Pastizal privacy policy

Last updated: 12 October 2026

Data controller

Juan Zurita Ruiz-Ruano, an individual trading as ZuritaTech (tax ID 26828689V), at Calle Alta Cartuja, 20, Granada (España). Contact: admin@zuritatech.com. Pastizal never sells your data.

This policy covers the Pastizal app and this website as far as Pastizal is concerned. The GDPR and Spain's LOPDGDD apply and, depending on where you live, the UK GDPR, Brazil's LGPD and US state privacy laws; we extend the rights described below to everyone.

What data we process and why

• Your transactions, accounts, budgets, goals and notes: stored on your device only, in a local database. We never receive them. There are no user accounts.
• Backups and CSV files: you create them and save them wherever you choose (Drive, email…); that service's own policy applies.
• Exchange rates: the app downloads the European Central Bank's public reference file; none of your data is sent.
• Receipt scanner (Premium): text is recognised on your device (Google ML Kit, local model). The image isn't uploaded.
• Ads (free version): Google AdMob may process device identifiers to show and measure ads, according to the consent you give in Google's form (UMP / IAB TCF). Premium shows no ads.
• Statistics and crashes (optional): only if you accept, the app sends anonymous usage statistics and crash reports to Google Firebase (Analytics and Crashlytics), with a Firebase installation identifier; never your amounts, notes, accounts or the advertising ID.
• Purchases: handled by Google Play. We only learn from Google whether your purchase is active.
• “Invite and earn” (optional, only if you open that screen or installed the app from a friend's link): a random installation identifier and the fingerprint of a secret key, an irreversible fingerprint (HMAC) of the device's Android identifier, your invitation code, who invited whom, the number of distinct days you open the app and the end date of the gifted Premium. We use your IP address transiently to limit abuse. Purpose: giving 1 month of Premium to the inviter and the invitee, and preventing fraud. In this process the app asks Google Play Integrity for an integrity verdict that we verify on the server.
• Website waitlist (your email, the app, the language and the dates you signed up, confirmed and were notified): only if you sign up on this website. Purpose: sending you a single email when Pastizal is out on Google Play, after you confirm your address from the email we send you.

Legal basis

Performance of the service you request (GDPR art. 6(1)(b)), for the account, syncing and purchases. Your consent (art. 6(1)(a)) for statistics, error reports and ads, which you can withdraw at any time in the app's privacy settings; withdrawing it doesn't affect earlier processing. For “Invite and earn”, performance of the promotion you request by using it (art. 6(1)(b)) and our legitimate interest in preventing fraud (art. 6(1)(f)). For the waitlist, your consent (art. 6(1)(a)), which you can withdraw at any time with the unsubscribe link in any of our emails or by writing to us.

Ads and consent

Pastizal shows Google AdMob ads on the free plan, with a PG content rating. In the countries where it applies, Google's consent form (UMP / IAB TCF) is shown before requesting ads and they are only requested according to your choice. In Settings, “Privacy and consent” lets you withdraw or change your consent where applicable.

Recipients and processors

We only share data with providers that supply us with a service, under contract, and don't use it for any other purpose:

• Google Play (Play Billing): purchases and subscriptions. Google processes payment details.
• Google AdMob and Google's consent form (UMP / IAB TCF): ads on the free plan, only according to your choice.
• Google Firebase (Analytics and Crashlytics): statistics and errors, only with your consent.
• IONOS SE: hosting of our server, on a VPS in Frankfurt (Germany), within the European Union.
• Cloudflare, Inc.: delivery network and attack protection. Connections to our website and API pass through its servers, which see your IP address and technical connection data; it doesn't keep your account content.
• European Central Bank: public source of exchange rates (it receives none of your data).
• Google Play Integrity: only in “Invite and earn”.
• Amazon Web Services EMEA SARL (Amazon SES, Stockholm region, within the European Union): sending the waitlist emails.
• Backblaze, Inc. (B2 storage, USA): encrypted backups of the server (Kalo accounts and the waitlist), under its data processing agreement (DPA) with standard contractual clauses.

International transfers

Some providers (Google, and Cloudflare where involved) may process data outside the European Economic Area, for example in the US. In that case GDPR safeguards apply: the EU-US Data Privacy Framework or standard contractual clauses. Outside the EU, protection may differ from that of your country.

How long we keep data

• Data on your phone: until you delete it or uninstall the app.
• “Invite and earn”: while you take part. Installations inactive for 13 months are deleted automatically, and invitations that are never completed after 30 days.
• Waitlist: if you don't confirm your email, it is deleted after 7 days; if you do, up to 30 days after we tell you about the launch, or as soon as you unsubscribe.

Your rights and how to use them

You can access, rectify and erase your data, object to or restrict its processing, ask for portability and withdraw your consent at any time. Uninstalling the app deletes all data on your phone. “Invite and earn” data is deleted from the app (“Invite and earn” › “Delete my invitation data”), which immediately erases everything about this installation on the server, including the gifted Premium.

For any other request email admin@zuritatech.com; we reply within one month at most. We won't discriminate against you for exercising your rights. If you're not satisfied, you can complain to the Spanish Data Protection Agency, AEPD (aepd.es) or to the authority in your country.

Grievance contact / Contacto para reclamaciones

If you live in India (Digital Personal Data Protection Act, 2023, DPDP) or want to file a complaint about how we handle your data, email admin@zuritatech.com. We will handle it and reply within 30 days at most.

Brazil (LGPD)

If you live in Brazil, the channel to exercise your rights as a data subject (LGPD) is admin@zuritatech.com. We have not appointed a data protection officer (encarregado/DPO); admin@zuritatech.com is the contact channel both for data subjects and for the National Data Protection Authority (ANPD), to which you can also complain (gov.br/anpd).

Minimum age and children

Pastizal's minimum age is 14, as declared in these terms and in the Google Play listing. If the law of your country requires a higher age (for example, 15 in France or 16 in Germany), that is the minimum age that applies to you. The app has no general age screen.

Only in Brazil, India, Indonesia, South Africa and Nigeria, where the law requires age assurance or an age of majority of 18, the app asks you to confirm “I am 18 or older”. No age or date of birth is stored, only a yes; if you don't confirm it, you can't use the app. To know whether it must ask for that confirmation, the app uses your SIM, network, language and Google Play country on your own phone, without sending or storing them for that purpose.

Pastizal isn't directed at anyone below the minimum age. If you think a minor has given us data, write to us and we'll delete it.

Automated decisions

We make no decisions based solely on automated processing that produce legal effects on you or similarly affect you. In “Invite and earn”, anti-fraud checks are automatic and their only effect is that you can't take part in the promotion; you can ask us to review it.

Security

Your financial data stays on your device and the app doesn't use Android's automatic cloud backup (it is turned off). Connections to our servers and to third parties use HTTPS.

Changes to this policy

If we make a material change, we'll tell you in the app before it applies. The date above shows the latest revision.