Privacy Policy
1. Controller and contact
Walletycs is operated by Alberto Calvo Rubió, an individual based in Spain.
- Contact address: Calle Jorge Manrique 1, Zaragoza
- NIF: 18176195P
- Email for privacy and service matters: info@walletycs.com
This policy explains how Walletycs processes personal data when you use the service.
2. The service
Walletycs is a free web application in public beta that helps adults import, create, organize, categorize, and analyze transaction information.
Walletycs does not connect directly to bank accounts, request online-banking credentials, initiate payments, hold funds, or provide financial advice.
3. Personal data processed
3.1 Account and authentication data
Depending on the authentication method and features used, Walletycs processes:
- Name and email address
- Profile image where supplied by an authentication provider
- Internal user identifier
- Email-verification status
- Account and record timestamps
- Language and preferred currency
- Plan, feature-usage counters, and interface preferences
- Authentication-provider account identifiers and metadata
- Session information, including expiration, IP address, and user agent where generated
- Verification, password-reset, MFA, recovery, and rate-limit information needed to secure the account
Authentication can include email and password or a third-party sign-in provider. Email/password authentication also processes a password hash. A third-party sign-in provider may create a restricted provisional identity before registration is completed; that identity cannot use the financial application until the required Terms acceptance and age declaration are recorded.
3.2 Transaction files and imported data
Supported CSV, Excel, and TXT files are parsed in the user's browser. Walletycs application source does not intentionally upload or store the original file.
The parsed information selected for import is sent to the backend. A transaction can include:
- Date
- Amount
- Currency
- Original concept or description
- Comment added by the user
- Internal assignment to a Walletycs account and category
- Tags
- Grouping and splitting information
The original concept is stored as provided through the import flow and may include information about the transaction or third parties.
Walletycs does not store the original file, bank login credentials, Open Banking access tokens, or payment-card credentials as part of the transaction-import feature.
3.3 Information created inside Walletycs
This can include:
- Walletycs account aliases
- Categories, category keywords, assignments, icons, colors, and budget settings
- Tags
- Manually created transactions
- Transaction comments
- Groups and splits
- Preferences and product-usage settings
Walletycs processes imported and manually created transactions through different product flows. The information retained for each transaction is described above.
3.4 Optional AI categorization
AI categorization is optional and runs only when the user requests it. Walletycs can be used without this feature.
When requested, Walletycs sends the information needed to generate a category suggestion (such as transaction concept, amount, available category names, category types, category keywords, and request language) through an AI routing service to a configured AI model provider. The original file, email address, user identifier, Walletycs account alias, transaction comment, and tag are not deliberately added to the request.
AI output is used only to suggest categories. The user reviews the result. It does not make a legal or similarly significant decision about the user.
The configured AI service uses a primary model provider and an automatic fallback through an AI routing service. The selected models are configured by Walletycs for zero data retention and no training. Provider configuration, processing location, and deletion remain subject to the applicable provider terms and data-protection arrangements.
3.5 Product analytics and technical data
Walletycs records application events used to understand feature use, limits, reliability, and security. These records can contain:
- Internal user identifier
- Event name
- Timestamp
- Feature counts or internal resource references
The declared application-event payloads do not intentionally include transaction concepts, comments, amounts, email addresses, or payment references.
Walletycs also uses cookieless web analytics for product and technical measurement. The applicable device-storage information and user controls are described in the Cookies Policy. Walletycs does not use advertising pixels or behavioural-marketing profiles during the free beta.
3.6 Browser storage and cookies
Authentication, MFA, language, interface state, privacy mode, chart preferences, and navigation restoration use cookies or browser storage. Further details are provided in the Cookies Policy.
3.7 Communications and rights requests
Walletycs processes messages sent to info@walletycs.com, verification information, replies, decisions, and request-handling records.
3.8 Terms acceptance, privacy presentation, and age declaration
We record when you accept the Terms and confirm your age, the Terms version accepted and the Privacy Policy version presented, and limited technical evidence to demonstrate acceptance.
4. Purposes and legal bases
Providing the requested service
To create and secure accounts, import selected transaction data, organize and analyze financial records, apply preferences, provide product export, and process account closure.
Legal basis: performance of the service requested by the user.
Optional AI categorization
To generate category suggestions when the user requests the feature.
Legal basis: performance of the specifically requested feature.
Security, abuse prevention, and reliability
To authenticate users, protect accounts, manage sessions and MFA, investigate errors and abuse, and maintain system integrity.
Legal basis: legitimate interests in operating a secure and reliable service and, where applicable, compliance with legal obligations.
Analytics and product improvement
To understand product use, technical performance, and feature limits. Walletycs uses cookieless web analytics and does not read or write analytics cookies or other analytics device storage. The legal basis is Walletycs's legitimate interests in operating and improving a secure, reliable service. Details of the data collected, the 24-hour visitor hash, and the reporting window are in the Cookies Policy.
Support, rights, compliance, and claims
To answer requests, comply with applicable obligations, document compliance, and establish, exercise, or defend legal claims.
Legal basis: performance of service, legal obligation, and legitimate interests as applicable.
5. User responsibility for imported information
Users must only import information they are entitled to use. Transaction concepts can contain personal data relating to another person. Users are responsible for using Walletycs lawfully and for not uploading or entering unnecessary third-party information.
6. Providers and recipients
Depending on the features used, providers and recipients can include:
- Hosting and application-execution providers: hosting, application execution, operational logs, and product analytics
- Database providers: PostgreSQL database hosting and restoration functionality
- Authentication providers: third-party sign-in where selected by the user
- AI routing and model providers: routing and inference for optional AI categorization
- Transactional email providers: account and service emails
- Currency-data providers: currency-pair queries without deliberately sending end-user personal or transaction data
Access to systems and personal data is restricted to persons authorized by the controller and only where necessary for administration, maintenance, security, support, or compliance.
7. International transfers
Some providers may process personal data outside the European Economic Area (EEA). Where required, Walletycs will rely on an adequacy decision, Standard Contractual Clauses, an applicable data-privacy framework, or another recognized safeguard. Information about the safeguards applicable to a transfer and how to obtain a copy can be requested at info@walletycs.com.
8. Retention
- Account and financial-domain data are generally kept while the account is active.
- Account deletion removes most directly linked production database records through database relationships and the account-deletion process.
- Verification or rate-limit records, provider data, emails, logs, caches, AI feature-usage records, and backups may follow separate technical or legal retention periods.
- Deleted data can remain temporarily in backups or restoration systems until rotation or re-deletion procedures apply.
- Security, rights-request, incident, and legal records can be retained where necessary for security, compliance, or claims.
Deletion can require different technical periods across databases, providers, logs, email systems, caches, and backups. The zero-retention setting for the selected AI inference models described in Section 3.4 is distinct from Walletycs feature-usage counters and other operational records. Walletycs provides further information on request.
9. Access, export, and other rights
Subject to applicable law, users may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests.
The self-service product export covers selected preferences and financial-domain records. It is not intended to be the complete response for every legal access request. Users can request a broader response at info@walletycs.com.
To protect the account, Walletycs may ask the requester to verify control of the account email or complete another proportionate verification step.
Users may lodge a complaint with the Spanish Data Protection Agency or another competent data-protection authority under applicable law.
10. Security
Walletycs applies technical and organisational measures to protect personal data, including:
- Controls to limit access to authorised users and personnel
- Protection of data during transmission
- Measures to prevent misuse and protect the service
Walletycs reviews and improves these measures as the beta develops. No online service can guarantee absolute security.
11. Adults only
Walletycs is intended only for users aged 18 or over. Users must confirm that they meet this requirement when creating an account.
12. Changes
Walletycs may update this policy as the beta changes. Material changes will be communicated through the service, email, or another appropriate method. The current policy will remain available before account creation and inside the application.