Privacy policy
This policy explains how Quiova Labs (“we”, “Quiova Labs”) processes personal information in connection with (1) the website quiovalabs.com (the “Site”) and (2) the Yavara mobile application for Android distributed via Google Play (the “App”).
Please read the Site and App sections carefully: processing differs. In particular, financial data you import into Yavara is processed and stored on your device; data leaves the device only in the limited cases described below—and, where applicable, with consent (opt-in analytics, purchases, and optional synthetic template contribution).
Controller: Quiova Labs, Barcelona, Spain. Privacy contact: quiovalabs@gmail.com. Canonical URLs: https://quiovalabs.com/en/privacy/ and https://quiovalabs.com/es/privacy/.
1. Controller
The data controller is Quiova Labs, based in Barcelona, Spain.
If we operate under a specific legal entity, we will update this section with the company name, tax ID (NIF/CIF), and registered address once publicly available. In the meantime, you can exercise your rights and ask questions at quiovalabs@gmail.com.
2. Scope of this policy
This policy covers:
- The Site (quiovalabs.com), including the waiting list and web cookies/analytics with consent.
- The Yavara App (Android / Google Play), including on-device financial data processing, opt-in in-app analytics, purchases/subscriptions, and optional synthetic template contribution.
3. Website (quiovalabs.com) — Data we collect
Depending on how you use the Site, we may process:
- Waiting list: name (optional), email address, preferred platform, and, if you indicate it, consent for product-related communications.
- Technical browsing data: approximate IP address, device/browser type, pages viewed, and interaction events, only when you accept analytics cookies in the consent banner.
- Communications: content you send to quiovalabs@gmail.com (for example support or privacy requests).
4. Website — Purposes and legal bases
We use Site data to:
- Run the waiting list and notify you about early access or other Yavara / Quiova Labs updates (legitimate interest and/or consent when you opt in via the form).
- Measure Site usage in aggregate via analytics (cookie consent where required).
- Respond to support, legal, or privacy requests (legitimate interest and, where applicable, legal obligation).
- Comply with applicable EU / Spanish law.
5. Website — Cookies and analytics
We use PostHog Cloud (hosted in the EU) to measure Site usage only if you accept analytics cookies in the consent banner. If you do not accept, no analytics tool is loaded and no browsing data is sent.
You can accept or reject on first visit. We do not use third-party advertising cookies for remarketing on the Site.
6. Yavara App — Overview
Yavara is a personal-finance app. There is no user account in the App. There are no in-app ads and no use of Advertising ID. The App is not directed to children under 16.
Yavara does not connect to banks via Open Banking and does not ask for bank credentials. You upload statements (for example CSV, Excel, PDF, or photo). Financial processing happens on your device.
We do not claim that data “never leaves the device”: there are three limited pathways described below (analytics/diagnostics with consent; purchases/subscriptions via Google Play and RevenueCat; and optional synthetic template contribution to Firebase).
7. Yavara App — Financial data (on-device only)
Financial data you generate or import in Yavara—including transactions, categories, and detected subscriptions—is processed and stored only on your device, in a local database encrypted at rest.
Quiova Labs does not run automatic cloud backups of your finances to our servers. JSON export and “delete all data” operate on local device data.
We do not use your financial data to train remote third-party AI models or for advertising. Any automation described in the product is meant to help you on-device.
8. Yavara App — Analytics and diagnostics (PostHog, opt-in)
In-app analytics is off by default. It is enabled only if you give explicit consent in Settings → Privacy.
If you consent, we use PostHog Cloud in the EU for aggregated events subject to an allowlist. We do not send amounts, merchants, IBANs, OCR text, file names, or other financial PII. With the same consent, crash/diagnostic reports may also be sent. Identity is anonymous (no person profiles).
You can withdraw consent by turning the option off in Settings → Privacy. Withdrawal does not by itself erase events already sent to PostHog; to request deletion of data already transmitted, contact quiovalabs@gmail.com.
9. Yavara App — Purchases and subscriptions
Premium purchases and subscriptions are handled via Google Play Billing and RevenueCat (purchase/subscription history and restore). Quiova Labs does not store card numbers or full payment details: charging is processed by Google Play under its terms.
Legal basis: performance of a contract / pre-contractual steps when you buy or restore Premium and, where applicable, legitimate interest to prevent fraud and manage entitlements.
10. Yavara App — Optional “help us support your bank” contribution
You may optionally choose—only after confirming following a preview—to send a synthetic statement template (file shape: headers, formats, lengths, amount sign conventions, etc.) to help us improve bank/format support.
That template is sent to Firebase (Quiova project), with Firebase anonymous authentication used only for that flow. The real statement is never sent, nor are real balances, IBANs, or merchants.
Firebase Storage may be part of the technical stack, but it is not used today to upload files; we do not treat Storage as an active upload channel. Legal basis: consent. You can decline; the App works without this contribution.
Deleting local App data does not remove templates already sent to Firebase. To request deletion of contributions already submitted, email quiovalabs@gmail.com.
11. Yavara App — Local export and deletion
JSON export and “delete all data” operate on the device. A local wipe removes local financial and App usage data, but does not automatically erase: (a) events already sent to PostHog (if you enabled analytics), or (b) templates already sent to Firebase (if you contributed). For those cases, contact quiovalabs@gmail.com.
Purchase/subscription records in Google Play / RevenueCat are governed by those providers; you can manage subscriptions in Google Play.
12. Processors / providers
We may use providers that process data on our behalf or as independent platforms, depending on the case:
- Site hosting (for example Netlify) — web infrastructure.
- PostHog Cloud (EU) — Site analytics (only with cookie consent) and App analytics and diagnostics (only with in-app consent).
- Google Play Billing — Android payment/subscription processing.
- RevenueCat — Premium purchase/subscription management and restore.
- Firebase / Google (Quiova project) — anonymous auth and receipt of synthetic templates in the opt-in contribution flow (Storage not used today for uploads).
- Email (quiovalabs@gmail.com / Google) — support and privacy communications.
13. International transfers
Some providers may process data outside the European Economic Area. Where international transfers occur, we apply safeguards required under applicable law (for example standard contractual clauses or other recognized mechanisms), together with appropriate security measures.
PostHog Cloud for the Site and the App is configured in the EU. Google (Play, Firebase/email) may involve processing with international scope under their policies; please also review those providers’ policies.
14. Retention
Site: we keep waiting-list emails while the list is active or until you ask to be removed; web analytics retention follows our PostHog settings; support emails are kept as needed to handle the request and meet legal obligations.
App — financial data: remains on your device until you delete it or uninstall the App (subject to OS behaviour).
App — PostHog: for as long as a lawful basis exists (consent) and according to retention configured in PostHog; after consent withdrawal we stop sending new events.
App — Firebase templates: for as long as needed to improve format support, or until you request deletion when we can reasonably identify them.
Purchases: transaction/entitlement records are retained according to Google Play, RevenueCat, and applicable accounting/tax obligations.
15. Your rights (GDPR / Spain)
If you are in the EEA / Spain, you may request access, rectification, erasure, restriction, portability, and objection, and withdraw consent where processing is consent-based, without affecting the lawfulness of prior processing.
You may also lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es.
To exercise rights regarding data Quiova Labs processes (waiting list, emails, PostHog events already sent, Firebase templates already sent, etc.), email quiovalabs@gmail.com stating the right and a contact channel. We may ask for reasonable information to verify your identity.
For data that exists only on your device, you can export or delete it in the App. For data processed by Google Play or other independent providers, you may also need to exercise rights with them.
16. Children
The Site and the App are not directed to children under 16. We do not knowingly collect children’s data. If you believe a child has provided us with data, contact quiovalabs@gmail.com so we can delete it where appropriate.
17. Changes
We may update this policy. We will post the “last updated” date at https://quiovalabs.com/en/privacy/ (and the corresponding Spanish version). For material changes, we may email you when we have your address (for example, waiting list) and/or provide reasonable notice in the App or on the Site.