Privacy Policy

Privacy Policy

Core commitment: security and no custody

• Qiryah does not hold money: it is not a bank, a brokerage or a digital wallet, and it does not hold funds in custody.
• Qiryah does not make transfers: no Pix, TED, SEPA, Bizum, bill payments or withdrawals.
• Qiryah does not connect to banks: we never ask for your banking password, token, card or access via Open Finance.
• Everything you record in the app (income, expenses, savings jars) is a personal, educational record. Your money always stays in your bank.

1. Overview

Qiryah takes the protection of your financial and family data seriously. This policy explains what we collect, why, and what your rights are. It follows the LGPD (Lei nº 13.709/2018, Brazil), the GDPR (Regulation (EU) 2016/679) and the LOPDGDD (Ley Orgánica 3/2018, Spain). The data controller is Qiryah; the contact details of the Data Protection Officer (DPO) are in the final section.

2. Data we collect

• Account: name, email and password (stored only as a hash). When you sign in with Google or Apple, we receive an identifier and the email of that account.
• Profile: language, currency, country and your onboarding answers (where you live, what weighs most on your budget).
• Financial data you enter yourself: income and expense entries, savings jars, limits per category. Nothing comes from banks.
• Learning progress: completed lessons, XP, coins, missions and badges.
• AI features: chat messages and the texts or images you send to the assistant (for example, a photo of a receipt or the text of your CV).
• Subscription: the purchase identifier issued by the store (Google Play or App Store). We never see or store card details.
• Technical data: app version and device language. Crash reports and usage metrics are only sent with your consent.
• In guest mode (without an account), your data stays only on your device.

3. Legal basis for processing

• Performance of a contract (LGPD art. 7, V / GDPR art. 6.1.b): calculating your budget, storing your records, syncing between devices and delivering the plan you subscribed to.
• Consent (LGPD art. 7, I / GDPR art. 6.1.a): educational personalisation by the AI, crash reports and usage metrics. You can turn each one on or off in the app, at any time.
• Legal obligation (LGPD art. 7, II / GDPR art. 6.1.c): tax records and app store requirements.
• Legitimate interest (LGPD art. 7, IX / GDPR art. 6.1.f): account security, fraud and abuse prevention, usage limits.
• Your financial data is never sold, rented or shared for advertising.

4. How long we keep your data

Your data is kept for as long as your account exists. You can delete your account at any time in the app (More → Privacy and data → Delete account): everything is erased immediately from our servers, and only a record of the deletion remains, with no personal data. Technical access logs are kept for up to 90 days for security. Backups are overwritten within 30 days.

5. Responsible artificial intelligence

The Qiryah assistant is an AI system with a strictly educational purpose (Regulation (EU) 2024/1689, art. 50). It does not provide investment advice, does not make automated credit decisions and does not evaluate you. Messages and images sent to the AI are processed by the Google Gemini API as a processor, under a contract that prohibits using that content to train public models. You can use the app without any AI feature.

6. Where your data is stored and international transfers

Qiryah's servers are located in a data centre in the European Union. The AI features (Google) may process data outside the EU, always covered by Standard Contractual Clauses (SCC) and the safeguards of the GDPR. The app stores (Google Play and App Store) handle billing under their own privacy policies.

7. Security

All communication uses TLS. Passwords are stored with argon2id; sessions use short-lived tokens with rotating renewal. Access to the servers is restricted and logged. No system is infallible: if an incident affects your data, you and the competent authority will be notified as required by law.

8. Children and teenagers

Qiryah is designed for people aged 18 and over. We do not knowingly collect data from minors; if this happens, we will delete it as soon as we become aware.

9. Changes and contact

Changes to this policy are announced in the app and published at https://www.qiryah.com/privacy. Questions or requests: dpo@qiryah.com.

Processors and Data Processing Agreements (DPA)

How we work with suppliers

We maintain data processing agreements (DPA) with all technology suppliers that handle personal data, requiring confidentiality, security measures and prompt incident response. None of them may use your data for their own purposes.

Infrastructure: servers in the European Union

• Role: processor (data processor).
• Purpose: hosting Qiryah's API and database.
• Safeguards: encryption in transit (TLS), key-restricted access, backups stored in the same region.

Google LLC: Gemini API (artificial intelligence)

• Role: processor for the AI features.
• Purpose: processing the questions, texts and images you send to the assistant.
• Guarantees: API usage contract that prohibits training models with the submitted content; Standard Contractual Clauses for international transfers.

Google Play and Apple App Store (subscriptions)

• Role: independent controllers for billing.
• Purpose: processing the purchase and renewal of the subscription; sending Qiryah only the receipt for validation.
• Qiryah does not receive card details.

Transactional email provider

• Role: processor.
• Purpose: sending account emails (password reset, deletion confirmation).
• Data: name, email and the content of the message.

Crash reports and usage metrics

• They only work with your consent, which can be withdrawn in the app.
• Crash reports: technical information about the error, without your financial data.
• Usage metrics: aggregated navigation events, stored on Qiryah's servers in the EU.

Your Rights as a Data Subject

What the law guarantees (LGPD art. 18 / GDPR arts. 15 to 22)

• Confirmation and access: know whether we process your data and obtain a copy.
• Rectification: update incomplete or outdated data (in the app, under More → Account).
• Portability: receive your data in an open format (JSON) to take to another service.
• Erasure: delete your account and everything in it.
• Withdrawal of consent: turn off personalised AI, crash reports and metrics.
• Information: know who we share data with (see the processors section).
• Objection and review: object to processing based on legitimate interest and request review of automated decisions (Qiryah does not make decisions of this kind).
• Complaint: to the ANPD (Brazil), the AEPD (Spain) or the authority of your country.

How to exercise them

• In the app: More → Privacy and data. There you can export your data in JSON, adjust your consents and delete your account, without having to ask anyone.
• By email: dpo@qiryah.com. We reply within 15 days (LGPD) or 1 month (GDPR), extendable as permitted by law when the request is complex.

Preferences and DPO

Data Protection Officer (DPO)

For formal requests, regulatory questions or the exercise of rights: dpo@qiryah.com.

Registered Data Protection Impact Assessment (RIPD/DPIA): DPIA-QIRYAH-2026-V1.

Data location: European Union.

Consent preferences

• Educational personalisation by AI: lets the assistant use your context (this month's budget, savings jars, priorities) to guide you better. When turned off, it answers in a generic way.
• Diagnostics and crash reports: sending technical errors to improve the app's stability.
• Aggregated usage metrics: navigation statistics to improve usability.

All of this is under More → Privacy and data and can be changed whenever you like; the core of the app does not depend on any consent.