Privacy Policy
This is a courtesy English translation of the legally binding Spanish original. In case of any discrepancy, the Spanish version prevails: Política de Privacidad
Last updated: 2 April 2026 (v1.2)
At Cuéntamo we take the protection of your personal data very seriously. This policy explains what data we collect, why we need it and what rights you have over it.
1. Data controller
| Owner | David Marín Carreño (self-employed) |
| NIF | 02246556P |
| Address | Calle Colmenar, 8. Chalet 6, 28863 Cobeña (Madrid) |
| Privacy email | [email protected] |
We are not required to appoint a Data Protection Officer (DPD/DPO) under Article 37 of the GDPR. For any matter relating to your data, you can write to the email address indicated above.
2. Data we collect
Account data
- Email address
- Name
Financial data entered by you
- Bank accounts (name, type, initial balance)
- Transactions (description, amount, date, category)
- Custom categories
- Recurring transactions
Subscription data
- Billing information handled by Stripe (we do not store card numbers on our servers)
Technical data
- IP address
- Technical cookies (see section 10)
- Technical performance metrics of the application (API response times, error rates, latency), collected in aggregate form and not linked to individual users.
3. Purposes of processing
- Service provision: managing your accounts, transactions, forecasts and the other features of Cuéntamo.
- Subscription management: processing payments, issuing invoices and keeping track of the status of your plan.
- Transactional communications: sending you registration confirmations, plan changes, security alerts and relevant notices about your account. These communications cannot be disabled because they are necessary for the operation of the service.
- Product communications: sending you messages about new features, usage tips, activity reminders and announcements from the Cuéntamo team. To determine which messages are relevant, we use data such as your registration date, the date of your last activity, whether you have set up recurring transactions or validated transactions, and whether you have the self-employed module enabled. You can disable these communications at any time from the Settings section of your profile.
- Service improvement: using anonymous description-to-category associations to feed the automatic categorization engine that benefits all users (see section 11). This purpose is an inherent condition of using the service.
4. Legal basis
| Purpose | Legal basis |
|---|---|
| Service provision and subscription management | Performance of a contract (art. 6.1.b GDPR) |
| Transactional communications | Performance of a contract (art. 6.1.b GDPR) |
| Product communications (engagement, new features, reminders) | Legitimate interest (art. 6.1.f GDPR) — improving the user experience and reducing churn. You can object at any time by disabling the option in your profile. |
| Team announcements (direct messages from the administrator) | Legitimate interest (art. 6.1.f GDPR). You can object at any time by disabling the option in your profile. |
| Tax and legal obligations | Compliance with a legal obligation (art. 6.1.c GDPR) |
| Technical performance metrics | Legitimate interest (art. 6.1.f GDPR) — ensuring the stability and quality of the service. |
| Aggregate product usage analysis | Legitimate interest (art. 6.1.f GDPR) — continuous improvement of the service. |
5. Data recipients
We only share your data with the providers strictly necessary to deliver the service:
| Provider | Role | Location |
|---|---|---|
| Stripe Inc. | Payment processing | USA (see section 6) |
| Postmark (Wildbit LLC) | Delivery of transactional email and product communications | USA (see section 6) |
| Hetzner Online GmbH | Server hosting | European Union |
We do not sell, transfer or share your data with third parties for advertising purposes.
6. International transfers
Stripe and Postmark are headquartered in the United States. Both providers operate under the Standard Contractual Clauses (SCCs) approved by the European Commission, which guarantee an adequate level of data protection in accordance with the GDPR.
Your financial data (accounts, transactions, categories) is stored exclusively on Hetzner servers within the European Union.
7. Retention periods
| Type of data | Retention period |
|---|---|
| Account data and financial data | While your account is active + 5 years after deletion (tax obligation) |
| Billing data | 5 years from issuance (Spanish tax legislation) |
| IP address and technical logs | 12 months |
Once these periods have elapsed, the data is permanently deleted.
8. Your rights
Under the GDPR and Ley Orgánica 3/2018 (LOPDGDD, the Spanish data-protection act), you have the right to:
- Access: know what data we hold about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request the deletion of your data (right to be forgotten).
- Restriction: restrict processing in certain circumstances.
- Portability: receive your data in a structured, commonly used format.
- Objection: object to the processing of your data in certain cases.
To exercise any of these rights, write to us at [email protected]. We will respond within a maximum of 30 days.
9. Complaints to the supervisory authority
If you believe that the processing of your data is not correct, you have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish data-protection authority):
- Website: www.aepd.es
- Address: C/ Jorge Juan, 6 — 28001 Madrid
10. Cookies
Cuéntamo uses only technical and functional cookies, which are necessary for the application to work correctly:
- Session token (JWT refresh token): an httpOnly cookie to keep you securely logged in.
- Interface preferences: language, active household and other display preferences.
We do not use tracking, analytics or advertising cookies. Therefore, a cookie banner is not required under the applicable regulations.
11. Categorization engine and aggregated data
Cuéntamo uses the bank description → category associations assigned by users to feed an automatic categorization engine that benefits all users of the service. This process is an essential part of how Cuéntamo works.
The data used is exclusively:
- The text of the bank description (for example, "RECIBO IBERDROLA ENERGIA").
- The category assigned by the user (for example, "Electricity").
No amounts, dates, balances or any other data that could identify a specific user are used. The associations are stored in a completely anonymous and aggregated form.
The use of this aggregated, anonymous data to improve the categorization service is an inherent condition of using Cuéntamo, based on the controller's legitimate interest (art. 6.1.f GDPR) and on the performance of the service contract (art. 6.1.b GDPR). If you do not want your description-to-category assignments to contribute to this shared categorization engine, please do not use the service.
Cuéntamo may analyse, in aggregate and anonymous form, the data entered by users (categories used, most frequent bank descriptions, features enabled) in order to improve the product and prioritize development. Under no circumstances do these analyses allow a specific user to be identified.
12. Product communications
Cuéntamo may send you non-transactional communications related to the service:
- Automated engagement emails: messages based on your activity on the platform (for example, reminders if you have not logged in for a while, congratulations when you set up your first recurring transaction, or tax deadline notices if you use the self-employed module). These emails are generated automatically according to rules configured by the Cuéntamo team.
- Team announcements: direct messages written by the Cuéntamo team about new features, service improvements, scheduled maintenance or other relevant communications.
Data used to determine which engagement emails to send you:
- Date of registration with the service.
- Date of last activity (creation or editing of transactions or recurring transactions).
- Whether you have created at least one recurring transaction or validated at least one transaction.
- Whether you have the self-employed module enabled (for tax notices).
We do not use the content of your transactions, amounts, balances or bank descriptions to decide which communications to send you.
You can disable all these communications at any time from Settings → Profile in the application, by turning off the "Receive communications from the Cuéntamo team" option. This option is enabled by default when you create your account.
Transactional communications (registration confirmations, password recovery, security alerts, subscription notices) are not affected by this preference and will continue to be sent whenever they are necessary for the operation of the service.
These emails are sent through a separate delivery channel (Postmark Broadcast Stream), distinct from the transactional channel, in line with email delivery best practices.
13. Security
We apply technical and organizational measures to protect your data:
- Encryption in transit: all communications take place over HTTPS/TLS.
- Passwords: stored with bcrypt hashing (never in plain text).
- Two-factor authentication (2FA): available to all users.
- Financial data: stored securely on our servers with restricted access.
14. Minors
Cuéntamo is intended for people aged 16 or over. We do not knowingly collect data from minors under that age. If we detect that a minor has registered, we will delete their account and associated data.