Privacy notice

1. Who is responsible for your data

The party responsible for processing your personal data is[TO COMPLETE: full name], an individual, with an address for notices at[TO COMPLETE: address] (“Genobills”, “we”). For anything related to your personal data, write to us at [TO COMPLETE: contact email].

This notice applies to the Genobills website, web app and mobile apps (together, the “Service”), and is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties and other applicable Mexican regulations.

2. What personal data we process

Data you give us to create and use your account

• Identification and contact: your name (to greet you in the app) and your email address.
• Authentication: your password. We don't know it: our authentication provider stores it transformed by a hash function, not as readable text. If you sign in with Google or Apple, we receive from that provider an identifier for your account, your email (Apple may give us a relay address that hides yours) and, if the provider shares it, your name. We never receive your Google or Apple password.
• Financial information you enter: your accounts (name, type, currency and starting balance), transactions (amount, date, description, category, tags and the account used), categories, tags, budgets, savings goals and favorite transactions. This is information you type in; we don't get it from your bank or any other source.
• Usage preferences: default and enabled currencies, language, light or dark theme, notification and reminder preferences, the layout of your home widgets, travel mode and whether you've seen the welcome tour.
• Linked people: if you link with another Genobills user (for example, your partner), we store that link and the transfers you log between you.
• Acceptance of these documents: the version of the Terms and conditions and of this notice that you accepted, and the date you did.

Optional data

Your date of birth and gender are optional: we don't ask for them to create your account and the Service works the same without them. If you choose to share them from your profile, we only use them for the secondary purpose described in section 3. You can delete them at any time from “Edit profile”.

Technical data

When you use the Service, our infrastructure providers log technical data needed for its operation and security, such as your IP address, browser or device type, and the date and time of requests. We don't use these logs to build profiles about you.

What we don't collect

• Sensitive personal data (such as health, ethnic origin, beliefs or sexual orientation).
• Bank credentials or passwords, card numbers, CLABE or payment details.
• Your location, your contacts, your photos or access to your microphone.
• Biometric data: if you turn on fingerprint or Face ID unlock, the check is done by your device and we never receive your fingerprint or face.
• Advertising identifiers or browsing data for analytics or advertising: the Service includes no analytics, tracking or advertising tools.

Please don't write data you don't need to keep in your transaction descriptions, such as card numbers or passwords.

3. What we use your data for

Purposes necessary for the Service

• Creating and managing your account and identifying you when you sign in.
• Storing your financial information and showing it to you with the Service's calculations (balances, totals, budgets, insights and goals).
• Syncing your information across your devices.
• Logging transfers with the people you've linked with.
• Showing you notices and reminders in the app and on your device, according to your preferences.
• Importing and exporting your information when you ask.
• Sending you the emails your account needs (email confirmation and password recovery).
• Handling your requests, questions and the exercise of your rights.
• Protecting the security and integrity of the Service and meeting legal obligations.

Secondary purpose

• Producing general, anonymous statistics about the people who use Genobills (for example, age ranges), only with the optional data (date of birth and gender) you choose to share.

If you don't want your data used for this purpose, don't provide it or delete it from your profile; you can also ask at the email in section 1. Saying no doesn't affect your use of the Service.

We don't use your data to sell or rent it, show you ads, build commercial profiles or make automated decisions that affect you.

4. Who we share your data with

Providers that help us operate (processors)

For the Service to work, your data is stored and processed with providers that act on our behalf and may only use it to provide their services to us:

• Supabase: database, authentication and sending your account emails.
• Vercel: hosting for the website and the web app.

These providers' servers may be located outside Mexico, including in the United States of America.

Other people and third parties

• Linked people: when you link with someone, that person sees your name (or, if you don't have one, the part of your email before the @) and the transfers logged between you. They don't see your other accounts or transactions. You do this by your own choice and can unlink whenever you want.
• Google and Apple: if you choose to sign in with them, signing in is also governed by their own privacy notices.
• Authorities: only when a law or a competent authority formally requires it.

Outside these cases, we don't transfer your personal data to third parties.

5. How we protect your data

• Communication between your device and our servers is encrypted (HTTPS/TLS).
• Each account can only read and change its own information: this rule is enforced in the database itself, not just in the app.
• Your password is stored hashed, never as readable text.
• According to our database provider's documentation, stored information is encrypted.
• You can turn on fingerprint or Face ID unlock on your phone to open the app.

No system is infallible. If a security breach significantly affects your rights, we'll tell you without delay so you can take action.

6. How long we keep your data

We keep your data while you have an account. If you delete your account from the app (Profile → Delete account), we delete your profile and all associated information from our database: accounts, transactions, categories, tags, budgets, goals and favorites. Transfers you logged with a linked person may still appear in that person's records, because they are part of their own information. Our providers' backups are deleted according to their rotation cycles. We may keep only what a law requires us to keep.

7. Your rights (ARCO) and how to exercise them

You have the right to access your data, rectify it,cancel it and object to its processing, as well as to revoke your consent and limit its use. You can exercise many of these rights yourself from the app:

• Access: view your information and download it in Settings → Import and export.
• Rectification: correct your information and profile at any time.
• Cancellation: delete your account in Profile → Delete account.
• Objection to the secondary purpose: delete your date of birth and gender in Edit profile.

You can also send a request to [TO COMPLETE: contact email] with: your name and your account's email, the right you want to exercise and a clear description of what you're asking for. If you act on behalf of someone else, include the document proving your representation. We'll answer within 20 business days at most and, if it applies, carry out your request within the following 15 business days.

If you believe your right to the protection of your personal data has been violated, you can go to the competent authority on the matter.

8. Minors

The Service is not intended for children under 13 and they must not use it. People aged 13 to 17 may only use it with the consent of their parent or guardian, who is responsible for supervising their use. If we learn that a child under 13 created an account, we'll delete it. If you are a parent or guardian and want to exercise the rights of a minor in your care, write to us at the email in section 1.

9. Cookies and local storage

The Service doesn't use analytics, advertising or third-party cookies. To keep you signed in and remember some preferences we use your browser's or device's local storage. The details are in our Cookie policy.

10. Changes to this notice

If we change this notice, we'll publish the new version on this page with its date. If the change is significant (for example, a new purpose or a new type of data), we'll tell you in the app and ask you to accept it before you keep using the Service.