Privacy Policy

Who we are

kvar. is operated by Liam Rothwell, a self-employed sole trader (autónomo) established in Spain, trading as kvar. ("kvar.", "we", "us"), with registered office at C/ Pintor Murillo, nº 1, Local 7, 18002 Granada, Spain. We are the data controller for the personal data described here. For any privacy question, contact hello@kvar.app.

Information we collect

• Account information. Your name and email address, collected when you sign up with email or continue with Google.
• Receipts and financial data you give us. The receipt images or PDFs you upload, the line items, merchants, dates, and amounts read from them, and the budgets, categories, and expenses you create or edit.
• Billing information. Subscriptions are handled by Stripe. We store your plan, subscription status, and billing period. We never see or store your card number.
• Household data. If you create or join a household, members of that household share the budgets and entries within it.
• Technical data. Standard server logs (such as IP address and browser type) needed to run, secure, and debug the service.
• Usage and diagnostic data. Which screens you open and which actions you complete (for example, that an entry was saved and by which capture method), plus crash and error reports when something goes wrong. We use it to see what works and to fix what breaks. It never includes your receipts, merchants, categories, notes or amounts, only the outcome of an action.

How we use your data

We use your data to provide the service, reading and categorizing your receipts, running your budgets, and showing your insights, to authenticate you, to process your subscription, to keep the service secure, to provide support, and to meet our legal obligations. Our legal bases are performance of our contract with you, your consent where required, our legal obligations (for example, keeping billing records), and our legitimate interest in operating and securing the service.

Automated receipt reading and the assistant

To save you typing, the receipts you upload are processed by automated extraction to read their line items, totals, and dates. This uses AI providers operating in European Union regions, depending on the document, Google (Gemini via Vertex AI), Anthropic (Claude via Amazon Bedrock), and Mistral. They act as our processors, under contract and only on our instructions, and don't use your data to train their own models. This is a convenience feature, not a decision producing legal effects about you; the figures are always yours to review and correct.

The in-app assistant works the same way. The messages you send it, and the financial data it needs to answer them (your recent entries, budgets, and totals), are processed by Google (Gemini via Vertex AI) in European Union regions, as our processor, under contract and only on our instructions, and are not used to train its models.

Who we share it with

We do not sell your data. We share it only with the service providers (sub-processors) that make kvar. work, each under a data-processing agreement:

• Supabase: database, authentication, and file storage (European Union, Ireland, eu-west-1).
• Stripe: payment processing and card handling.
• Vercel: hosting of the web app.
• Railway: hosting of the receipt-extraction service.
• Google, Anthropic (via Amazon Web Services), and Mistral: automated receipt extraction, in EU regions.
• PostHog: product analytics and crash reporting (European Union cloud). It receives the usage and diagnostic data described above, never your receipts or amounts.
• Sentry: error monitoring (European Union data region). When something breaks it receives the technical details of the failure (the error, the page or endpoint, your account id), never your receipts, amounts or messages.
• Brevo: our product and marketing emails, such as the weekly recap (your name and email address; European Union).
• Resend: transactional emails, such as account and billing messages (your name and email address).
• Expo: delivery of push notifications to the mobile app (your device's push token and the text of each notification).

We may also disclose data where required by law, or to protect our rights and the safety of our users.

International transfers

Your core data is stored in the European Union, and receipt extraction is processed in EU regions. Where any provider processes data outside the European Economic Area, that transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

We keep your data while your account is active. When you close your account, we delete or anonymise your personal data, including your receipts and the data extracted from them, within 30 days, and it is purged from backups on the normal backup-rotation cycle. We retain billing and invoice records for as long as Spanish tax and commercial law requires (up to six years), even after your account is closed.

Your rights

Under the GDPR you have the right to access, correct, delete, export, and restrict the processing of your personal data, and to object to certain processing. To exercise any of these, email hello@kvar.app. You also have the right to lodge a complaint with the Spanish data-protection authority, the Agencia Española de Protección de Datos (AEPD, www.aepd.es), or with the supervisory authority where you live.

How we protect your data

Every user's data is isolated at the database with row-level security, so your records are only ever accessible to you (and the household you choose to share with). Data is encrypted in transit, and access is restricted to what's needed to run the service.

Children

kvar. is a financial tool intended for adults. It is not directed to children, and you must be at least 18 to use it. We do not knowingly collect data from anyone under 18.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you.

Contact

Questions about your privacy? Email hello@kvar.app.