Your data

Privacy Policy

Effective and last updated: 18 July 2026

The Spanish text is the official version. The English text is provided for convenience.

This policy explains how Kwito handles personal data when you visit the website, create an account, upload receipts or contact support. The data controller is the service operator identified in the Legal Notice. Questions and privacy requests can be sent to [email protected].

1. Data we process

• Account data: email address, password hash, chosen language, account status and session information.
• Receipt data: uploaded images or files, receipt text, store, date, amounts, products, categories, notes and corrections.
• Service usage: landing page and campaign parameters contained in the URL, pricing choice, signup and activation events, approximate country and basic technical logs.
• Communications: support messages and any billing or price-reservation information you provide.

Kwito does not ask for bank credentials and does not connect to your bank.

2. Why we use it

We use the data to create and secure your account, turn receipts into structured purchase records, generate reports, remember your chosen language, provide support, reserve an early-access price when requested, understand whether the product works and comply with legal obligations.

The main legal basis is providing the service you request and taking steps before a future paid contract. Security, basic product measurement and service improvement rely on our legitimate interests, balanced against user privacy. Legal obligations apply where records must be retained by law.

3. AI-assisted receipt processing

Kwito uses an AI service to read receipt content and, when needed, translate item names. Receipt images, text or relevant extracted fields may be sent to that provider solely to perform these tasks. Automated extraction can be wrong, so the original receipt is kept alongside the structured result for checking.

4. Service providers

Kwito currently relies on Fly.io for application hosting and storage, Cloudflare for website delivery and security, OpenAI for AI-assisted receipt processing and Zoho for support email. These providers process only the data needed for their role under their applicable contractual and security terms.

5. Storage and retention

Account and receipt data is kept while your account is active or until it is no longer needed for the purposes above. You can request account and receipt deletion at any time. Data may remain temporarily in restricted backups and technical logs until their normal rotation. Records required by law may be retained for the applicable statutory period.

6. International processing

Some providers may process data outside the European Economic Area. Where this occurs, Kwito relies on appropriate contractual or legal safeguards required by applicable data-protection law.

7. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing. Send the request from your account email to [email protected]. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

8. Cookies and browser storage

The application uses a strictly necessary login cookie. The public website stores your language only after you choose it. Kwito does not currently use third-party advertising or analytics cookies. Campaign parameters are read from the page URL and sent with first-party funnel events; Kwito does not save a marketing identifier in browser storage.

9. Security and your choices

We use reasonable technical and organisational measures to protect the service. No online system can guarantee absolute security. Upload only receipts you are entitled to use, and remove or cover information that is not needed for spending analysis.

10. Children and changes

Kwito is not intended for children. We may update this policy as the service, providers or legal requirements change. Material changes will be shown on the website or communicated through the account email when appropriate.