top of this document.
• We will notify you by email at least 15 days before the changes take effect, if they significantly affect your rights.
• For minor changes or improvements in clarity, we will publish the new version without prior notice.

Continued use of PresupuestAPP after the changes take effect constitutes your acceptance of the updated policy.

11 Contact & complaints

For any questions about this Privacy Policy or to exercise your rights, please contact us at:

• Privacy email: soporte@presupuesta.eu
• General email: soporte@presupuesta.eu
• Website: https://presupuesta.eu

We are committed to responding within a maximum of 30 days of receiving your request.

If you are not satisfied with our response, EU residents have the right to lodge a complaint with their national data protection authority. UK residents may contact the Information Commissioner's Office at ico.org.uk.