Quentas

This policy explains how your personal data is processed when you visit the Quentas website or use the Quentas personal finance application (together, the "Service"), and which rights you have. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD).

1. Who is responsible for your data

The data controller is Alejandro Acho, a private individual based in Spain, who runs Quentas. You can contact him about anything related to your data through the contact form.

2. What data we process

Account data: your name, email address, password (stored only as a secure hash, never in plain text), preferred language, profile picture if you add one, and your settings and email preferences.
Google sign-in: if you choose to sign in with Google, Google shares your name, email address and profile picture with us. We never receive your Google password.
Financial data you enter: workspaces, accounts and balances, transactions and transfers, categories, fixed expenses, debts and payments, investments and trades, and savings goals. Quentas does not connect to your bank: we only hold what you type in or import. Please avoid including unnecessary sensitive information in free-text fields such as descriptions or notes.
Imported files: Excel files you upload to import data are read to create your records and are not stored once the import finishes.
Market data requests: to show prices for your investments we send the ticker symbols (and, for historical prices, the dates) to Yahoo Finance. These requests contain no personal data about you.
AI assistant (optional): when the in-app assistant is available and you use it, your messages, the attachments you add (images or PDF files) and the financial figures the assistant needs to answer are sent to Anthropic, which generates the replies. Conversations are kept in your account until you delete them or your account.
Connections with external AI assistants (MCP): if you create an access token and connect an assistant such as Claude, that assistant can read your financial data and record transactions on your behalf. We store the token's name and its creation, expiry and last-use dates. What the assistant does with the data it reads is governed by your agreement with its provider.
Messages you send us: the name, email address and message you send through the contact form or the feedback and support forms in the app.
Technical data: IP address, browser and device information, and server logs needed to run the Service securely, prevent abuse (for example, rate limiting) and investigate errors.
Cookies and similar storage: see section 8.

3. Why we process it and on what legal basis

To provide the Service and manage your account, including storing your financial data, computing balances, projections and charts, importing and exporting your data, sending essential emails (account verification, password reset) and the weekly and monthly reports, which you can switch off in your email preferences. Legal basis: performance of the contract you accept when you sign up (Art. 6(1)(b) GDPR).
To keep the Service secure and working: preventing fraud and abuse, limiting the number of requests, keeping backups and fixing errors. Legal basis: our legitimate interest in protecting the Service and its users (Art. 6(1)(f) GDPR).
To answer your messages. Legal basis: our legitimate interest in replying to you, or steps taken at your request before entering into a contract (Art. 6(1)(b) and (f) GDPR).
To send news about Quentas, only if you have agreed to receive them. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from your email preferences or the unsubscribe link in each email.
To measure visits to the public website with Google Analytics, only if you accept the analytics cookies. Legal basis: your consent (Art. 6(1)(a) GDPR).
To comply with legal obligations, such as requests from the competent authorities (Art. 6(1)(c) GDPR).

We do not sell your data, we do not use it for advertising and we do not make decisions about you based solely on automated processing.

4. Who we share it with

We only share data with service providers that process it on our behalf and under our instructions (data processors), to the extent each one needs:

Hosting, database, file storage and backup providers on which the Service runs.
An email delivery provider that sends our emails.
Google, for Google sign-in and, only with your consent, Google Analytics on the public website.
Anthropic, for the in-app AI assistant, only if it is available and you use it.
Slack, where technical error reports (which may include details of the request that failed) are sent so that we can fix problems.
Yahoo Finance receives the ticker symbols of your investments, without any personal data.
Stripe, only if paid plans are offered in the future, to process payments. We would never store your card details.

We may also disclose data when required by law or by a valid request from a public authority.

5. International transfers

Some of these providers (such as Google, Anthropic, Slack or Stripe) may process data outside the European Economic Area, mainly in the United States. In those cases the transfer is covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, by the EU–U.S. Data Privacy Framework.

6. How long we keep it

Account and financial data: while your account exists. When you delete your account, your data is removed from the live database; copies in backups are deleted as those backups are rotated out.
AI assistant conversations: until you delete them or your account.
Contact messages: for as long as needed to handle your request and for up to one year afterwards.
Server logs: for a short period, only as long as needed for security and debugging.
Analytics data: no longer than 14 months, according to the Google Analytics retention settings.

Some data may be kept for longer when the law requires it or to defend legal claims.

7. Your rights

Under the GDPR you have the right to:

Access your personal data and obtain a copy of it.
Rectify inaccurate data. You can edit most of it directly in the app.
Erase your data. You can delete your account at any time from your account page, which removes your data as described in section 6.
Portability: you can export your transactions to an Excel file at any time from the Import / Export page, or ask us for a copy of your data.
Object to processing based on legitimate interest, and ask us to restrict it.
Withdraw your consent at any time, without affecting earlier processing. For analytics, use the "Cookie settings" link in the website footer.

To exercise these rights, contact us as described in section 1. If you believe your data has not been processed lawfully, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the supervisory authority of your country of residence.

8. Cookies and local storage

Essential: cookies and browser storage that keep you signed in, remember your language, theme and active workspace, and store your cookie choice. They are needed for the Service to work and do not require consent.
Analytics (optional): Google Analytics cookies, used only on the public website (never in the app or on the sign-in pages) and only if you click "Accept" in the cookie banner. You can change your choice at any time from the "Cookie settings" link in the footer.

9. Security

We protect your data with encrypted connections (HTTPS), hashed passwords, access controls and regular backups. No system is completely secure, so if you notice anything suspicious, please let us know.

10. Minors

The Service is not intended for children under 14, and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy when the Service or the law changes. We will publish the new version on this page with its date and, if the changes are significant, we will let you know by email or in the app.