This policy explains how Cuaderno de Deudas handles personal data. It applies to the Android app, the account and the associated services.
1. Who we are
- Owner: Antonio Sánchez, natural person.
- Location: Peru.
- Privacy and support email: [email protected]
- Website: antonioapps.com
- App: Cuaderno de Deudas
While the service does not generate charges, the owner operates as a natural person. If a company is incorporated later, this policy may be assumed by the new legal entity with its tax ID, after notice in the app and on this page.
2. Where it is available
The app is intended for businesses in Latin America and the United States. By using it from any of those countries you accept this policy and keep the rights granted by your local law. The list of available countries may vary according to the Google Play listing.
The app is not directed at the European Union or the United Kingdom at this stage.
3. Two different roles
The app processes two groups of data:
- Your account data (email, business, country, currency, plan). Here we are the controller.
- Your customers' or debtors' data (name, phone, photo, amounts, notes, due dates). Here you are the controller of that database and we act as a processor: we only store, sync and protect it to provide the service.
This means:
- You decide which customers you register and for what purpose.
- You must inform your customers and have a legal basis to process their data.
- We do not sell, rent or use that data for advertising.
- If one of your customers exercises their rights, you must respond as the controller; we help you execute the response.
4. What data we process
4.1 Data you give us
- Account: email and password. The password is stored as a hash by our authentication provider; we cannot read it.
- Business: name, country, currency and time zone.
- Optional profile: Yape number (Peru only) and WhatsApp message template.
- Customers: name, phone, optional credit limit and optional photo.
- Entries: type (credit sale or payment), amount, optional free-text note, date and optional due date.
- Support: the messages you send us.
4.2 Data generated by using the app
- User and device identifiers.
- Sync status and app version.
- Technical usage events (for example, sign-in or registration).
- Crash logs.
- Pro plan purchase receipts, if you subscribe.
4.3 Data we do not request
We do not access your contacts, SMS, calendar, microphone or location. We do not use advertising. We do not request storage permissions: photos are selected with the system picker.
4.4 Sensitive data
The app is not designed to record sensitive data (health, religion, politics, sexual orientation, biometric data of your customers). Please do not write such data in notes or photos. If you do, you are responsible for having the corresponding legal basis.
5. Why we use the data
| Purpose | Data | Legal basis |
|---|---|---|
| Create and maintain your account | Email, password, UUID | Performance of contract |
| Display and sync your notebook | Profile, customers, entries, photos | Performance of contract |
| Send local collection reminders | Due dates, business name | Performance of contract / consent |
| Prepare WhatsApp messages | Name, phone, amounts, template | Your express action when sending |
| Export your notebook to CSV | The whole notebook | Your express action |
| Validate the Pro plan | Purchases | Performance of contract |
| Measure stability and errors | Technical events, crashes | Legitimate interest in improving the service |
| Handle support and rights | The data you send us | Performance of contract / legal obligation |
| Comply with legal obligations | Purchases, legally required data | Legal obligation |
We do not make automated decisions that affect your rights. We do not build commercial profiles of your customers.
6. Who we share it with
We do not sell or rent personal data. To operate we use these processors:
| Provider | Service | Data |
|---|---|---|
| Supabase | Authentication, database, photo storage and functions | The whole notebook |
| Google Firebase | Analytics and crash reporting | Technical events, crashes, IDs |
| Google Play | App distribution and purchases | Google account, purchase data |
| Cloudflare | Hosting of the legal pages | Static content only |
We may also share data if required by law or a competent authority, if necessary to protect rights, safety or integrity, or in the event of a merger, acquisition or sale of assets, in which case we will notify you before your data is transferred to the new controller.
We do not share data with advertisers or data brokers.
7. How long we keep it
- Account and profile: while the account exists.
- Customers and entries: while the account exists. Customers you delete are removed from the database and your devices.
- Photos: while the customer or account exists.
- Purchases: while the account exists and for the period required by applicable accounting and tax regulations.
- Crashes: 90 days.
- Analytics: 14 months.
- Backups: up to 30 days from the provider's rotation. Backups may retain copies after deletion until they rotate.
When we no longer need data, we delete it irreversibly.
8. International transfers
Our providers may store and process data on servers outside Peru, including the United States. In those cases we require contractual and security measures equivalent to those we apply locally, in accordance with Law 29733 and its regulations.
9. How we protect data
- Encryption in transit with mandatory HTTPS; no plain traffic.
- Per-user access rules (RLS) in the database: each account only sees its own data.
- Photos in private storage, accessible only by the owner.
- Phone backups disabled so data does not go to Google's cloud or another device.
- Optional PIN and biometrics to lock the app.
- Limited server access; administrative keys are not included in the APK.
- Logs without names, phone numbers, notes or amounts.
No system is 100% secure. If a breach affects personal data, we will notify the authority and affected people within the legal deadlines.
10. Your rights
As the data subject you can:
- Access the data we hold about you.
- Rectify inaccurate or incomplete data.
- Delete your data when it is no longer necessary or the processing is unlawful.
- Object to a specific processing activity.
- Withdraw your consent when consent is the legal basis.
- Request information about how we process your data.
- Port your notebook: you can export it to CSV from Settings.
- File a complaint with the National Authority for Personal Data Protection (ANPD) if we do not respond.
To exercise them, write to [email protected] with your name, the account email and the right you want to exercise. We may ask for reasonable identity verification. We will respond within the legal deadline.
If you are a customer of a shop and want to exercise your rights over data that shop registered, you must contact the shop, which is the controller of that database. If you ask us, we will help channel the request, but the decision belongs to the shop.
10.1 Rights by country
In addition to the rights above, your country's law may grant you others. These are the minimums we respect:
| Country | Main law | Additional or special rights |
|---|---|---|
| Peru | Law 29733 and D.S. 016-2024-JUS | Access, rectification, deletion, objection, information, ANPD |
| Mexico | LFPDPPP and its regulations | Access, rectification, deletion, objection, limitation of use, withdrawal of consent |
| Colombia | Law 1581 of 2012 and Decree 1377 | Know, update, rectify, delete, withdraw, complain to the SIC |
| Chile | Law 19.628 and Law 21.719 | Access, rectification, deletion, objection, portability, blocking |
| Argentina | Law 25.326 | Access, rectification, deletion, confidentiality; AAIP |
| Uruguay | Law 18.331 | Access, rectification, deletion, objection; URCDP |
| Costa Rica | Law 8968 | Access, rectification, deletion, objection; PRODHAB |
| Panama | Law 81 of 2019 | Access, rectification, deletion, objection; ANTAI |
| Dominican Republic | Law 172-13 | Access, rectification, deletion, objection |
| Paraguay | Law 6534/2020 | Access, rectification, update, deletion, objection |
| Ecuador | Organic Law on Personal Data Protection | Access, rectification, deletion, objection, portability |
| United States | State laws, e.g. CCPA/CPRA in California | Know, delete, correct, opt out of sale/sharing, non-discrimination |
If local law grants you a broader right, it prevails over this policy. Write to us and we will handle it.
11. Delete your account and data
You can delete your account from Settings → Delete my account or from the Delete account page.
When you do:
- Your customers' photos are deleted from storage.
- Your authentication user is deleted.
- Your profile, customers, entries, devices and purchases are deleted in cascade.
Backups may take up to 30 days to rotate. Purchase records may be retained for accounting and tax obligations.
Important about your customers: deleting your account also deletes their data. If you need to keep a history for accounting reasons, export it to CSV before deleting the account.
11.1 Delete an individual customer
You can delete a customer without closing your account. When you do, the following is deleted from the database and your devices:
- Name, phone, photo and credit limit.
- All credit sales and payments.
- The notes on those entries.
- The associated dates and due dates.
Only an identifier without personal data is kept so the deletion propagates to the other phones in the business.
If the customer has an outstanding debt, they cannot be deleted: you must first settle or offset it. This prevents losing a real debt record.
12. Minors
The app is intended for people over 18 who manage a business. It is not directed at minors and we do not knowingly collect data from minors. If we detect a minor's account, we will close it. Do not record minors' data in notes or customer photos.
13. Notifications and WhatsApp
The app may send you local collection reminders if you authorize them. They are calculated on your phone and are not sent to third parties. You can disable them in Settings or in your system settings.
The app does not send WhatsApp messages automatically. It only opens WhatsApp with a text you review and send.
14. Cookies and similar technologies
The Android app does not use advertising cookies. The website hosting this policy may use strictly necessary cookies for hosting and security. We do not use analytics or advertising cookies on this site.
15. Payments and free beta
The app is in a free beta for a limited time. There is no fixed number of users or published charging date: the Owner will decide when to move to a subscription and will notify users in the app and on the Google Play listing with reasonable advance notice. Accounts created during the beta do not acquire a permanent right to free service unless expressly stated.
If you subscribe to the Pro plan, payment is processed through Google Play. We do not receive or store card numbers. Google tells us the product, status and purchase identifier to activate the plan. While the service is free, no payment data is collected.
16. Changes to this policy
We may update this policy due to legal or product changes. We will publish the new version with its date and, if the change is material, notify you in the app or by email before it takes effect. If the change requires your consent, we will ask for it expressly.
17. Contact and complaints
- Privacy: [email protected]
- Support: [email protected]
- Location: Peru
If you are not satisfied with our response, you can contact the National Authority for Personal Data Protection (ANPD), under the Ministry of Justice and Human Rights of Peru.