1. Data controller
- Controller: GIRA, SL
- NRT (tax number): L-719243-J
- Registered address: Crta. de Nagol, C/ Camp del Tomasset, núm. 8, AD600 Sant Julià de Lòria, Principat d’Andorra
- Privacy contact: privadesa@calers.ad
This policy explains how we process personal data when you visit calers.ad and when you use the app app.calers.ad (the “service”).
2. Applicable law
We process data in accordance with Andorran Qualified Law 29/2021 of 28 October on the protection of personal data (LQPD) and, where applicable because we offer the service to people in the European Union, with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).
3. Data we process
Depending on how you interact with Calers, we process:
- Account data: first name, last name, email address, password (stored only as a hash), language and preferences.
- Sign-in with Google or Apple: if you choose this option, we receive the account identifier, name and email provided by that provider. We never receive your password.
- Financial data you enter: accounts, balances, transactions, categories, tags, budgets, goals, debts, scheduled transactions and bank files you import. Calers does not connect to your bank: it only processes what you enter.
- Subscription data: plan, status, dates and Paddle customer and subscription identifiers. Card and payment details are processed directly by Paddle and we never receive them.
- Acceptance of the legal texts: the version of the terms and the privacy policy you accept, your confirmation that you are 18 or over, the date and your IP address.
- Two-step verification, if you turn it on: the secret key (stored encrypted), the recovery codes (stored only as a hash) and the browsers you choose to remember (browser and system type, IP address and dates of use).
- Technical and security data: IP address, browser type, access times, login attempts and a log of sensitive actions.
- Browsing data on the website calers.ad, only if you accept analytics cookies: pages visited, referring page, device and browser type, language, approximate location (country and city) and the Google Analytics cookie identifiers. We never link this data to your account or your financial data, and the app does not use Google Analytics.
- Requests and communications: the data you provide when you write to us or submit a request to exercise your rights.
4. Purposes and legal bases
- Providing the service (creating and managing your account, storing and displaying your data, importing and exporting it): performance of the contract.
- Managing the free trial, subscription, payments and refunds through Paddle: performance of the contract and compliance with legal obligations.
- Keeping a record that you have accepted the terms and the privacy policy and that you are an adult: performance of the contract and our legitimate interest in being able to prove it.
- Keeping the service secure, preventing fraud and unauthorised access, monitoring our staff’s access to data and making backups: legitimate interest.
- Sending you service communications (email verification, password recovery, subscription notices or significant changes): performance of the contract.
- Handling requests to exercise your rights: compliance with a legal obligation. Handling other enquiries: legitimate interest.
- Managing security incidents and, where necessary, notifying the supervisory authority and the people affected: compliance with a legal obligation.
- Complying with legal, tax and accounting obligations: legal obligation.
- Producing aggregated visit statistics for the website calers.ad with Google Analytics to improve its content: your consent, which you can withdraw at any time from “Cookie settings” in the footer.
We do not use your data for advertising, we do not build marketing profiles and we do not make automated decisions with legal effects on you.
5. Recipients and processors
We do not sell or share your data. We only disclose it to the providers we need to deliver the service:
- Clouding.io (Spain): hosting of the servers that run the website and the app and where the data and backups are stored. Acts as a processor.
- SiteGround (servers in the European Union): the email service we use to send you service emails and receive the ones you send us. Acts as a processor.
- Paddle.com Market Limited (United Kingdom) and its group companies, which act as our official reseller (Merchant of Record) and process payment and billing data as independent controllers under their own privacy policy.
- Google and Apple, only if you choose to sign in with their account. They act as independent controllers under their own policies.
- Google Ireland Limited (Ireland), only if you accept analytics cookies on the website calers.ad: the Google Analytics statistics service. It acts as a processor, with advertising features and Google Signals turned off, and receives no data from your account or the app.
Processors may only use the data to provide their services to us, following our instructions and with appropriate confidentiality and security safeguards.
We may also disclose data to authorities where required by law, for example to the Andorran Data Protection Agency if we have to notify it of a security incident.
6. International transfers
Your account and financial data are stored on servers located in the European Union (Spain), and email is also handled within the European Union. Andorra and the European Union recognise each other as providing an equivalent level of data protection, so these transfers do not require additional safeguards.
- Paddle processes payment and billing data in the United Kingdom, a country recognised as providing an adequate level of protection, and may use its own providers in other countries with the safeguards described in its privacy policy.
- If you sign in with Google or Apple, you identify yourself directly with these companies, which may process data in the United States under their own policies. We do not send them your account or financial data: we only receive from them the identifier, name and email needed to sign you in.
- If you accept analytics cookies, Google may process website browsing data in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, and the processing is also covered by the standard contractual clauses included in Google’s data processing terms.
7. Data retention
- Account and financial data: for as long as you have an active subscription or trial. If it ends and you don’t renew it, we keep the account for 12 more months so you can reactivate it or export your data; we will email you 30 and 7 days before and then permanently delete it together with the backups. If you delete your account from your profile, your database, associated files and backups are erased immediately.
- Acceptance of the terms and the privacy policy: for as long as the account exists.
- Subscription and payment data: up to 6 years, the period required by tax and accounting law.
- Account activity log (sign-ins, significant changes and IP address): 12 months.
- Login attempts and password recovery requests: 30 days.
- Browsers remembered for two-step verification: 30 days, or until you forget them or turn off verification.
- Log of our staff’s access to data: 24 months.
- Automatic security alerts: 12 months.
- Server and application logs: between 14 days and 6 months.
- Google Analytics browsing data: 14 months. Analytics cookies expire after 2 years or when you withdraw your consent.
- Backups: 14 days.
- Requests to exercise your rights: 3 years after they are resolved, so we can prove that we handled them.
- Security incidents and any communications we sent to the people affected: for as long as needed to prove that we met our legal obligations.
- Other communications: for as long as needed to handle them and any resulting liabilities.
If you delete your account, all this data is erased immediately, except what we need to prove that we met our obligations (requests to exercise your rights, security incidents and the log of our staff’s access) and server logs, which are kept until the end of the periods above. Invoices are kept by Paddle under its own policy.
8. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given.
The quickest way is in the app, under My profile → Privacy and data, where you can:
- Download all your data in a ZIP file (JSON and CSV formats).
- Correct your profile data.
- Delete your account and all your data.
- Send us a request to exercise any other right and check its status and our reply.
You can also write to privadesa@calers.ad from the address linked to your account. Where necessary, we may ask for additional information to verify your identity. We will reply within one month, which may be extended by two further months if the request is complex or we receive many; in that case, we will let you know within the first month.
If you believe we have not handled your data properly, you can lodge a complaint with the Andorran Data Protection Agency (APDA, www.apda.ad) or, if you live in the European Union, with the supervisory authority in your country.
9. Security
We apply technical and organisational measures appropriate to the risk: HTTPS-encrypted connections, a separate database with its own user for each customer, hashed passwords, optional two-step verification, login attempt limits, expiring sessions, logging of sensitive actions, a signed log of our staff’s access to data, automatic alerts for suspicious activity and automatic backups. No system is infallible, but we continuously review and improve these measures.
If a security incident affects your data and poses a risk to your rights, we will notify the Andorran Data Protection Agency within 72 hours of becoming aware of it and, if the risk is high, we will inform you by email without delay.
10. Minors
The service is intended for people aged 18 and over, and you must confirm that you are 18 or over to create an account. We do not knowingly collect data from minors and, if we find that we have, we will delete it.
11. Changes to this policy
We may update this policy to reflect legal or service changes. We will publish the current version on this page with its update date and, if the changes are significant, we will notify you by email or in the app.