Who processes your data
Data controller: BK Modules LLC, 102 Gold Ave SW, Albuquerque, NM. For anything related to your data, write to [email protected].
What data we process and why
- Your account: name and email, and your Google identifier if you sign in with Google. There is no password: you sign in with Google or with a single-use link that expires after 15 minutes. Legal basis: performance of the service you request.
- Your groups and movements: names of the people in the group, descriptions, amounts, dates and categories. This is the content of the service and only the group's members see it.
- Receipt photos and PDFs: the photo is compressed on your device (WebP, 1200 px at most) and the original never leaves it. The compressed copy and the text read from it are stored; for a PDF receipt, the PDF as it is and an image of its first page. On the free plan they are deleted 12 months after being uploaded (the receipt's lines stay); what someone with Pro uploads does not expire. Images are not public: they are served one by one after checking that you belong to the group.
- Reading receipts with AI: if a receipt does not add up with our rules and you ask to “Read with AI”, we send OpenAI (our AI provider) only the text of the receipt (the text your phone read or the one we extracted from the PDF) to arrange it into lines. The image is never sent.
- Group assistant: what you dictate is turned into text by the speech recogniser of your phone or your browser (depending on the device, this may be a Google or Apple service); only that text reaches us, never your voice. A message our rules can tell is not about expenses is not sent to anyone. To record an expense, we first interpret it with our own rules, without AI. Only if they don’t fully understand it, and if you have AI messages left that month, do we send OpenAI that text, the earlier part of that conversation (your messages and a summary of the assistant’s answers), today’s date and the names of the people in the group with an internal number.
- Questions to the assistant: questions about the group’s expenses (“how much have we spent at the supermarket?”) are translated by OpenAI into a query, and they count towards your AI messages for the month. OpenAI receives your question, the earlier part of that conversation, today’s date, the names of the people in the group with an internal number and the list of categories, but never the group’s movements: we calculate the figures ourselves from what you can see. To write the sentence that goes with the answer, OpenAI receives what its card shows (the figures and the names, categories and descriptions that appear in it), and that sentence goes through OpenAI’s moderation before you are shown it. “How much do I owe?” is answered by our rules, without AI.
- Conversations with the assistant: we never send OpenAI emails or data from other groups. Conversations are stored in your account so you can pick them up again from the history; only you can see them, they remain if the group is archived and they are deleted when you delete your account or when the group is deleted.
- Categories with AI: if we can’t recognise a description from what was chosen before or from our word list, we send OpenAI only that description (for example, “birthday dinner”), without names, amounts or dates, to choose its category; the answer is reused for the same description in any group.
- What OpenAI does not keep: requests to read receipts, for the assistant and for categories are made with storage turned off (store = false) and, under its API terms, OpenAI does not use what it receives to train its models.
- Phone notifications: if you allow them, we store your phone’s notification identifier to send you your groups’ notifications (who recorded what, with its description and amount), which are delivered through Firebase Cloud Messaging, by Google. You choose which ones you get in “Your account”.
- Exporting to Excel or PDF: the file with the group’s data is generated when you ask for it and is for you; we do not keep it any longer than needed for you to download it.
- Server logs: IP address, date and page requested, for security and to fix faults. They are deleted after 30 days.
- Ads: on the free plan, the Android app shows a Google AdMob banner on some screens; the website has no ads and there are none with Pro. In the European Economic Area, the United Kingdom and Switzerland, before any ad is requested we ask you with Google’s consent form whether you accept personalised ads; if you don’t, the ads are not personalised. To serve them, Google receives your phone’s advertising ID, IP address and technical device data, and processes them under its own policy (policies.google.com/technologies/ads). You can change your choice at any time in “Your account” → “Ad privacy”, and reset or delete the advertising ID in Android settings. We receive none of this.
- Pro subscription: billing is done by Google Play; we never see your card or payment details. About your subscription we store what Google Play tells us: the purchase identifier, the plan, its status (active, cancelled, payment pending…), the date it renews or ends and the order number, to know whether you have Pro, plus a random identifier of your account that the app sends to Google when you buy, so the purchase can only be linked to your account. We check every purchase with Google and receive its notices of renewals, cancellations and refunds. Legal basis: performance of the subscription contract.
Who it is shared with
With the other members of your groups (what you record in them) and with the providers that make the service work: hosting, email for sign-in links, photo storage, OpenAI as the AI provider (for the text of receipts you ask to read with AI, the assistant messages and questions our rules can’t resolve, the sentence of its answers and its moderation, and descriptions without a category) and Google (sign-in, phone notifications, ads and Pro billing). We do not sell data or build advertising profiles of our own.
For how long
Your account, for as long as you have it. If you delete it from “Your account”, your user, your sessions, your conversations with the assistant, your Pro subscription data and your devices’ notification identifiers are deleted. What you recorded in the groups stays — otherwise the others' accounts would not add up — but it is no longer linked to you: you become just another person in the group, without an account.
Groups are archived (they become read-only) and an admin can reopen them; a group is also archived automatically when nobody with an account is left in it. What was recorded in a group is kept with it, archived or not. An archived group is deleted completely (movements, receipts with their photos and PDFs, conversations with the assistant and the people in the group) after two years without activity, that is, without anyone in the group opening or reopening it. We notify its members 30 days before, on their phone (if they have notifications turned on) and in the list of archived groups, so they can reopen or export it. Server logs are purged after 30 days and receipt photos and PDFs according to the period above.
Your rights
You can access, rectify, erase, object to, restrict the processing of and request the portability of your data by writing to [email protected]. You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es).